# Sony DRM malware **URL:** \ **Category:** The BBQ Pit\ **Created:** [November 2, 2005, 8:45pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162 "2005-11-02T20:45:05Z")\ **Posts on this page:** 20\ **Page:** 7
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [November 13, 2005, 2:24pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/121 "2005-11-13T14:24:06Z")
> [@Silentgoldfish](#): > > The good news there is that EULA’s are completely unenforceable in a court. Because it’s a contract that occurs after the point of sale they’re considered null and void and you can click “yes” to as many as you want without fear of reprisal when you fail to do stuff like fail to delete all your music when you go bankrupt. > > Does that count as legal advice? It’s a pretty open secret anyway. They’re as useful as those things you sign going into surgery that state that if the doctor screws up (s)he’s not liable for damages. Those haven’t exactly stopped successful malpractice suits. You list your location as Brisbane - perhaps in Australia it’s “completely unenforceable”. However, in the US things are not the same. See this article for an example - scroll down until you hit _ProCD, Inc. v. Zeidenberg_. > [@](#): > > Case authority exists on both sides for the enforceability of shrink-wrap licenses under current state contract law, but more recent cases have validated such licenses. In ProCD, Inc. v. Zeidenberg, the U.S. Seventh Circuit Court of Appeals ruled that shrink-wrap terms are enforceable for software purchased from a retail store. The court characterized the shrink-wrap license as an “offer” that the buyer “accepted” by using the software without objection after having an opportunity to review the terms. [http://www.gigalaw.com/articles/2000-all/uhlfelder-2000-12-all.html](http://www.gigalaw.com/articles/2000-all/uhlfelder-2000-12-all.html) Mind you, this article if from 2000, but AFAIK case law since that time has continued to support the validity of shrink-wrap licenses. Note as well that some States in the US may have other legislation impacting this; since I do not know how many, I will not make a claim as to “most” or “few”. ---
**Author:** ![Silentgoldfish](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@Silentgoldfish](https://boards.straightdope.com/u/Silentgoldfish)\ **Post date:** [November 13, 2005, 2:35pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/122 "2005-11-13T14:35:54Z")
My understanding is that because it’s another contract that they want you to digitally sign (the I Agree) that occurs AFTER the point of sale it’s invalid. If it was visible before you bought whatever the software was it would hold weight but because you can’t see an EULA without already purchasing the product it’s not considered part of the deal you made when you purchased whatever. ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [November 13, 2005, 2:37pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/123 "2005-11-13T14:37:50Z")
> [@Ponder Stibbons](#): > > In a [related article](http://www.msnbc.msn.com/id/9973890/): > > I’ll tell you whose PC it is. It’s _my_ fucking PC. And this whole episode has made me very leery of ever buying anything Sony ever again. No offense dude, but all this has only made you “very leery”? What would it take for you to actually permanently boycott a pathetic company like this - them reformatting your hard drive every time you put in Neil Diamond’s Greatest Hits? ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [November 13, 2005, 2:58pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/124 "2005-11-13T14:58:14Z")
> [@Silentgoldfish](#): > > My understanding is that because it’s another contract that they want you to digitally sign (the I Agree) that occurs AFTER the point of sale it’s invalid. If it was visible before you bought whatever the software was it would hold weight but because you can’t see an EULA without already purchasing the product it’s not considered part of the deal you made when you purchased whatever. No offence to yourself either, but _how_ is this your understanding? Do you have a cite or reference you are thinking of specifically? I’m not saying you’re wrong, but I want to know what your evidence is for insisting that you are right. I posted a cite saying that that is not the case in the US (I say nothing with respect to Australia in terms of IP law). My understanding from a Report I started and never finished a while ago is that the UCC in the US allows for these EULAs with software as a special case, and therefore they are legal and enforceable within the US, within reason. Plus, as I said, State laws also come into