Don't Buy Sony Music CDs -- Installs rootkits

Sony takes a page from spyware scum?

I first read about this at http://blogs.chron.com/techblog/ Here is an excerpt from that site.

Quote:

---

If this analysis by Mark Russinovich at software developer Sysinternals is correct, it's not just scummy spyware pushers and worm writers who install rootkits on Windows PCs.

At least one record label, Sony BMG, does it, too.

Russinovich discovered that a copy-protected CD he owns, Van Zant's Get Right with the Man, dropped a rootkit onto his system as part of its Digital Rights Management scheme. The CD comes with its own medai player, and can only be played on a PC with that software.

In his detailed, technical report, Russinovich outlines the steps he took to track down the rootkit and figure out that it came from this Sony CD.

What he also discovers is that the technique used by the rootkit to cloak itself could be taken advantage of by other forms of malware. In other words, the installation of the Sony software left his machine vulnerable to attacks.

It also proved difficult to remove -- I doubt the average PC-owning Van Zant lover would be able to do what Russinovich had to do. There's no uninstall utility for it, and he had to yank it by hand.

And when he did, it disabled his CD drive -- the icon was missing from Windows Explorer as a result.

Music labels, in a desperate attempt to save the dying CD format, are doing ugly things in the name of protecting their content. Of course, consumers can respond with their own ugliness -- don't buy CDs with this type of DRM. There are other ways to acquire these CDs, including downloading them from a source such as Napster or iTunes.

Yes, those files are copy-protected, but not in a malicious way, and if you burn a CD using them, you can rip them back to standard MP3 format.

(Spotted on Slashdot.)

Update: Reader Howard Hoy has posted several excellent updates in the comments. He's contacted Sony, asking for a way to remove the software. Sony sent him to a Web site that required the installation of an ActiveX control developed by the same company that created the rootkit. There's some indication the ActiveX control can perform a remote reboot of his system.

---

The attitude of Sony as reported is really unbelievable.

For anyone that doesn't know, Mark Russinovich's company is winternals.com and sysinternals.com, which is the top software development company for system utilities.

Linda

;) :rolleyes: :cool:

thanks for the warning. That's reprehensible and will surely backfire on them.

Nick just posted the same warning: http://discussions.virtualdr.com/sho...d.php?t=196667 ....it's a bad'n


Liam

I like the T.V.'s Sony makes but will never buy a Cd from them again until they come "clean" about this and give an uninstall option. And yes the big companies review forums like these and I hope Sony now knows they've been found out!

Quote:

---

it's not just scummy spyware pushers and worm writers who install rootkits on Windows PCs.

At least one record label, Sony BMG, does it, too.

---

There's a difference?

Quote:

---

Originally Posted by lgbpop

There's a difference?

---

EXACTLY!!! In the absence of corporate "sponsorship" of such activities, they would quickly die on the vine.

Boycott, boycott, boycott these products. It is the ONLY way to make ANY impact on the issues whatsoever. But, don't do it silently. Inform companies that you are not only going to boycott their products, but WHY.

This is beta software, but it will apparently detect this and other rootkits:

http://www.f-secure.com/blacklight/try.shtml

I've boycotted Sony for several years now regarding the lousy service I received(none)with some home electronics that went south on me from the start. :mad: I contacted them until I got fed-up with the no-answer/stupid answer syndrome of their so-called tech support. You have to realize however that this company is spread over most of the earth when it comes to where their products are actually Manufactured. And imho, the words 'quality control' are mostly non-existent with these goons. To put it more simply, as long as the bucks roll in,,they care squat about anything else.
Do yourself a favor and go elsewhere. 'caveot emptor' my friends... :rolleyes:

It's stupid how the music industry spends all this money and effort into preventing people from "stealing" their profits ... I'll tell them how to get people buying CD's again: Stop producing $16 albums that have only 1 or 2 good songs in each ... then, I'll buy your Cd's again, you thief! (Not that I condone anyone copying and/or downloading music illegally.)

Here is information here on Microsoft's response.

http://www.eweek.com/article2/0,1895,1838294,00.asp

According to this article they are going to be adding technology to combat this to both their MS Anti-spyware (beta) as well as to their Microsoft Malicious Software Removal Tool.

