Sony may have infected YOUR PC.

I would not put any Sony media into Your PC. Particularly cd’s & dvd’s made/marketed since April 2005.

Sony DRM Rootkit blows huge hole in PC Security…? See article(s):

cliffs: Sony protected media discs autoinstall a hidden (hidden from MS & Anti-viral software) rootkit / .exe that opens up Your compture to more malicious code then the last 5 “Big Name” viruses.

http://www.slyck.com/news.php?story=997

Damage Runs Deep With Sony-BMG Fiasco
November 17, 2005
Thomas Mennecke

Trying to gauge the damage caused by Sony-BMG’s rootkit DRM will take years to comprehend. The gaping wound caused by Sony-BMG exists well beyond infected computers, security problems, and a tarnished reputation. The record label’s entire philosophy on P2P networking, Internet piracy and DRM has been effectively destroyed.
The copyright industry has attempted to persuade P2P users back into the record stores by exploiting a largely overblown claim that file-sharing networks expose risks to malicious software. On June 14, 2004, MPAA CEO Dan Glickman made the following statement.

“While these P2P services would have users believe they simply offer an easy way to download movies and music, they really do much more. It is well-documented that using these services can lead to user’s computers being infected with spy ware and viruses. Often, unwitting users have their most sensitive, private information exposed to unfriendly eyes around the world. Further, P2P systems have been used by pornographers as an easy avenue to reach children.”

This argument by the copyright industry has been annihilated. Computer Associates labeled Sony-BMG’s rootkit as both spyware and a trojan horse. Minimum estimates suggest as many as 500,000 individuals have Sony-BMG’s rootkit DRM installed – far exceeding any infections caused by P2P networking.

Even without an official label by Computer Associates, the public perception of Sony-BMG’s rootkit is that of distrust. In an ironic twist of fate, computers infected with Sony-BMG’s DRM software run the serious risk of being exposed to malicious software. Considering the files Sony-BMG use are hidden from anti-virus and anti-spyware applications, any virus writer can write an identically named file and exploit an untold number of computers.

The copyright industry has also preached from a moral standpoint. Believing there is a parallel between downloading a file from the Internet and physically stealing a CD from a music store, both the music and movie industry have accused file-traders of moral corruption.

“This is not just about online versus offline,” said Hilary Rosen, former president and CEO of the RIAA. “Most in the online business community recognize that what Napster is doing threatens legitimate e-commerce models - and is legally and morally wrong.”

Much like the virus argument, the “moral” argument has also been vanquished. The reason why Sony-BMG found itself in so much trouble is because they hid information – otherwise known as deception – and thought they could get away with it. The specifics of Sony-BMG’s rootkit were never disclosed in the EULA, and they certainly did not disclose the consequences of its removal. Whatever moral standpoint the copyright industry had was effectively nullified when Sony-BMG and First4Internet inked their deal.

Although Sony-BMG succeeded in negating the music and movies industry anti-P2P argument in one swift stroke, that’s not the extent of the damage. The music and movie industry’s Digital Rights Management (DRM) campaign – once shrouded in secrecy – has also suffered irreparable harm.

DRM (Digital Rights Management) is a blanket term used to describe copy protection on any digital medium. The protection can be simple, such as blocking unlicensed search terms, or very complex, such as First4Interent’s XCP (extended copy protection.) The deployment of DRM can be considered secretive because very few individuals are actually aware of it.

During a recent anti-DRM protest in New York City, a wide majority of individuals were unaware that such copy protection even existed.

Sony-BMG managed to change all of that.

The last thing record labels want is a tremendous amount of attention drawn to the implementation of DRM. As if Sony-BMG’s actions weren’t bad enough, drawing negative publicity to the DRM issue on only compounded the situation.

Now people are very aware of the Sony-BMG fiasco and the implementation of DRM. What was once largely invisible to the average customer has been shot right into the spotlight. The term “DRM” is now associated with malignancies such as ‘virus’, ‘malicious software’, ‘deception’, ‘arrogance’, ‘distrust’, and ‘trojan.’