play. See for example _Mortenson v. Timberline Software Corporation, et al_ > [@](#): > > In this May 4, 2000 decision (M.A. Mortenson Company, Inc., v. Timberline Software Corporation and Softworks Data Systems, Inc.), the Supreme Court of the state of Washington upheld a lower court ruling that validated a shrinkwrap software license. See also _Ticketmaster Corp., et al. v. [Tickets.com](http://Tickets.com), Inc._ (U.S. District Court for the Central District of California) > [@](#): > > ‘In defending this claim, Ticketmaster makes reference to the “shrink-wrap license” cases, **where the packing on the outside of the CD stated that opening the package constitutes adherence to the license agreement (restricting republication) contained therein. This has been held to be enforceable.** That is not the same as this case because the “shrink-wrap license agreement” is open and obvious and in fact hard to miss. Many web sites make you click on “agree” to the terms and conditions before going on, but Ticketmaster does not. Further, the terms and conditions are set forth so that the customer needs to scroll down the home page to find and read them. Many customers instead are likely to proceed to the event page of interest rather than reading the “small print.” It cannot be said that merely putting the terms and conditions in this fashion necessarily creates a contract with any one using the web site.’ (emphasis added) Note that it said opening the packaging constitued acceptance of the terms and conditions inside the package. Note as well that in this last case, they validate shrink-wrap agreements, **but** make a distinction for agreements which are “hard to miss” in terms of the Ticketmaster website. Note here in Kansas where Judge Vratil (nice woman, actually, who I’ve met) in Klocek v. Gateway, Inc., 41 UCCRS 2d 1059, 2000 WL 967459 (D. Kansas, June 15, 2000) found against Gateway’s shrink-wrap agreement: > [@](#): > > Court holds that Gateway’s Standard Terms and Conditions, supplied along with and inside the packaging of a computer purchased by the plaintiff, do not create a binding contract with that consumer under either the law of either Missouri or Kansas. The court reached this conclusion despite the fact that the Standard Terms provide that they will constitute the terms of such an agreement if the consumer retains the computer for more than 5 days, and the consumer so retained the computer. [http://www.phillipsnizer.com/library/cases/lib\_case209.cfm](http://www.phillipsnizer.com/library/cases/lib_case209.cfm) The short answer is, you cannot definitively say that they are completely unenforceable or that they are completely enforceable in the US. ---
**Author:** ![Silentgoldfish](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@Silentgoldfish](https://boards.straightdope.com/u/Silentgoldfish)\ **Post date:** [November 13, 2005, 4:13pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/125 "2005-11-13T16:13:25Z")
Best of my knowledge I’m just talking basic contract law – are you referring specifically to EULA’s when you are talking “shrink-wrap” agreement? A contract is formed when there has been offer and acceptance plus consideration (ie payment in the form of cash or contra) and that any purported attempt to impose further obligations thereafter would have to be the subject of a separate, collateral contract to be enforceable. The doctrine of collateral contract is in Heilbut, Symons & Co v. Buckleton [1913] AC 30 – “‘If you make such and such a contract I will give you 100 pounds’ is in every sense a complete legal contract.” There is no consideration for the purported collateral contract because the principal contract has already been executed and the further terms are therefore no contract at all. ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [November 13, 2005, 4:36pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/126 "2005-11-13T16:36:40Z")
> [@Silentgoldfish](#): > > Best of my knowledge I’m just talking basic contract law – are you referring specifically to EULA’s when you are talking “shrink-wrap” agreement? > > A contract is formed when there has been offer and acceptance plus consideration (ie payment in the form of cash or contra) and that any purported attempt to impose further obligations thereafter would have to be the subject of a separate, collateral contract to be enforceable. The doctrine of collateral contract is in Heilbut, Symons & Co v. Buckleton [1913] AC 30 – “‘If you make such and such a contract I will give you 100 pounds’ is in every sense a complete legal contract.” > > There is no consideration for the purported collateral contract because the principal contract has already been executed and the further terms are therefore no contract at all. But here again, as I posted twice before, is the difference US versus Australia? As I posted now thrice, if you’re talking Australia, then I have no comment. If you’re talking US, then I do. ---