Cheers,

Linda

I've looked down on Sony for a while now, but this only makes it worse.

Anyone else own a Playstation or PS2? Anyone here never have a problem with either of them?

The answer to the second question is most likely "no".

The problem with DREs(Disc Read Errors)(due to the somewhat shoddy quality of Sony's hardware) got so bad that some third party took up a law suit against Sony. Instead of getting sued, they agreed to fix all PS2 units for free. Though, when you call in about this, they simply say they will wave the repair fee.

EDIT: Oh, wow! As soon as I finished posting this, they had a short news story on this topic on G4 TV! :eek:

This is unbelievable, where did Sony find the nerve to do this?! :mad:

Here is an in-depth article on this subject. What really pi**ed me off was this:

Quote:

---

It is not clear whether users with the existing DRM technology will be able to upgrade to the new features. However, Sony BMG offers a removal program for the copy protection software, which can be downloaded from the company's Web site, according to a spokesperson.

---

If you follow that link for the "removal program", you get to this page. Then you have to look for an uninstall program, which is not all that clear, unless you read through the FAQ. But here's the deal... you don't get to download the uninstall program. Noooooooooooooo. It takes you to an Uninstall Request form, where you have to give away some details like where you bought it, artist name, title etc.!!!What?! Come again? This pi**es me off double as much! Firstly, Sony does this cr*p, then the make you fill in a request to uninstall a program on my own computer!!! Does this seem absolutely ridiculous to anyone else!? Not only that, but apparently, eweek, who wrote the article, didn't even bother checking the link Sony provided them, trusting their word that it takes you to an uninstall program. Read the quote from the article above again. If they would have followed the link, they would surely have commented that it is a request form not a removal program!

I don't buy cd's radio is good enough for me. Never bought a Sony CD (I think) and now, never will. I'll consider whether I'm gonna buy any Sony in the future :mad:

In case anyone's missed this thread, check out the link to the .dll; one entry in the list reads:

Quote:

---

Akbar: All this is belonging to a copy protection (sony software driven copy protection). See also: Link

---

Sony's sure doing their best to be loveable lately... :mad:

Hmm, I was just thinking to myself...

Do you think that new Sony DVDs do this as well?

I would bet that Sony has this software on all of the CDs or DVDs, where they are trying to protect their intellectual property supposedly. As Mark with Sysinternals said "Not only does this stealth rootkit leave the PC vullnerable to other hackers, but he said the code is very sloppily written.

Linda

Quote:

---

Originally Posted by Syzich

Anyone else own a Playstation or PS2? Anyone here never have a problem with either of them?

The answer to the second question is most likely "no".

---

Yes I own both.

No problems with either other than when using scratched or dirty discs.

A good washing usually fixes the latter.

The scratched ones.....

Looks like Sony's trying to save face http://www.eweek.com/article2/0,1895,1881203,00.asp
http://www.betanews.com/article/Sony...kit/1130965475

The patch is available
http://cp.sonybmg.com/xcp/english/updates.html

And Wikipedia is well up to date http://en.wikipedia.org/wiki/Rootkit

Quote:

---

Update: Reader Howard Hoy has posted several excellent updates in the comments. He's contacted Sony, asking for a way to remove the software. Sony sent him to a Web site that required the installation of an ActiveX control developed by the same company that created the rootkit. There's some indication the ActiveX control can perform a remote reboot of his system.

Update 2.0: BetaNews reports that Sony plans to make a patch available that will uncloak the DRM software -- though it won't remove the DRM itself. The link is here, but at the moment requires the previously mentioned ActiveX control before you can download it. Uncool, Sony. Just cough up the patch without making your customers jump through hoops.

---

For more information, go to Mark Russinovich's Blog at

http://www.sysinternals.com/Blog/ Below are two posts from the 300 plus comments to this issue on Mark's blog.

