# Sony DRM malware **URL:** \ **Category:** The BBQ Pit\ **Created:** [November 2, 2005, 8:45pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162 "2005-11-02T20:45:05Z")\ **Posts on this page:** 20\ **Page:** 9
**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\ **Post date:** [November 17, 2005, 8:16pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/161 "2005-11-17T20:16:36Z")
> [@Ponder Stibbons](#): > > Personally, I think this’ll just make Sony make sure their DRM is sneakier and more secure. Which is, IMHO, not a good thing. I have faith that the techie community will be more clever ferreting out their malware than Sony and their ilk will be hiding it. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [November 17, 2005, 8:51pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/162 "2005-11-17T20:51:44Z")
> [@Revtim](#): > > I have faith that the techie community will be more clever ferreting out their malware than Sony and their ilk will be hiding it. You shouldn’t as far as the blue ray stuff is concerned. The reason the sony anti copy CDs don’t work very well is that there is nothing the the CD standard about copy protection. They need to make CDs that will work in old CD players. With the new standards they can implement features to prevent coping and locking a player to a dvd correctly because the hardware will be there to make these things work. ---
**Author:** ![Dag\_Otto](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Dag\_Otto](https://boards.straightdope.com/u/Dag_Otto)\ **Post date:** [November 17, 2005, 8:55pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/163 "2005-11-17T20:55:13Z")
> [@Knorf](#): > > I hope Sony is forced to pay big for this blunder. I wonder if Sony will demand back the royalties paid (if any) to the artists on the recalled discs. ---
**Author:** ![Ponder\_Stibbons](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ponder_stibbons/32/343_2.png) [@Ponder\_Stibbons](https://boards.straightdope.com/u/Ponder_Stibbons)\ **Post date:** [November 17, 2005, 9:20pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/164 "2005-11-17T21:20:41Z")
> [@Dag Otto](#): > > I wonder if Sony will demand back the royalties paid (if any) to the artists on the recalled discs. My suspicion is that they will simply replace the disks with non-“protected” versions. Or, if they’re _really_ stupid, disks with a _different_, but equally moronic, protection scheme. ---
**Author:** ![kanicbird](https://avatars.discourse-cdn.com/v4/letter/k/5f8ce5/32.png) [@kanicbird](https://boards.straightdope.com/u/kanicbird)\ **Post date:** [November 19, 2005, 1:30am UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/165 "2005-11-19T01:30:29Z")
> [@](#): > > My suspicion is that they will simply replace the disks with non-“protected” versions. Well they did. But also they (and first 4 internet) may have lifted part of there player from open source software: [http://news.com.com/Did+Sony+rootkit+pluck+from+open+source/2100-1029\_3-5960222.html?tag=nefd.top](http://news.com.com/Did+Sony+rootkit+pluck+from+open+source/2100-1029_3-5960222.html?tag=nefd.top) My understanding about using open source software is that you must make your ‘creation’ also open source, ---
**Author:** ![duffer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duffer/32/1026_2.png) [@duffer](https://boards.straightdope.com/u/duffer)\ **Post date:** [November 19, 2005, 1:59am UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/166 "2005-11-19T01:59:29Z")
Now I’m getting curious about the competition of Blu-Ray and HD-DVD (is that the term for the other format?) From what I understand at it’s base, the competing technologies are roughly the same as Beta vs. VHS. With Sony and a few big shots going up against Microsoft and a few big shots. (Any links to straightforward, clear, non-biased comparisons?) I know this much. Thanks to this shit if Blu-Ray becomes the standard, I’ll glom onto any and every other technology/process I can find to get my movie fix. As a side note, with Microsoft having such a dominating market share of home computers and the fact they’re puching something different than Blu-Ray, topped off with linking everything in your house to a PC very soon, I just see this DRM as a digital way of Sony shooting themselves in the foot right before running a marathon. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [November 19, 2005, 2:03am UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/167 "2005-11-19T02:03:50Z")
The latest update of [Microsoft Antispyware](http://www.microsoft.com/athome/security/spyware/software/default.mspx) will remove the Sony DRM rootkit: > [@](#): > > We have analyzed several versions of the rootkit that have been shipped as part of Sony’s XCP software. We are calling the family WinNT/F4IRootkit. We chose the name based on the company that authored this component. We have added detection and removal for those versions via the online scanner at the Windows Live Safety Center. To quickly scan and remove those versions of the rootkit from your computer, you can select the “Full Service Scan” followed by the “Quick scan” option. > > The Windows AntiSpyware Beta will be able to detect and remove this as well with the 11/17/05 signature release. Detection and removal will also be added to the December release of the Malicious Software Removal Tool which will be released the second Tuesday of December. > > We also wanted to take a moment to confirm that we are not removing or disabling Sony’s XCP software. We are only removing the rootkit component published by First 4 Internet which is included as part of Sony’s XCP software. We will continue to monitor the situation and react as conditions change. [http://blogs.technet.com/antimalware/](http://blogs.technet.com/antimalware/) ---
