# Sony President Defends Rootkit (What You Don't Know Won't Hurt You) **URL:** \ **Category:** Great Debates\ **Created:** [November 10, 2005, 6:51pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453 "2005-11-10T18:51:12Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [November 10, 2005, 6:51pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/1 "2005-11-10T18:51:12Z")
I thought Mary Mapes took the cake for lame attempts at self-justification, but she’s just been decisively outdone by Sony’s latest spin on their stealth rootkit: > [@Sony President Thomas Hesse](#): > > In an interview with NPR reporter Neda Ulaby, the President of Sony BMG’s Global Digital Business, Thomas Hesse, defends Sony’s installation of a rootkit by declaring, “Most people, I think, don’t even know what a Rootkit is, so why should they care about it?” Well, gee, most people, I think, don’t know what beryllium is, so I guess it would be OK for me to do some open-air beryllium grinding. :rolleyes: ---
**Author:** ![2sense](https://avatars.discourse-cdn.com/v4/letter/2/e47774/32.png) [@2sense](https://boards.straightdope.com/u/2sense)\ **Post date:** [November 10, 2005, 7:12pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/2 "2005-11-10T19:12:57Z")
What’s a rootkit? ---
**Author:** ![chrisk](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@chrisk](https://boards.straightdope.com/u/chrisk)\ **Post date:** [November 10, 2005, 7:15pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/3 "2005-11-10T19:15:51Z")
> [@2sense](#): > > What’s a rootkit? Definitions differ, which is what makes this case so confusing. Apparently, though, sony’s rootkit allows [trojan horses](http://news.zdnet.co.uk/internet/security/0,39020375,39236720,00.htm) to hide on your computer without being caught in regular antivirus scans. :eek: ☹ :mad: ---
**Author:** ![asterion](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@asterion](https://boards.straightdope.com/u/asterion)\ **Post date:** [November 10, 2005, 8:56pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/4 "2005-11-10T20:56:35Z")
> [@2sense](#): > > What’s a rootkit? A rootkit can be thought of as something that installs into the kernel. The kernel is the core of the OS and problems with the kernel can cause instability and even failure. ---
**Author:** ![Ponder\_Stibbons](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ponder_stibbons/32/343_2.png) [@Ponder\_Stibbons](https://boards.straightdope.com/u/Ponder_Stibbons)\ **Post date:** [November 10, 2005, 10:30pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/5 "2005-11-10T22:30:09Z")
For those that may not know, there is currently a lively [pit thread](http://boards.straightdope.com/sdmb/showthread.php?t=342821) on this very subject. **Dante** posted [this link](http://www.theinquirer.net/?article=27426) that I found to be very informative. I’m not sure this is GD material. Is _anybody_ going to take Sony’s side on this one? ---
**Author:** ![ed](https://avatars.discourse-cdn.com/v4/letter/e/c77e96/32.png) [@ed](https://boards.straightdope.com/u/ed)\ **Post date:** [November 11, 2005, 4:49pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/6 "2005-11-11T16:49:29Z")
> [@2sense](#): > > What’s a rootkit? A rootkit is a program that is designed to “hide” itself and other programs from the operating system (thereby hiding them completely from the users and administrator of that system). They do this by intercepting calls to and from the operating system’s core functions (called “hooking”) and preventing any information about itself from being made available to the system or any other programs. Essentially, it alters the operating system so that it will lie to itself about what it’s doing, making programs completely invisible to anything (especially to virus scanners). Rootkits are not necessarily _malicious_ in and of themselves, since they don’t usually attempt to do damage outright; however they are almost always used maliciously to hide other processes, such as backdoor processes that allow remote access, or keyloggers and screen capture programs to grab user information. Additionally, it’s not uncommon for a rootkit to introduce untintended problems to a system, since they are not necessarily written with stability or safety in mind. A good rootkit, once installed, will make it all but impossible for the operator to _ever_ know that his system is compromised, because any and every operation his system performs is going to be altered by the rootkit. There are ways to detect many rootkits out there, but it’s an arms race, and the rootkit programmers are often a step ahead. Of course, since a rootkit installs itself into the most fundamental layer of your system, it can (and does, in this case) introduce stability problems. In this case, the Sony rootkit is particularly careless because it doesn’t just hide specific files or processes, it hides _anything_ prefixed with sys in the filename. What this means is that Sony has planted a backdoor into your system for future attacks by just about anyone, by providing an easy-to-use rootkit pre-installed for future would-be attackers. ---