Quote:

---

Mark - I'm glad to see this. Thought I was the only one steamed about this. I bought a reissue of an obscure jazz trombone album from 1964. It had this DRM on it. Sony has a site in the UK that deals with customer issues regarding this. I returned the CD and asked that they tell me how to remove this software. They have to install MORE software in order to remove this software. After trying with Sony, I wrote First 4 Internet directly (at [email protected]), regarding the removal process of their XCP-Aurora software, and asked what the ActiveX software was they need to isntall in order to remove the XCP software. Here is what they said, on October 27:

Dear Tom:

The updates site initially prompts the user to install an ActiveX control which detects if there is an XCP - Aurora installation and then selects the most appropriate update. To remove this activeX control simply open the folder ‘systemroot\downloaded program files’ (On a windows XP computer with a default installation the systemroot folder will be ‘C:\Windows’) and delete the file ‘codesupport.ocx’.

When the activeX control has been installed the Updates Site will display one of two screens. The updates site will either inform you that it cannot find an XCP installation or it will offer the download of Service Pack 1. Service Pack 1 contains several updates and workarounds but is essentially the same software that was originally installed from your purchased CD. If the Update Site displays the screen informing you it cannot find an XCP installation then the previous uninstall attempts have been successful.

If however the Update Site prompts you to install Service Pack 1 you can follow John’s instructions and the new uninstall should be successful. All you will be left with is ‘codesupport.ocx’ which is from the website not the CD so isn’t part of the uninstall process. ‘Codesupport.ocx’ is easily removed following the instructions above.

The FAQ (Frequently Asked Questions) for the Update Site contains detailed information regarding installing the activeX and downloading updates. The FAQ can be viewed here http://updates.xcp-aurora.com/faq.aspx.

If you have any further issues or the FAQ doesn’t resolve your questions please do not hesitate to reply to this email.

Very Best Regards,

The XCP – Aurora Support Team
http://updates.xcp-aurora.com

Here is one of the comments on the sysinternals website.

"Sent an email earlier today to New Media Manager, Stein Vegusdal @ SonyBMG Norway. In his reply he states that Mark has violated the DMCA act when he tried to find the installed rootkit and manually removed it. As per, he states that it clearly says in the EULA that customers have to contact Sony customerservice for getting removalinstructions. As to try to remove it yourself, Sony seems to think of it as a breach of the DMCA act and other applicable laws around the world. Further he states that First4Internet is a Symantec-partner and that Symantec has posted it as not harmful.. Seems like we can wait for forever for a Symantec removal tool against this **** then.

Further he defends the rootkit, by saying that the gamesindustrys copyprotection schemes are not being critizised, even if they have stricter rules... As if that makes the Sony case any better...

# posted by dubeldarr : 10:09 AM, November 02, 2005"

---

Quote:

---

SONY ISSUES PATCH

After a chorus of criticism, Sony Corp.'s music division said Wednesday it is distributing a free software patch to reveal hidden files that automatically installed to hard drives when some of its music CDs were played on personal computers.

The offending technology was designed to thwart music piracy.

Sony BMG Music Entertainment and its partner, UK-based First 4 Internet, said they decided to offer the patch as a precaution, not because of any security vulnerability, which some critics had alleged.

"What we decided to do is take extra precautionary steps to allay any fears," said Mathew Gilliat-Smith, First 4 Internet's CEO. "There should be no concern here."

---

http://seattlepi.nwsource.com/busine...rotection.html

# posted by Search Engines Web : 7:27 PM, November 02, 2005[/QUOTE]

Please note that this is not an uninstaller for DRM. It merely reveals the hidden stealth toolkit files.

Linda

;) :rolleyes: :cool:

Quote:

---

The patch will be made available for download from Sony BMG's Web site, with another offered directly to antivirus vendors. The DRM software will not be removed, however, only uncovered; that means users will still be unable to delete it without risk of rendering their CD drive inoperable.

Customers must contact Sony BMG support for removal instructions.

---

This still drives me mad! Some poor user can't uninstall a program on his computer because Sony says so?! :mad: :mad: :mad:

For an audio explanation of this piece of software trash that Sony is using
check out the podcast at
http://www.grc.com/securitynow.htm
Labels on the CD's say quote"content enhanced protected"
A search on "Amazon revealed 24,000 CD's that had this"

forgot this in my post

Episode #12 | 03 Nov 2005 | 24 min.
Sony's "Rootkit Technology" DRM (copy protection gone bad)

Leo and I discuss details and consequences of Sony Corporation's alarming "Rootkit" DRM (digital rights management) copy protection scheme. This poorly written software unnecessarily employs classic rootkit technology (see episode #9) to hide from its users after installation. It can not be uninstalled easily, it can be easily misused for malicious purposes, and it has been implicated in many repeated BSOD "blue screen of death" PC crashes.

