Malicious software on Sony CDs.

[loose passive]

Sony rootkit under fire in court
Lawsuits filed in California and Italy and more to follow

Tom Sanders in California, vnunet.com 11 Nov 2005
Several class action law suits are being filed against Sony BMG over its controversial XCP anti piracy software.

One case was filed early November in California where consumer Alexander Guevara is asking the judge to ban Sony from selling any additional music CDs protected by anti-piracy software such as the controversial XCP technology.

The XCP anti piracy software aims to regulate the number of copies that a consumer can make of a CD on his computer as well as limit the file formats in which the CD can be ripped. To prevent the user from deleting the technology, it comes bundled with a so-called rootkit that hides the software from both the user and the system, including anti-virus software. Security experts have said that the technology is poorly designed and easy to use by worm authors to dodge detection by anti-virus software.

A first virus targeting the software was detected on Thursday.

Alan Himmelfarb filed the lawsuit on 1 November, one day after software developer Mark Russinovich, of Sysinternals unveiled the technology's true nature on his blog. The suit is seeking class action status, which would allow Himmelfarb to argue his case on behalf of all of California's residents who have purchased an audio CD with the XCP technology.

An employee for Himmelfarb's lawfirm confirmed its involvement in the suite, but was unable to provide further details because Alan Himmelfarb was travelling.

Sony BMG did not return phone calls seeking further information. The company has always maintained that its software is harmless and doesn't compromise a computer's security.

Himmelfarb's complaint alleges that Sony failed to disclose the true nature of the XCP software. "These actions constitute fraud, fralse advertising, trespass and violation of state and federal statues prohibiting malware, and unauthorized computer tampering," he wrote in his legal complaint.

Another similar suit is being prepared in the state of New York and a consumer watchdog group from Italy too has taken legal action against the record label.

************************************************** *********

I was told this software could be used to make programs that can run undetected on your system. Does anybody think someone is going to use this to keep bots or something else running without detection?