# Sony DRM malware **URL:** \ **Category:** The BBQ Pit\ **Created:** [November 2, 2005, 8:45pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162 "2005-11-02T20:45:05Z")\ **Posts on this page:** 20\ **Page:** 4
**Author:** ![Tabby\_Cat](https://avatars.discourse-cdn.com/v4/letter/t/6a8cbe/32.png) [@Tabby\_Cat](https://boards.straightdope.com/u/Tabby_Cat)\ **Post date:** [November 7, 2005, 6:23pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/61 "2005-11-07T18:23:27Z")
HOLY BLEEP!!! IT PHONES HOME!!! :mad: [Sony Rootkit Phones Home](http://games.slashdot.org/games/05/11/07/1221209.shtml?tid=233&tid=207&tid=10) > [@](#): > > strider44 writes "Mark from Sysinternals has digged a little deeper into the Sony DRM and discovered it Phones Home with an ID for the CD being listened to. XCP Support claims that “The player has a standard rotating banner that connects the user to additional content (e.g. provides a link to the artist web site). The player simply looks online to see if another banner is available for rotation. The communication is one-way in that a banner is simply retrieved from the server if available. No information is ever fed back or collected about the consumer or their activities.” Yeah, right. Like I trust you XCP malware writers. (someone come up with a better derogratory term? Please?) ---
**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\ **Post date:** [November 7, 2005, 6:24pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/62 "2005-11-07T18:24:39Z")
> [@casdave](#): > > I wonder about the outrage expressed, given that iPod software makes itself the default digital player on your computer, and it will not let you use anything else. > > I have come across those who even removed it, but still can’t use winamp, seems to me that maybe Apple has some way of getting its hooks deep into your registry. > > Why is there no outrage about this ? I don’t have an iPod, but I’ve used iTunes occasionally, even bought an album from it, and I’ve had no problems not using it as my media player (and using Winamp). On two different computers. I suppose there’s no outrage because the situation you describe is rare, whereas the DRM gets installed on the majority of computers of those who put that CD in their computer. Hopefully enough people will turn off autorun on their drives so that the DRM affects as few or fewer people. Here’s that URL again everybody: [http://www.annoyances.org/exec/show/article03-018](http://www.annoyances.org/exec/show/article03-018) Seriously, everybody needs to send this link to everybody they know who might play CDs in their PCs. Once autorun is out of the picture, all these DRM malwares are almost rendered inert (they can still be loaded manually unfortunately, and it’s easy to do so accidentally) Since they still have to make the discs play in standard CD players, it will be extremely difficult for them to prevent a non-autorunning PC from treating the disc like a standard old-style non-DRM CD. ---
**Author:** ![rayh](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rayh](https://boards.straightdope.com/u/rayh)\ **Post date:** [November 10, 2005, 8:42pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/63 "2005-11-10T20:42:34Z")
And now for the good news. Sony BMG are facing at least three law suits over this, possibly more. Symantec says it has tools which can find the files but not remove them. Comperter Associates says it will be releasing a tool to uninstall the XCP files. Kaspersky Labs nas branded the XCP program spyware because it hides itself, could compromise security and can slow machines down. Full story [here.](http://news.bbc.co.uk/1/hi/technology/4424254.stm) ---
**Author:** ![Dante](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dante/32/9673_2.png) [@Dante](https://boards.straightdope.com/u/Dante)\ **Post date:** [November 10, 2005, 9:09pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/64 "2005-11-10T21:09:48Z")
Just in case there aren’t enough links in this thread, [here’s](http://www.theinquirer.net/?article=27426) the Inquirer’s excellent article about it. Gets a little bit into the EULA as well. NOTE: Inquirer (tech website), not The Enquirer (gossip rag). ---
**Author:** ![Duke\_of\_Rat](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Duke\_of\_Rat](https://boards.straightdope.com/u/Duke_of_Rat)\ **Post date:** [November 10, 2005, 9:18pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/65 "2005-11-10T21:18:18Z")
And virus writers have developed a virus to exploit the Sony DRM malware… [http://blogs.washingtonpost.com/securityfix/2005/11/virus\_writers\_e.html](http://blogs.washingtonpost.com/securityfix/2005/11/virus_writers_e.html) ---
**Author:** ![Ponder\_Stibbons](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ponder_stibbons/32/343_2.png) [@Ponder\_Stibbons](https://boards.straightdope.com/u/Ponder_Stibbons)\ **Post date:** [November 10, 2005, 9:18pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/66 "2005-11-10T21:18:48Z")
Daaaaaaaaamn. I hope I haven’t accidentally put any Sony disks in my player lately. Fortunately the only CD’s I’ve bought lately has been old fart shit like Neil Young and Pink Floyd, so I’m hoping I’m OK. Hmmm. But the CD drive _itself_ is a Sony. You don’t suppose … ??? ---