I don't believe that two wrongs make a right....but wouldn't it be fitting if some hacker downloaded a rootkit into one of Sony's servers? Maybe the one in their accounting department, right before the end of the year when they have to do month-, quarter-, and year-end closings and figure out their corporate income taxes..and print their annual reports to shareholders ;) ....and maybe that rootkit caused their system to crash. What a shame. I'm sure Sony would agree with the need to have that rootkit there, though.

Right........... :rolleyes:

Here are two articles on this Sony's stealth rootkit. Both articles contain new information.

One of the key statements is that Sony's stealth toolkit breaks Vista spectacularly according to the first article. It has also been reported that this software crashes XP media centers.

Sony has a PR disaster on their hands. I wonder how long it will take for them to say "Uncle".

http://www.washingtonpost.com/wp-dyn...referrer=email

http://blogs.washingtonpost.com/secu...referrer=email

Cheers,

Linda

It shouldn't be possible to install a rootkit in Vista at all, though of course being still in early beta, the protection may not be there yet. There seems to be plenty of evidence of it crashing MCE from what I've seen.

Quote:

---

Sent an email earlier today to New Media Manager, Stein Vegusdal @ SonyBMG Norway. In his reply he states that Mark has violated the DMCA act when he tried to find the installed rootkit and manually removed it. As per, he states that it clearly says in the EULA that customers have to contact Sony customerservice for getting removalinstructions. As to try to remove it yourself, Sony seems to think of it as a breach of the DMCA act and other applicable laws around the world.

---

That is outrageous, and is just one small step removed from all malware writers being able to hide behind the DMCA. You guys over there in the US need to start doing something about that stupid law soon. That's what you get when big business can buy legislation, and bribe politicians (sorry, I mean "donate canpaign funds") :mad:

I am curious,

Do the CDs cause the same problems for people using linux or Mac OS?

Doc

No, this is a problem for Windows computers only ATM. But there certainly are Linux rootkits, indeed the very idea of rootkits started with Linux/Unix I believe. So this sort of thing could definitely be adapted for other OS's in the future.


There are more strong words here, I couldn't have written it better myself:

http://www.wired.com/news/rants/0,23...w=wn_tophead_5

Quote:

---

Sony may even have committed a crime under the U.S. Computer Fraud and Abuse Act, which can carry fines and prison terms for anyone who "knowingly causes the transmission of a program ... and as a result of such conduct, intentionally causes damage, without authorization, to a protected computer." Corrupting Windows so it misreports the contents of a hard drive sounds a lot like "damage," and the click-wrap license agreement on the Sony disk amounts to pretty thin "authorization" -- disclosing only that "this CD will automatically install a small proprietary software program ... intended to protect the audio files embodied on the CD."

---

:( Not much of a warning message.

Liam

Thanks everyone for this information. Not only will I boycott all Sony products, but I'll make sure everyone I know is aware of this. How bad would it be if you bought someone a Sony CD for Christmas and it ended up disabling their machine or invited in other malware? Cripes!

Here is the URL for the Sony music feedback if anybody else wants to voice their opinions directly to Sony:

http://www.sonymusic.net/sony/feedback.cgi

Here's some more good commentary:

http://news.bbc.co.uk/1/hi/technology/4406178.stm

Quote:

---

Number four tells you to consult the EULA when you want to copy the disc. Which madhouse did we step into that now means a CD needs a EULA? I stopped buying CDs so I wouldn't have to give money to rapacious weasels years ago, and none of the CDs I own have a EULA on them. It is madness. So, at Best Buy tonight, I tried to consult the EULA before I bought the Van Zant CD.

It wasn't on the CD package, not on the shelves near by, and the blue shirted aisle trolls had no idea what I was talking about. No, they could not provide me with one, I did ask though. So, if you are dumb enough to buy a Sony CD, and don't want to rootkit your machine, you can't find out beforehand, have to agree to a one sided contract that you can't read before you say yes, and can't get your money back. Wonderful, thank you Sony.

