Sony CDs Rootkit Your Systems (Bad news)

Matt Flynn · #1 11-20-2005, 12:20 AM

This is last week in the tech world, but many Sony CD's secretly rootkit your system. See the links below for a discussion of what that is. It is bad. A rootkit essentially creates an environment "around" your system that the system cannot see. It is invisible to antispyware and other malware detection software. It cannot be tracked by regular means. The Sony malware can easily be exploited by hackers and has already been. It can also screw up your devices and some programs.

Thanks to my buddy Earl, here are some Links:

The blog posting by Mark Russinovich that started the furor in which a
security techie discovers the rootkit. Basically, it's a geek
detective story.

http://www.sysinternals.com/blog/200...al-rights.html

Washington Post picks up the story:

http://blogs.washingtonpost.com/secu...aids_hack.html

Slashdot picks up a second Russinovich blog in which he shows the Sony's
DRM phones home.

http://games.slashdot.org/article.pl...207&tid=10

Why rootkits should be illegal; Malware that exploits Sony's rootkit
appears:

http://it.slashdot.org/article.pl?si...72&tid=233

Sony's wonderful EULA analyzed:

http://www.eff.org/deeplinks/archives/004145.php

Here's the must read: Bruce Schneir (a big crypto-guy) asks why the
anti-virus didn't detect Sony's DRM rootkit.

http://www.schneier.com/blog/archive...drm_rootk.html

Hmmm, the security companies are evidently NOT going to protect you from
malware put out by companies. Also, you do really think that Sony is
the only one doing this?

Enjoy. If you want to test for it, go to http://www.f-secure.com/blacklight/ and download their beta-test rootkit detector.

I am putting Sony on a two-year boycott for this. Worse, it looks like I'll have to go Linux once the new Microsoft operating system comes out. Unreal.

astroglide · #2 11-20-2005, 12:33 AM

[ QUOTE ]
I am putting Sony on a two-year boycott for this.

[/ QUOTE ]

do you think this order came from the ceo? sony is a monster company, no doubt with billions of divisions, vice presidents, and managers. the audio cd people have likely never even met the dvd player people. the dvd player people haven't met the television people. etc. sony has gotten a lot of deserved anti-press over this.

your boycott won't do anything individually, which i'm sure you know, but feel it's worth it on principle which would be fine. but what i'm suggesting is that the idea of boycotting everything they make (if that is your intention) seems kind of dumb, because each division can effectively be seen as its own company. for a philosophical boycott, how about just skipping their audio cds? that way if you think the playstation 3 or some other product looks cool, you can still buy one.

i've never understood why people would stop eating at a restaurant over a bad waiter, stop shopping at a store over a bad salesperson, etc. there are other waiters and there are managers to which you can complain and actually make a difference as opposed to simply not showing up. running up the chain of command until you get a response that satisfies you isn't a big hassle, and at a minimum you'll usually get free stuff out of it. one of my stepfathers had all sorts of places where he "couldn't go" because of isolated problems. as a consumer, he screwed himself.

[ QUOTE ]
Worse, it looks like I'll have to go Linux once the new Microsoft operating system comes out. Unreal.

[/ QUOTE ]

vista isn't even close to being released. if you decide for whatever reason that it sucks, you'd still be infinitely better off with a mac over a pc with linux if you value day-to-day usability.

wonderwes · #3 11-20-2005, 12:34 AM

I read this on Yahoo news. This story came out late on Friday, but it will get a lot of attention next week. This is a huge ordeal.

Its really scary that companies like Sony are tracking you and invading your PC's for their own well being. Kinda like when party poker port scan's your box.

Can't trust anyone these days.

vulturesrow · #4 11-20-2005, 12:54 AM

[ QUOTE ]
Here's the must read: Bruce Schneir (a big crypto-guy) asks why the
anti-virus didn't detect Sony's DRM rootkit.

[/ QUOTE ]

Because a rootkit isnt a virus? And from what I read, the program wasnt even a rootkit per se.

Matt Flynn · #5 11-20-2005, 01:16 AM

[ QUOTE ]
[ QUOTE ]
Here's the must read: Bruce Schneir (a big crypto-guy) asks why the
anti-virus didn't detect Sony's DRM rootkit.

[/ QUOTE ]

Because a rootkit isnt a virus? And from what I read, the program wasnt even a rootkit per se.

[/ QUOTE ]

It is.

Matt Flynn · #6 11-20-2005, 01:21 AM

[ QUOTE ]
[ QUOTE ]
I am putting Sony on a two-year boycott for this.

[/ QUOTE ]

do you think this order came from the ceo? sony is a monster company, no doubt with billions of divisions, vice presidents, and managers. the audio cd people have likely never even met the dvd player people. the dvd player people haven't met the television people. etc. sony has gotten a lot of deserved anti-press over this.

your boycott won't do anything individually, which i'm sure you know, but feel it's worth it on principle which would be fine. but what i'm suggesting is that the idea of boycotting everything they make (if that is your intention) seems kind of dumb, because each division can effectively be seen as its own company. for a philosophical boycott, how about just skipping their audio cds? that way if you think the playstation 3 or some other product looks cool, you can still buy one.

[/ QUOTE ]

Absolutely I want to punish the whole company. It encourages Sony and other companies to create cultures of responsibility and holds them accountable.

#7 11-20-2005, 01:32 AM

Sony's recalling the problem, as I read it...

related stories

BadBoyBenny · #8 11-20-2005, 01:37 AM

Do you really believe that if this software had been installed by an adware agency a small freeware company or they wouldn't have done anything?

astroglide · #9 11-20-2005, 01:51 AM

i think you're cutting off your nose to spite your face here

PhatTBoll · #10 11-20-2005, 02:02 AM

Perhaps if people didn't insist on stealing music en masse, this stuff wouldn't exist.

As it is, this seems a lot like the occasional weakness in Windows that gets a lot of press every now and then. The problem is identified, made public, and fixed. It just seems like a lot of hyperventilating. Wasn't it common knowledge that manufacturers were putting anti-theft software on their CD's?