**Author:** ![VegemiteMoose](https://avatars.discourse-cdn.com/v4/letter/v/df788c/32.png) [@VegemiteMoose](https://boards.straightdope.com/u/VegemiteMoose)\ **Post date:** [November 19, 2005, 2:41am UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/168 "2005-11-19T02:41:47Z")
Stupid Sony. I love my PS2 and was planning on buying a PS3 (eventually) but I’m also a bit of a paranoia-phile and I hate crap like hidden shit on CD’s. Arrrggghhh. ---
**Author:** ![kaylasdad99](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kaylasdad99/32/3398_2.png) [@kaylasdad99](https://boards.straightdope.com/u/kaylasdad99)\ **Post date:** [November 19, 2005, 5:23pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/169 "2005-11-19T17:23:39Z")
…but, what does “DRM” stand for? ---
**Author:** ![Tuckerfan](https://avatars.discourse-cdn.com/v4/letter/t/eada6e/32.png) [@Tuckerfan](https://boards.straightdope.com/u/Tuckerfan)\ **Post date:** [November 19, 2005, 5:31pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/170 "2005-11-19T17:31:51Z")
> [@kaylasdad99](#): > > …but, what does “DRM” stand for? “Digital Rights Management” ---
**Author:** ![GIGObuster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gigobuster/32/421_2.png) [@GIGObuster](https://boards.straightdope.com/u/GIGObuster)\ **Post date:** [November 19, 2005, 7:57pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/171 "2005-11-19T19:57:30Z")
> [@Tuckerfan](#): > > “Digital Rights Management” George Orwell would be proud. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [November 20, 2005, 2:46pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/172 "2005-11-20T14:46:35Z")
Forgive me if these items have been brought up in this 4-page thread already and I missed it. It’s damming that, in a program designed to prevent copyright infringement, code has been found that was ripped off from others, violating a copyright: [http://dewinter.com/modules.php?name=News&file=article&sid=215](http://dewinter.com/modules.php?name=News&file=article&sid=215) No, I can’t hold Sony harmless because they didn’t write the software. Surely they have an obligation to their customers. It has been noted that even though the Sony malware disks have been on the market for 8 months, all the security companies (Symantec, etc.) have either ignored the threat to their customers, or, one accusation says, reached an agreement with First4Internet (the malware developer) to not tell anyone. This includes Microsoft, which is now in the security business (finally!), which provides excellent fodder for MS-bashers and conspiracy theorists. > **[Sony Rootkits: A Sign Of Security Industry Failure?](https://www.informationweek.com/it-life/sony-rootkits-a-sign-of-security-industry-failure-)** > > One analyst wonders why it took so long to catch onto Sony's use of rootkits on CDs and whether customers may have a false sense of security. > [@](#): > > “For at least for seven months, Sony BMG Music CD buyers have been installing rootkits on their PCs. Why then did no security software vendor detect a problem and alert customers?” asked Joe Wilcox, an analyst with JupiterResearch. I can’t see any way those companies can get off the hook. If they weren’t aware of the problem, what good is a security company that doesn’t detect a virus for 8 months? And if they were aware, how can they say they didn’t know what the software could do (open back doors, etc.)? Isn’t that their job, to analyze suspicious software? And if they knew, but chose to keep silent, what does that say about ethics in a company _whose business is selling trust?_ > [@](#): > > “We all missed this,” acknowledged Sam Curry, vice president of Computer Associates’ eTrust security group, which develops and sells the PestPatrol anti-spyware line. It all comes down to a lack of concern for customers. And a blind spot in future vision. ---
**Author:** ![JRDelirious](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jrdelirious/32/9531_2.png) [@JRDelirious](https://boards.straightdope.com/u/JRDelirious)\ **Post date:** [November 20, 2005, 3:25pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/173 "2005-11-20T15:25:18Z")
Ah, but, you see, this suspectware was not distributed by “Them”, the scuzzy, unwashed subversives; it was distributed by “One Of Us”, a respected and very powerful corporate content-provider. And DRM has the full legal blessing of the Powers That Be. ---
**Author:** ![Lightnin](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lightnin/32/180_2.png) [@Lightnin](https://boards.straightdope.com/u/Lightnin)\ **Post date:** [November 20, 2005, 3:57pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/174 "2005-11-20T15:57:14Z")
> [@Archergal](#): > > More than half a million networks may have been infected by Sony’s DRM rootkit: Wanna hear something amusing? I work for Sony (games, not the music division). One of the perks we get is that we get to order a Sony music CD once a month for free. The very first computer that those CDs get played on is, of course, our work computer. I wonder how many Sony employees’ computers have the DRM toolkit at this point? ---