**Author:** ![Ponder\_Stibbons](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ponder_stibbons/32/343_2.png) [@Ponder\_Stibbons](https://boards.straightdope.com/u/Ponder_Stibbons)\ **Post date:** [November 10, 2005, 9:23pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/67 "2005-11-10T21:23:09Z")
BTW, great article **Dante** , I found it very informative. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [November 10, 2005, 10:44pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/68 "2005-11-10T22:44:36Z")
Sony offers a what the customer doesn’t know won’t hurt them defense. ---
**Author:** ![Nightsong](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/nightsong/32/3083_2.png) [@Nightsong](https://boards.straightdope.com/u/Nightsong)\ **Post date:** [November 10, 2005, 11:34pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/69 "2005-11-10T23:34:03Z")
You know, in some ways the timing on this couldn’t be better: I’m writing up a cyber ethics paper so I can finally get out of graduate school, and this is _perfect_ for what I’m discussing. 😃 That being said, though, Sony has definately gone way too far with their quest for the ‘perfect’ DRM. They haven’t thought about the impact to the consumer in a long time, except in terms of ‘how can we get even more money out of them’. :mad: * * * \<\< One cat leads to another. \>\> ---
**Author:** ![Tuckerfan](https://avatars.discourse-cdn.com/v4/letter/t/eada6e/32.png) [@Tuckerfan](https://boards.straightdope.com/u/Tuckerfan)\ **Post date:** [November 11, 2005, 12:01am UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/70 "2005-11-11T00:01:33Z")
[Here come the lawyers!](http://news.bbc.co.uk/1/hi/technology/4424254.stm) 🆒 (Link also contains listing of tainted CDs. If you like Ricky Martin, I’d be worried.) ---
**Author:** ![E-Sabbath](https://avatars.discourse-cdn.com/v4/letter/e/e19adc/32.png) [@E-Sabbath](https://boards.straightdope.com/u/E-Sabbath)\ **Post date:** [November 11, 2005, 1:02am UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/71 "2005-11-11T01:02:46Z")
Just to make things more interesting… > **[First Trojan using Sony DRM spotted](https://www.theregister.com/2005/11/10/sony_drm_trojan/)** > > Roots you, Sir There is now a trojan that takes advantage of the sony product. This should, if I remember my cybercrime laws, qualify them for proscecution in the United States. If anyone felt like taking Sony to criminal task. They are aiding and abetting felons. ---
**Author:** ![duffer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duffer/32/1026_2.png) [@duffer](https://boards.straightdope.com/u/duffer)\ **Post date:** [November 11, 2005, 1:48am UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/72 "2005-11-11T01:48:21Z")
> [@Tuckerfan](#): > > (Link also contains listing of tainted CDs. If you like Ricky Martin, I’d be worried.) Sp would I. But I think this shit Sony is trying to pull is cause for concern as well. 😃 ---
**Author:** ![rayh](https://avatars.discourse-cdn.com/v4/letter/r/e79b87/32.png) [@rayh](https://boards.straightdope.com/u/rayh)\ **Post date:** [November 11, 2005, 1:27pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/73 "2005-11-11T13:27:49Z")
[More](http://news.bbc.co.uk/1/hi/technology/4427606.stm) on the Sony virus. The number of class action law suits against Sony is now up to six. > [@](#): > > In response to the concerns, Sony has released a statement “deeply regretting any disruption that this may have caused.” It added that it would work with anti-virus firms to ensure its anti-piracy system stayed safe. Stayed safe??? If this shit wasn’t on your machine, it wouldn’t have been compromised. ---
**Author:** ![Ponder\_Stibbons](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ponder_stibbons/32/343_2.png) [@Ponder\_Stibbons](https://boards.straightdope.com/u/Ponder_Stibbons)\ **Post date:** [November 11, 2005, 2:17pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/74 "2005-11-11T14:17:50Z")
Another article on this subject: [http://www.nytimes.com/2005/11/09/technology/circuits/09POGUE-EMAIL.html](http://www.nytimes.com/2005/11/09/technology/circuits/09POGUE-EMAIL.html) Apparently, according to this article, Sony has given up on the protection scheme for future CD’s, but still (of course) admits doing nothing wrong. > [@Sony Spokesman via NY Times](#): > > It’s benign content protection. It’s not malware, it’s not spyware—it’s innocent. … When the issue arose, we addressed it very quickly. ---