**Author:** ![Silentgoldfish](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@Silentgoldfish](https://boards.straightdope.com/u/Silentgoldfish)\ **Post date:** [November 13, 2005, 4:42pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/127 "2005-11-13T16:42:57Z")
> [@Una Persson](#): > > But here again, as I posted twice before, is the difference US versus Australia? As I posted now thrice, if you’re talking Australia, then I have no comment. If you’re talking US, then I do. I’m talking commonwealth countries. But it’s basic enough (I’m no lawyer) that I don’t understand from a legal point why it’s not similiar in the US. It strikes me as against fair trade to allow bit to be added to a contract after point of sale. ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [November 13, 2005, 5:00pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/128 "2005-11-13T17:00:45Z")
> [@Silentgoldfish](#): > > I’m talking commonwealth countries. But it’s basic enough (I’m no lawyer) that I don’t understand from a legal point why it’s not similiar in the US. It strikes me as against fair trade to allow bit to be added to a contract after point of sale. Could be. There are several efforts to reform it, however, they go to both sides of the extreme in some cases. ---
**Author:** ![kanicbird](https://avatars.discourse-cdn.com/v4/letter/k/5f8ce5/32.png) [@kanicbird](https://boards.straightdope.com/u/kanicbird)\ **Post date:** [November 13, 2005, 5:08pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/129 "2005-11-13T17:08:23Z")
I think it could be argued that there are really 2 EULA’s. The 1st one is accepted when you break the shrinkwrap, which basically aloows you to play it on a music CD player. The 2nd one is if you use in on a PC, which you have to qaccept them f’n up yoru computer if you want to use the disk there, not accepting it at that point does not prohibit you from listening on the music CD equipment. Also I have my PC set to display a list of options (open folder, play music using etc.) Does this mean I am in danger of that crap being installed? ---
**Author:** ![Dag\_Otto](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Dag\_Otto](https://boards.straightdope.com/u/Dag_Otto)\ **Post date:** [November 13, 2005, 5:25pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/130 "2005-11-13T17:25:49Z")
> [@Una Persson](#): > > The short answer is, you cannot definitively say that they are completely unenforceable or that they are completely enforceable in the US. What do you mean by ‘enforceable’? I agree that if you click on the ‘I agree’ button during installation after the terms of the EULA are fully disclosed you are bound to the agreement. However, if you don’t agree, are you simply out of your money? I think that’s the part that rankles most people. What would solve this would be a process to refund the money as soon as the user clicked ‘I don’t agree’. In that case, the software could send a report to the publisher with some basic information about the machine and perhaps the CD key, and give the user a reasonable amount of time (say 30 days) to send the software and a copy of the receipt to the publisher. It wouldn’t be perfect because it would probably take as long as getting a mail in rebate but the user would get his money back, but it would be fair. Another option could be to e-mail the user an ‘authorization to return’ which the retailer would need in order to refund the money. There may be technical problems to this, but the solution couldn’t be near as complex as installing a rootkit, which at least one publisher has demonstrated a willingness to do. [imho] Looking at the CDs that have the rootkit program, does anyone else think that Sony is trying to protect some mediocre music? It’s sort of like locking up the stainless steel flatware and leaving the silver out in the open. [/imho] ---
**Author:** ![Silentgoldfish](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@Silentgoldfish](https://boards.straightdope.com/u/Silentgoldfish)\ **Post date:** [November 13, 2005, 5:49pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/131 "2005-11-13T17:49:41Z")
> [@Dag Otto](#): > > What do you mean by ‘enforceable’? I agree that if you click on the ‘I agree’ button during installation after the terms of the EULA are fully disclosed you are bound to the agreement. However, if you don’t agree, are you simply out of your money? I think that’s the part that rankles most people. The thing is, though, that the product promises to do things, you buy it because it will do these things, and it’s not until after money has changed hands (and the contract has been fulfilled) that they hit you with the extra legalese about what you can and can’t do. Because this isn’t part of the original contract it can’t be enforced, so is essentially meaningless. ---