**Author:** ![waterj2](https://avatars.discourse-cdn.com/v4/letter/w/858c86/32.png) [@waterj2](https://boards.straightdope.com/u/waterj2)\ **Post date:** [November 12, 2005, 1:56am UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/7 "2005-11-12T01:56:23Z")
Can an EULA that cannot be read before purchasing the CD and consenting to it be legally enforced? And when did the world decide that EULAs in general could be so broad, while non-software products have fairly strict liability guidlines? ---
**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\ **Post date:** [November 12, 2005, 9:06pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/8 "2005-11-12T21:06:33Z")
I have a question-have these rootkits been included yet? And if they have, how long have they been doing it? ---
**Author:** ![Der\_Trihs](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/der_trihs/32/233_2.png) [@Der\_Trihs](https://boards.straightdope.com/u/Der_Trihs)\ **Post date:** [November 12, 2005, 9:24pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/9 "2005-11-12T21:24:38Z")
> [@Guinastasia](#): > > I have a question-have these rootkits been included yet? And if they have, how long have they been doing it? [Here’s](http://news.bbc.co.uk/1/hi/technology/4424254.stm) a story with a list of contaminated CDs. ---
**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\ **Post date:** [November 12, 2005, 10:14pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/10 "2005-11-12T22:14:21Z")
Thanks. Whew, I’m safe. ---
**Author:** ![GIGObuster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gigobuster/32/421_2.png) [@GIGObuster](https://boards.straightdope.com/u/GIGObuster)\ **Post date:** [November 12, 2005, 10:26pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/11 "2005-11-12T22:26:37Z")
I love the note in the unistall requests from SONY XCP: > [@](#): > > UNINSTALL REQUESTS > > If at some point you wish to remove the software from your machine simply contact customer service through this link. > > … > > You will, though, be unable to use the disc on your computer once you uninstall the components. So IOW, don’t like the software and you prefer to use your high quality computer speakers? Then you bought an expensive coaster! Congratulations sucker! ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [November 12, 2005, 11:34pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/12 "2005-11-12T23:34:09Z")
Great. Just when I’m finally getting over my fear of terrorism, lead-tainted water in DC, spiders, and a declining economy, I’m going to have to start worrying about invisible programs on my computer that could do things that I don’t understand. Faaaan-tastic. ---
**Author:** ![Zabali\_Clawbane](https://avatars.discourse-cdn.com/v4/letter/z/ecd19e/32.png) [@Zabali\_Clawbane](https://boards.straightdope.com/u/Zabali_Clawbane)\ **Post date:** [November 12, 2005, 11:42pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/13 "2005-11-12T23:42:48Z")
> [@Guinastasia](#): > > Thanks. Whew, I’m safe. Hopefully, though Velvet Revolver’s Contraband released in 2004 had [DRM](http://www.cs.princeton.edu/~jhalderm/cd3/) technology too. I wonder where else it can be found? :mad: ---
**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\ **Post date:** [November 13, 2005, 12:33am UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/14 "2005-11-13T00:33:57Z")
> [@ed](#): > > In this case, the Sony rootkit is particularly careless because it doesn’t just hide specific files or processes, it hides _anything_ prefixed with sys in the filename. What this means is that Sony has planted a backdoor into your system for future attacks by just about anyone, by providing an easy-to-use rootkit pre-installed for future would-be attackers. His job completed the little seen, near mythological “ed” sinks back below the waves as silently as he came. ---