**Author:** ![Bag\_of\_Mostly\_Water](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bag_of_mostly_water/32/1029_2.png) [@Bag\_of\_Mostly\_Water](https://boards.straightdope.com/u/Bag_of_Mostly_Water)\ **Post date:** [November 11, 2005, 5:48pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/75 "2005-11-11T17:48:25Z")
It looks like Sony is now including something similar for MacOS X. The following was posted in today’s Macintouch. (No link. A link would only be valid for today.) > [@](#): > > Darren Dittrich followed up on the discovery that Sony was playing a dirty trick on its customers, secretly installing a malware-style “root kit” on their computers via audio CDs: > > I recently purchased Imogen Heap’s new CD (Speak for Yourself), an RCA Victor release, but with distribution credited to Sony/BMG. Reading recent reports of a Sony rootkit, I decided to poke around. In addition to the standard volume for AIFF files, there’s a smaller extra partition for “enhanced” content. I was surprised to find a “Start.app” Mac application in addition to the expected Windows-related files. Running this app brings up a long legal agreement, clicking Continue prompts you for your username/password (uh-oh!), and then promptly exits. Digging around a bit, I find that Start.app actually installs 2 files: PhoenixNub1.kext and PhoenixNub12.kext. > Personally, I’m not a big fan of anyone installing kernel extensions on my Mac. In Sony’s defense, upon closer reading of the EULA, they essentially tell you that they will be installing software. Also, this is apparently not the same technology used in the recent Windows rootkits (made by XCP), but rather a DRM codebase developed by SunnComm, who promotes their Mac-aware DRM technology on their site. This doesn’t seem as bad as what is done under Windows. If only these two files are installed, removing them would be very easy. Also, the installer on the CD does not auto run and you must type in an administrator password before anything is installed. ---
**Author:** ![Dag\_Otto](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Dag\_Otto](https://boards.straightdope.com/u/Dag_Otto)\ **Post date:** [November 11, 2005, 7:53pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/76 "2005-11-11T19:53:57Z")
> [@Dante](#): > > Just in case there aren’t enough links in this thread, [here’s](http://www.theinquirer.net/?article=27426) the Inquirer’s excellent article about it. Gets a little bit into the EULA as well. > > NOTE: Inquirer (tech website), not The Enquirer (gossip rag). That site also has [this story](http://www.theinquirer.net/?article=27568) about how Sony might modify Playstation games to “ensure that no game would be playable from any console other than the one in which it was first read”. Nothing definite, but now I don’t doubt Sony would do try it. ---
**Author:** ![Sunspace](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunspace/32/1250_2.png) [@Sunspace](https://boards.straightdope.com/u/Sunspace)\ **Post date:** [November 11, 2005, 8:04pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/77 "2005-11-11T20:04:32Z")
A while back, there was an article in Wired, entitled “The Civil War Inside Sony”. It described how two major factions battled within Sony: the hardware developers, who wanted to create more and more hardware capable of doing more and more recording and playback, and the content mongers, who wanted to release their movies and music as restrictively as possible. The conclusion of the article was that the unresolved civil war was leading Sony to create potentially-great products that were crippled by technically-unnecessary restrictions, and the company was suffering major sales losses as a result. Looks like the Bad Side of the content mongers won the war. ---
**Author:** ![Ponder\_Stibbons](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ponder_stibbons/32/343_2.png) [@Ponder\_Stibbons](https://boards.straightdope.com/u/Ponder_Stibbons)\ **Post date:** [November 11, 2005, 10:02pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/78 "2005-11-11T22:02:45Z")
This just in on MSNBC: [Sony halts music CDs with anti-piracy scheme](http://www.msnbc.msn.com/id/10005667/) > [@](#): > > Stung by continuing criticism, … Sony BMG Music Entertainment, promised Friday to temporarily suspend making music CDs with antipiracy technology that can leave computers vulnerable to hackers. ---
**Author:** ![Ponder\_Stibbons](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ponder_stibbons/32/343_2.png) [@Ponder\_Stibbons](https://boards.straightdope.com/u/Ponder_Stibbons)\ **Post date:** [November 11, 2005, 10:15pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/79 "2005-11-11T22:15:42Z")
In a [related article](http://www.msnbc.msn.com/id/9973890/): > [@Bob Sullivan](#): > > But the disclosure and the controversy have opened anew some basic questions: Whose PC is it? I’ll tell you whose PC it is. It’s _my_ fucking PC. And this whole episode has made me very leery of ever buying anything Sony ever again. ---
**Author:** ![duffer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duffer/32/1026_2.png) [@duffer](https://boards.straightdope.com/u/duffer)\ **Post date:** [November 11, 2005, 10:56pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/80 "2005-11-11T22:56:34Z")
> [@Dag Otto](#): > > That site also has [this story](http://www.theinquirer.net/?article=27568) about how Sony might modify Playstation games to “ensure that no game would be playable from any console other than the one in which it was first read”. Nothing definite, but now I don’t doubt Sony would do try it. I’ll admit I haven’t read the article yet, but how exactly will this work in the arena of game rentals? [Previous page](https://boards.straightdope.com/t/sony-drm-malware/329162.md?page=3) [Next page](https://boards.straightdope.com/t/sony-drm-malware/329162.md?page=5)