**Author:** ![Tabby\_Cat](https://avatars.discourse-cdn.com/v4/letter/t/6a8cbe/32.png) [@Tabby\_Cat](https://boards.straightdope.com/u/Tabby_Cat)\ **Post date:** [November 13, 2005, 6:10pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/132 "2005-11-13T18:10:47Z")
> [@Silentgoldfish](#): > > The thing is, though, that the product promises to do things, you buy it because it will do these things, and it’s not until after money has changed hands (and the contract has been fulfilled) that they hit you with the extra legalese about what you can and can’t do. Because this isn’t part of the original contract it can’t be enforced, so is essentially meaningless. The point is that there are 2 contracts. 1. You pay money, you get the physical CD. 2. You agree to certain terms, you get a licence for playing etc the copyrighted material on the CD. Clear? It’s not like you’re amending the original contract (1) though the EULA. These are 2 separate contracts. ---
**Author:** ![Silentgoldfish](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@Silentgoldfish](https://boards.straightdope.com/u/Silentgoldfish)\ **Post date:** [November 13, 2005, 6:14pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/133 "2005-11-13T18:14:45Z")
> [@Tabby\_Cat](#): > > Clear? It’s not like you’re amending the original contract (1) though the EULA. These are 2 separate contracts. Buuut… you ARE amending the original contract. You buy software to use it. It’s bought with the express intent to use it. Nowhere in the original contract is it stated that you are actually buying the right to sign another contract to actually use the product you are paying for. ---
**Author:** ![mhendo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mhendo/32/3159_2.png) [@mhendo](https://boards.straightdope.com/u/mhendo)\ **Post date:** [November 13, 2005, 6:18pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/134 "2005-11-13T18:18:08Z")
Hey **kanicbird** , i’m still interested in hearing your explanation of how or why this DRM violates Microsoft’s Windows copyright. ---
**Author:** ![kanicbird](https://avatars.discourse-cdn.com/v4/letter/k/5f8ce5/32.png) [@kanicbird](https://boards.straightdope.com/u/kanicbird)\ **Post date:** [November 13, 2005, 6:22pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/135 "2005-11-13T18:22:29Z")
**mhendo** This DRM modifies the OS by use of a rootkit, actually modifying the Windows OS itself to be a ‘Sony DRM’ OS, which they use mostly Microsoft code. ---
**Author:** ![mhendo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mhendo/32/3159_2.png) [@mhendo](https://boards.straightdope.com/u/mhendo)\ **Post date:** [November 13, 2005, 6:38pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/136 "2005-11-13T18:38:55Z")
But the only thing that separates this rootkit from hundreds of other pieces of software is that it hides itself from the owner. By your logic, anything that changes the Windows registry, or allows the computer to do something that Windows can’t do by itself, is a violation of copyright. Also, i call bullshit on your claim that it becomes a “Sony DRM” operating system. It is a Windows operating system with some modifications made by the Sony software. Finally, exactly how is it violating Microsoft’s copyright? Please explain, with reference to the appropriate section of American copyright law. Or are you just sounding off about something that you have no clue about? ---
**Author:** ![Tabby\_Cat](https://avatars.discourse-cdn.com/v4/letter/t/6a8cbe/32.png) [@Tabby\_Cat](https://boards.straightdope.com/u/Tabby_Cat)\ **Post date:** [November 13, 2005, 6:42pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/137 "2005-11-13T18:42:45Z")
> [@Silentgoldfish](#): > > Buuut… you ARE amending the original contract. You buy software to use it. It’s bought with the express intent to use it. Nowhere in the original contract is it stated that you are actually buying the right to sign another contract to actually use the product you are paying for. Well, then, I bought it with the express intent to pirate it. Does that matter? No. With software, within copyright there is the right to make copies, or to make derivative