**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\ **Post date:** [November 20, 2005, 5:12pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/175 "2005-11-20T17:12:03Z")
> [@Musicat](#): > > I can’t see any way those companies can get off the hook. If they weren’t aware of the problem, what good is a security company that doesn’t detect a virus for 8 months? This DRM shit is bad, but let’s not dillute the term “virus” to include it. This thing does not copy and spread itself, it’s NOT a virus. And since it’s not a virus, I wouldn’t have expected any anti-virus company to be on the lookout for it. Now that it’s made news, I wouldn’t be surprised if the anti-virus companies start looking for this and other rootkits now, but I don’t think it’s reasonable to expect anti-virus progs to have looked for this stuff before now. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [November 20, 2005, 6:00pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/176 "2005-11-20T18:00:34Z")
**Revtim** Most of the anti virus companies have products for detecting and removing mal ware. Their response has been pretty week. I still have not seen anything to remove the program. The details I have read about what sony does to remove the program are vauge but it sure does not sound to me like they are doing any more than removing the cloaking part. ---
**Author:** ![asterion](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@asterion](https://boards.straightdope.com/u/asterion)\ **Post date:** [November 20, 2005, 6:30pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/177 "2005-11-20T18:30:52Z")
Yeah, the AV companies haven’t done much. I think Sophos (which is what I’m running) will do something about it and MS has got their antispyware program to delete the rootkit with the latest upgrade. I can’t test it because I don’t have any of the CDs in question and I’m not about to purposefully infect my machine. ---
**Author:** ![Rysto](https://avatars.discourse-cdn.com/v4/letter/r/ecccb3/32.png) [@Rysto](https://boards.straightdope.com/u/Rysto)\ **Post date:** [November 20, 2005, 7:14pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/178 "2005-11-20T19:14:03Z")
> [@Revtim](#): > > This DRM shit is bad, but let’s not dillute the term “virus” to include it. This thing does not copy and spread itself, it’s NOT a virus. And since it’s not a virus, I wouldn’t have expected any anti-virus company to be on the lookout for it. Now that it’s made news, I wouldn’t be surprised if the anti-virus companies start looking for this and other rootkits now, but I don’t think it’s reasonable to expect anti-virus progs to have looked for this stuff before now. The definition of [virus](http://en.wikipedia.org/wiki/Computer_virus)fits this just fine: > [@](#): > > A virus is a type of program that can replicate itself by making (possibly modified) copies of itself. The main criterion for classifying a piece of executable code as a virus is that it spreads itself by means of ‘hosts’. A virus can only spread from one computer to another when its host is taken to the uninfected computer, for instance by a user sending it over a network or carrying it on a removable media. You’re thinking of a computer worm, which spreads itself over a network. ---
**Author:** ![Muffin](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/muffin/32/4341_2.png) [@Muffin](https://boards.straightdope.com/u/Muffin)\ **Post date:** [November 20, 2005, 7:56pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/179 "2005-11-20T19:56:37Z")
Thank you **Revtim** and **Fear Itself** , for pointing out what I must do to protect my computer from this. ---
**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\ **Post date:** [November 20, 2005, 8:42pm UTC](https://boards.straightdope.com/t/sony-drm-malware/329162/180 "2005-11-20T20:42:22Z")
> [@Rysto](#): > > The definition of [virus](http://en.wikipedia.org/wiki/Computer_virus)fits this just fine: It does not fit that definition at all. The first sentence of the virus definition you provide is “A virus is a type of program that can replicate itself by making (possibly modified) copies of itself.” The Sony rootkit DRM does not do this. It cannot spread from a computer it is installed on to other media or other computers. All it does (as is known so far) is DRM functions, such as preventing MP3 ripping and whatnot. If it’s discovered that a computer with this DRM installed can copy the DRM to another computer via some means such as infecting media or copying over the network, then it’s a virus. This is what is meant in your quoted definition when it says "it spreads itself by means of ‘hosts’ ", which nobody to my knowledge has accused the Sony DRM of doing. If you count it being installed from the Sony CD as replication, then there’s practically no software written that does not fit the definition of a virus. This shit is deceptive and dangerous, but it’s not a virus unless one dilutes the definition of a virus beyond the point of usefulness. [Previous page](https://boards.straightdope.com/t/sony-drm-malware/329162.md?page=8) [Next page](https://boards.straightdope.com/t/sony-drm-malware/329162.md?page=10)