Sony Raids Hacker Playbook

UPDATED: SEE BELOW
We’ve seen some deplorable tactics from the Recording Industry but Sony BMG has stooped to a new low. This is utterly appalling.

From the Washington Post:

“Sony BMG has configured some of its music CDs to install antipiracy software that uses techniques typically employed by hackers and virus writers to hide the program from users and to prevent them from ever uninstalling it.

“The CDs in question make use of a technique employed by software programs known in security circles as rootkits,”…

“Sony’s anti-piracy program installer pops up when you drop one of these content-protected CDs into your drive. If you agree to install it, there is no “uninstall” feature. Russinovich (of Sysinternals) was able to use his knowledge of rootkits and the Windows operating system to zero in on the offending driver files needed to run the software. Unfortunately, he found that removing the program also erased the system files that power his CD-ROM drive, rendering it useless.

Russinovich also discovered that the Sony program drivers are configured to load themselves in “Safe Mode” (a diagnostic mode of Windows that is useful for fixing problems with the operating system), which he said could make system recovery extremely difficult if any of the program drivers has a bug that prevents the system from booting.”

“Hypponen said the only way to uninstall the program in the conventional sense (without running the risk of hosing your system or CD-ROM drive) is to contact Sony BMG directly via a Web form and request removal.”

WTF?
In a real life situation this would “breaking and entering” plus vandalism.

UPDATE from Information Week:

“Customers have used Amazon.com’s review feature to slam a Sony CD implicated in a security and copy-protection brouhaha, reducing the online retailer’s rating for the Van Zant album, “Get Right with the Man,” from three-and-a-half stars to just one-and-a-half in the space of a few days.”

In response, the Van Zant’s have released the following on their website.

“CD SOFTWARE UPDATES/PLUG-INS – This Service Pack removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs. Sony insists that this component is not malicious and does not compromise security. However to alleviate any concerns that users may have about the program posing potential security vulnerabilities, this update has been released to enable users to remove this component from their computers.”

With artists listening maybe Sony will as well.

SECOND UPDATE:

The patch can cause blue screen errors and data loss.
See Mark’s (the researcher’s) blog for the full story.

Leave a Reply