works. Clearly, by installing it, you have to make a copy of it, or at least a derivative work. If you do not have a licence from the copyright owner, or ARE the copyright owner, then you are infringing on copyright when you do so. Now, they phrase it as a “right to use”. I’ve never seen this right in UK law before, and my textbooks make no mention of it, however, I believe making derivative works is enough to cover this particular issue of installing software. Perhaps even performance rights. I’ll look it up some more if you’re not satisfied. Now, you may argue that you should be given this “licence to use” together with the physical media. Well, there may be a moral argument for that. However, there is currently no legal reason for you to do so. For example, I can sell you the script for a play. You can do whatever you want with this script and the paper it’s written on, but if I don’t grant you a licence to PERFORM the play, all you can do is read it. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [November 13, 2005, 7:30pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/138 "2005-11-13T19:30:19Z")
> [@BlackKnight](#): > > Christ, this just keeps getting better and better, doesn’t it? Indeed: > [@Computer Associates Spyware Information Center](#): > > XCP.Sony.Rootkit installs a DRM executable as a Windows service, but misleadingly names this service “Plug and Play Device Manager”, employing a technique commonly used by malware authors to fool everyday users into believing this is a part of Windows. Approximately every 1.5 seconds this service queries the primary executables associated with all processes running on the machine, resulting in nearly continuous read attempts on the hard drive. **This has been shown to shorten the drive’s lifespan.** ---
**Author:** ![Walton\_Firm](https://avatars.discourse-cdn.com/v4/letter/w/45deac/32.png) [@Walton\_Firm](https://boards.straightdope.com/u/Walton_Firm)\ **Post date:** [November 13, 2005, 8:18pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/139 "2005-11-13T20:18:45Z")
Whoa. Just when you think Sony/First4Internet has hit rock bottom, it gets even worse. That ActiveX control which you have to accept before Sony will (if you ask real nice) allow you to download the uninstaller? Apparently, it installs a generic backdoor which can be exploited by the author of any HTML page you visit afterwards. The backdoor allows anybody to reboot your machine, and probably to execute random code on your machine. [Details here](http://hack.fi/~muzzy/sony-drm/), including a link to a demonstration page which will reboot your machine if you have the ActiveX component installed. ---
**Author:** ![kanicbird](https://avatars.discourse-cdn.com/v4/letter/k/5f8ce5/32.png) [@kanicbird](https://boards.straightdope.com/u/kanicbird)\ **Post date:** [November 13, 2005, 8:21pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/140 "2005-11-13T20:21:17Z")
> [@](#): > > But the only thing that separates this rootkit from hundreds of other pieces of software is that it hides itself from the owner. By your logic, anything that changes the Windows registry, or allows the computer to do something that Windows can’t do by itself, is a violation of copyright. Windows is designed to have the registry changed by programs, the rootkit, ok my terms may be a bit off here, but to my understanding places itself between the OS and the hardware, and in this case prevents windows from running as designed - this position is the place for the OS, not just a program (perhaps a driver could fit this too, but I see a difference) > [@](#): > > Also, i call bullshit on your claim that it becomes a “Sony DRM” operating system. It is a Windows operating system with some modifications made by the Sony software. You want to see bullshit, then just wait till you try to update your Sony DRM OS with the next windows update and it goes unstable. Let me say you will have to go through loads of bullshit then. > [@](#): > > Finally, exactly how is it violating Microsoft’s copyright? Please explain, with reference to the appropriate section of American copyright law. Or are you just sounding off about something that you have no clue about? Well more sounding off out of anger at this tactic, and would love to see this whole thing blow up in Sony’s face in a really big way. Perhaps it would be safer to say that MS may have a case against Sony for addtional costs of tech support including the removal tools that are being created. [Previous page](https://boards.straightdope.com/t/sony-drm-malware/329162.md?page=6) [Next page](https://boards.straightdope.com/t/sony-drm-malware/329162.md?page=8)