**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\ **Post date:** [November 13, 2005, 12:52am UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/15 "2005-11-13T00:52:21Z")
> [@GIGObuster](#): > > Then you bought an expensive coaster! Congratulations sucker! They’re not going to tell anybody, but I’m pretty sure if autorun is turned off you can use the CD in your computer like a standard non-DRM audio CD. To turn of autorun: [http://www.annoyances.org/exec/show/article03-018](http://www.annoyances.org/exec/show/article03-018) ---
**Author:** ![GIGObuster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gigobuster/32/421_2.png) [@GIGObuster](https://boards.straightdope.com/u/GIGObuster)\ **Post date:** [November 13, 2005, 3:17am UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/16 "2005-11-13T03:17:49Z")
The 800 pound gorilla has spoken: [http://www.eweek.com/article2/0,1895,1886122,00.asp](http://www.eweek.com/article2/0,1895,1886122,00.asp) > [@](#): > > Microsoft Corp. will start deleting the rootkit component of the controversial DRM scheme used by Sony BMG Music Entertainment. > > The software giant’s Windows AntiSpyware application will be updated to add a detection and removal signature for the rootkit features used in the XCP digital rights management technology. > > … > > Garms said an analysis of the XCP software that ships on about 20 Sony BMG Music CDs led to the determination that zapping rootkit would protect Windows users. > > “We are concerned about any malware and its impact on our customers’ machines. Rootkits have a clearly negative impact on not only the security, but also the reliability and performance of their systems,” Garms added. > > He said an “a set of objective criteria” was used to make the decision to classify the XCP software for detection and removal by the anti-malware technology. > [@](#): > > The use of the technology blew up in Sony’s face Duh. ---
**Author:** ![GIGObuster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gigobuster/32/421_2.png) [@GIGObuster](https://boards.straightdope.com/u/GIGObuster)\ **Post date:** [November 16, 2005, 8:09am UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/17 "2005-11-16T08:09:48Z")
> [@GIGObuster](#): > > So IOW, don’t like the software and you prefer to use your high quality computer speakers? Then you bought an expensive coaster! Congratulations sucker! I was wrong… Not only you were getting an expensive coaster, but also a (non protective) troyan! [http://news.com.com/Sony+recalls+risky+rootkit+CDs/2100-7349\_3-5954154.html?tag=nefd.top](http://news.com.com/Sony+recalls+risky+rootkit+CDs/2100-7349_3-5954154.html?tag=nefd.top) > [@](#): > > Princeton University computer science professor Ed Felten wrote on his blog Tuesday that he and a fellow researcher had confirmed that Sony’s initial Web-based uninstall tool–designed to uninstall the copy-protection software deposited by Sony’s CDs–actually exposed a critical vulnerability on computers. > > The tool downloaded a program that causes a user’s hard drive to accept instructions from Web sites. But the program remained active on the user’s hard drive after it had been instructed to uninstall the Sony software. The program could then be triggered by almost any code from any Web site, including malicious instructions, the Princeton researchers said. > > “Any Web page can seize control of your computer; then it can do anything it likes,” Felton and fellow researcher J. Alex Halderman wrote on their blog. “That’s about as serious as a security flaw can get.” > > Sony later replaced that Web-based uninstall tool with one that downloads a program with its own instructions, as opposed to one that accepts instructions from Web sites. The researchers said the new program appeared to be safe. > > For anyone who did use the earlier tool, the researchers’ blog has instructions for removing the Sony component. I can’t decide, SONY and First4Internet are either the Keystone cops or the Three Stooges of software! ---
**Author:** ![J.Gelert](https://avatars.discourse-cdn.com/v4/letter/j/53a042/32.png) [@J.Gelert](https://boards.straightdope.com/u/J.Gelert)\ **Post date:** [November 16, 2005, 6:15pm UTC](https://boards.straightdope.com/t/sony-president-defends-rootkit-what-you-dont-know-wont-hurt-you/330453/18 "2005-11-16T18:15:21Z")
> [@](#): > > Hopefully, though Velvet Revolver’s Contraband released in 2004 had DRM technology too. I wonder where else it can be found? Well, most of RCA’s records past year or so (Kings Of Leon, Kasabian, and the aforementioned Velvet Revolver) have been copy-protected. Nothing that can’t be circumvented by turning Autorun off, which is a good idea in general, anyway. Least RCA puts their copy-protection disclaimer on the front of their CDs, while Sony’s been hiding it in fine print on the back, with a somewhat vague ‘Content Protected’ logo on the front.