---

Quote:

---

To end on an up note, just think about these two things. What you are seeing is the light and happy side of rights removing DRM infections. There is a bill going through congress to remove more of your rights. Yes, they can't control the analogue hole, and can't legally force you to bow to them, so they are buying government to change the laws and accomplish both goals. No good will come to the end user because of this, but it sure will make a lot of people rich.

---

Here's the full article:

Sony DRM is worse than you might think

Please remember when it comes to the IRA..oops RIAA.. Sony is just the leader of the pack.
And this "Hidden" root kit is just the latest in the chain of "Copy Protection" software that RIAA members have been useing. And why this one is so bad? because the user dosent know it is there, and if you do manage to remove it (with out the SONY Tool) your PC will be unable to play ANY audio CD..
Seems little has changed, well that is my impression..
User buys a CD, places it in their PC to enjoy the music.. Get hit with the request to "Please install our Little program so you can enjoy the advanced features of this disk", yeh the advanced features? Spyware, and copy protection software.

Quote:

---

The pirates who don't want to pay will have no trouble getting it, but those who abide by the law will get punished.

---

quoted from one of the news links..
been fighting this type of parasite software for over 18months.. same leopard, same spots, hidding under a different tree

Quote:

---

Originally Posted by SuperSparks

Here's the full article:

Sony DRM is worse than you might think

---

Well... I'm as unhappy about this as the next guy, but one thing's for sure. Until SOME of US are willing to take on these corporate and government @$$holes in court, all the complaining in the world won't accomplish much. And, I say this fully recognizing what a long uphill battle that will be. But in this case we can either stop supporting them entirely, and give up buying new music, or we can challenge them legally. Anything short of that is just sour grapes.

FWIW, I haven't bought a CD in the last 4 years. I can get all the music I need from my existing collection and Internet Radio. Over on this side of the pond, we not only have to put up with the DRM crap, but we pay the same in pounds as you guys do in dollars, regardless of the exchange rate. I'm fed up with being ripped off, and I've voted with my wallet :mad:

If the recording companies wanted to design a method for getting their customers to stop purchasing CDs, they could not have come up with a better idea. No doubt, they will blame it on people stealing their intellectuals but when their sales go through the floor, then maybe someone at these companies will realize that they goofed.

I also think that this issue is going to have to result in a class action lawsuit.

A fair use policy needs to be established similar to the what was established for VCR tapes 20 years ago.

The very best result would be for recording artists to set up their own distribution systems, so that they not only earn more but retain the copyrights to their intellectual creations. It is not just the consumer that is being ripped off but IMO most of these recording artists are also being ripped off.

Cheers,

Linda

;) :rolleyes: :cool:

I fully agree with SuperSparks. Probably the best way to show that not all the consumers are as stupid as Sony hopes that we are is to vote with our pockets. Boycott them until they offer a suitable solution to this mess, apologize to the consumers whos computers may have been damaged and change their strategy all together.
I have started a petition which I hope will make its rounds. You are all welcome to sign it and send it on to everyone you know.
http://www.petitiononline.com/sonydrm/

I also am saying bye-bye to Sony and their underhanded methods.

Does someone make a program that will allow the user to either grant or deny permission to do a silent install such as Sony's rootkit???

Quote:

---

Originally Posted by John Steven

I also am saying bye-bye to Sony and their underhanded methods.

Does someone make a program that will allow the user to either grant or deny permission to do a silent install such as Sony's rootkit???

---

Not that I know of. As far as I know, there are only a few scanners that can detect the rootkits, but no programs that can actively stop them from installing. It shouldn't be long before anti-spyware programs integrate it into their real-time scanning.

However, Windows Vista will have built in protection against rootkits. In fact it's probably the only way of protecting against them with any certainty, to have the protection written into the OS kernel itself.

Come on people,put your sig where your mouth is! Only 4 signatures on the petition now.

And, there 'is' a way to keep the rootkit totally "off" your PC! Trouble is,our AUP won't let me discuss it... :rolleyes:

Done, i didn't see the link put up by Usil.:)

EDIT BTW The new rootkit and keylogger protection in Vista is going to the called Windows Defender, it's an upgraded version of Anti-Spyware Beta, same GUI AFAIK, nice and easy to navigate and setup.:)

Liam