Sony President Defends Rootkit (What You Don't Know Won't Hurt You)

[Steve_MB]

I thought Mary Mapes took the cake for lame attempts at self-justification, but she’s just been decisively outdone by Sony’s latest spin on their stealth rootkit:

@Sony President Thomas Hesse

In an interview with NPR reporter Neda Ulaby, the President of Sony BMG’s Global Digital Business, Thomas Hesse, defends Sony’s installation of a rootkit by declaring, “Most people, I think, don’t even know what a Rootkit is, so why should they care about it?”

Well, gee, most people, I think, don’t know what beryllium is, so I guess it would be OK for me to do some open-air beryllium grinding. :rolleyes:

[2sense]

What’s a rootkit?

[chrisk]

@2sense

What’s a rootkit?

Definitions differ, which is what makes this case so confusing. Apparently, though, sony’s rootkit allows trojan horses to hide on your computer without being caught in regular antivirus scans. :eek: :mad:

[asterion]

@2sense

What’s a rootkit?

A rootkit can be thought of as something that installs into the kernel. The kernel is the core of the OS and problems with the kernel can cause instability and even failure.

[Ponder_Stibbons]

For those that may not know, there is currently a lively pit thread on this very subject. Dante posted this link that I found to be very informative.

I’m not sure this is GD material. Is anybody going to take Sony’s side on this one?

[ed]

@2sense

What’s a rootkit?

A rootkit is a program that is designed to “hide” itself and other programs from the operating system (thereby hiding them completely from the users and administrator of that system). They do this by intercepting calls to and from the operating system’s core functions (called “hooking”) and preventing any information about itself from being made available to the system or any other programs. Essentially, it alters the operating system so that it will lie to itself about what it’s doing, making programs completely invisible to anything (especially to virus scanners).

Rootkits are not necessarily malicious in and of themselves, since they don’t usually attempt to do damage outright; however they are almost always used maliciously to hide other processes, such as backdoor processes that allow remote access, or keyloggers and screen capture programs to grab user information. Additionally, it’s not uncommon for a rootkit to introduce untintended problems to a system, since they are not necessarily written with stability or safety in mind.

A good rootkit, once installed, will make it all but impossible for the operator to ever know that his system is compromised, because any and every operation his system performs is going to be altered by the rootkit. There are ways to detect many rootkits out there, but it’s an arms race, and the rootkit programmers are often a step ahead.

Of course, since a rootkit installs itself into the most fundamental layer of your system, it can (and does, in this case) introduce stability problems.

In this case, the Sony rootkit is particularly careless because it doesn’t just hide specific files or processes, it hides anything prefixed with sys in the filename. What this means is that Sony has planted a backdoor into your system for future attacks by just about anyone, by providing an easy-to-use rootkit pre-installed for future would-be attackers.

[waterj2]

Can an EULA that cannot be read before purchasing the CD and consenting to it be legally enforced? And when did the world decide that EULAs in general could be so broad, while non-software products have fairly strict liability guidlines?

[Guinastasia]

I have a question-have these rootkits been included yet? And if they have, how long have they been doing it?

[Der_Trihs]

@Guinastasia

I have a question-have these rootkits been included yet? And if they have, how long have they been doing it?

Here’s a story with a list of contaminated CDs.

[Guinastasia]

Thanks. Whew, I’m safe.

[GIGObuster]

I love the note in the unistall requests from SONY XCP:

UNINSTALL REQUESTS

If at some point you wish to remove the software from your machine simply contact customer service through this link.

…

You will, though, be unable to use the disc on your computer once you uninstall the components.

So IOW, don’t like the software and you prefer to use your high quality computer speakers? Then you bought an expensive coaster! Congratulations sucker!

[Ravenman]

Great. Just when I’m finally getting over my fear of terrorism, lead-tainted water in DC, spiders, and a declining economy, I’m going to have to start worrying about invisible programs on my computer that could do things that I don’t understand. Faaaan-tastic.

[Zabali_Clawbane]

@Guinastasia

Thanks. Whew, I’m safe.

Hopefully, though Velvet Revolver’s Contraband released in 2004 had DRM technology too. I wonder where else it can be found? :mad:

[astro]

@ed

In this case, the Sony rootkit is particularly careless because it doesn’t just hide specific files or processes, it hides anything prefixed with sys in the filename. What this means is that Sony has planted a backdoor into your system for future attacks by just about anyone, by providing an easy-to-use rootkit pre-installed for future would-be attackers.

His job completed the little seen, near mythological “ed” sinks back below the waves as silently as he came.

[Revtim]

@GIGObuster

Then you bought an expensive coaster! Congratulations sucker!

They’re not going to tell anybody, but I’m pretty sure if autorun is turned off you can use the CD in your computer like a standard non-DRM audio CD.

To turn of autorun:
http://www.annoyances.org/exec/show/article03-018

[GIGObuster]

The 800 pound gorilla has spoken:

http://www.eweek.com/article2/0,1895,1886122,00.asp

Microsoft Corp. will start deleting the rootkit component of the controversial DRM scheme used by Sony BMG Music Entertainment.

The software giant’s Windows AntiSpyware application will be updated to add a detection and removal signature for the rootkit features used in the XCP digital rights management technology.

…

Garms said an analysis of the XCP software that ships on about 20 Sony BMG Music CDs led to the determination that zapping rootkit would protect Windows users.

“We are concerned about any malware and its impact on our customers’ machines. Rootkits have a clearly negative impact on not only the security, but also the reliability and performance of their systems,” Garms added.

He said an “a set of objective criteria” was used to make the decision to classify the XCP software for detection and removal by the anti-malware technology.

The use of the technology blew up in Sony’s face

Duh.

[GIGObuster]

@GIGObuster

So IOW, don’t like the software and you prefer to use your high quality computer speakers? Then you bought an expensive coaster! Congratulations sucker!

I was wrong…
Not only you were getting an expensive coaster, but also a (non protective) troyan!

http://news.com.com/Sony+recalls+risky+rootkit+CDs/2100-7349_3-5954154.html?tag=nefd.top

Princeton University computer science professor Ed Felten wrote on his blog Tuesday that he and a fellow researcher had confirmed that Sony’s initial Web-based uninstall tool–designed to uninstall the copy-protection software deposited by Sony’s CDs–actually exposed a critical vulnerability on computers.

The tool downloaded a program that causes a user’s hard drive to accept instructions from Web sites. But the program remained active on the user’s hard drive after it had been instructed to uninstall the Sony software. The program could then be triggered by almost any code from any Web site, including malicious instructions, the Princeton researchers said.

“Any Web page can seize control of your computer; then it can do anything it likes,” Felton and fellow researcher J. Alex Halderman wrote on their blog. “That’s about as serious as a security flaw can get.”

Sony later replaced that Web-based uninstall tool with one that downloads a program with its own instructions, as opposed to one that accepts instructions from Web sites. The researchers said the new program appeared to be safe.

For anyone who did use the earlier tool, the researchers’ blog has instructions for removing the Sony component.

I can’t decide, SONY and First4Internet are either the Keystone cops or the Three Stooges of software!

[J.Gelert]

Hopefully, though Velvet Revolver’s Contraband released in 2004 had DRM technology too. I wonder where else it can be found?

Well, most of RCA’s records past year or so (Kings Of Leon, Kasabian, and the aforementioned Velvet Revolver) have been copy-protected. Nothing that can’t be circumvented by turning Autorun off, which is a good idea in general, anyway.

Least RCA puts their copy-protection disclaimer on the front of their CDs, while Sony’s been hiding it in fine print on the back, with a somewhat vague ‘Content Protected’ logo on the front.