This situation has already delayed the implementation of DRM on CDs. Sony-BMG has ceased the manufacture of CDs with XCP software, and does not expect to reinstate their DRM policy until sometime next year. Other record labels are also coming under increased scrutiny for their DRM products, forcing EMI to state, “We don’t use rootkits.” With so much public scorn now directed towards DRM, record labels are facing the very real possibility that DRM in its current incarnation can no longer manage to exist.

Sony-BMG has managed to accomplish in 16 days what bloggers, the Electronic Frontier Foundation, writers, journalists, and niche sites have been working on for years. Sony-BMG has destroyed the music and movie industry’s arguments against P2P, and brought mainstream attention and public distaste to the DRM debate.

:confused:

A “less” editorial article:

http://lfpress.ca/newsstand/Business/2005/11/17/1310415-sun.html

Sony safeguard backfires

By JOHN MILLAR, SPECIAL TO THE FREE PRESS

Who would have thought that buying a Sony BMG music CD would open their computer to a malicious virus attack or cause their listening habits to be communicated on the Internet without their consent or even their knowledge?

It is unlikely Sony thought it was creating a security risk for the legitimate purchasers of its music CDs. But that is what happened last week.

What must have seemed like a viable way to control unauthorized copying of music turned into a PR nightmare.

Sony started to use a form of digital rights management technology on its CDs. This anti-copying software would automatically install on a user’s computer when the music CD was inserted in a computer disk drive.

A number of problems resulted. First, the application was designed to install at a “root” or system level and be disguised so it could not be found by normal means. Also, the computer user would need to read the entire user agreement and understand the wording in order to have any awareness of the application and how it would operate.

Second, the media player Sony used with the CDs would send the Internet protocol address of the user’s computer and their listening habits back to Sony – without notice to the user.

As if that wasn’t enough to create a public relations problem, the application could be co-opted by a hacker. Designed to hide a legitimate objective (preventing unauthorized copying) it could also be used to hide other objects, including malicious code taking advantage of the Sony technology.

It did not take long for an exploit to appear.

A Trojan horse named Backdoor.Ryknos takes advantage of the security risk created to hide itself on the user’s computer.

Backdoor.Ryknos also adds itself, as a trusted application, to the Windows Firewall and open a back door. The code causes the infected computer to connect to a predetermined IRC channel using a specific transmission control protocol port.

The attacker can then send sensitive information about the compromised computer, send a notification message to a predetermined IP address and download and execute files.

Another problem arose when Sony offered a way for users to remove the rootkit. Its website said before downloading the uninstaller, you had to give your identity, the albums and artists purchased, e-mail address and other data back to the Sony-related company that makes the rootkit. There is no way to disable or modify the “phone home” technology.

According to security experts, manually removing the application might even damage the compromised computer’s operating system and possibly violate the manufacturer’s end-user licence agreement.

A further risk could arise if a user brought one of the CDs to play on their office computer. If a hacker were able to gain access to the application, they would potentially be able to compromise the business’s network.

All because someone thought they could solve one problem – without fully thinking through the possible consequences.

Instructions for anyone wishing to disable the auto-run feature on the CD are available from a number of security vendors. Computer Associates instructions are located at www.ca.com/securityadvisor. Similarly, security vendors now offer online scanners which include the ability to detect the presence of the application.

jesus christ, nice job sony

i hope some huge company gets hacked because an employee brought in a son cd to play on their computer, and sony gets fucked in court by said company

lol at sony

this is >>> mercedes self-braking breaking.

rofl… (until I get home and check my PC that my bro-in-law fucks up all the time) :squint:

http://www.sysinternals.com/blog/2005/11/sony-you-dont-reeeeaaaally-want-to_09.html

For those readers that are coming up to speed with the story, here’s a summary of important developments so far:

The DRM software Sony has been shipping on many CDs since April is cloaked with rootkit technology:

  • Sony denies that the rootkit poses a security or reliability threat despite the obvious risks of both
  • Sony claims that users don’t care about rootkits because they don’t know what a rootkit is
  • The installation provides no way to safely uninstall the software
  • Without obtaining consent from the user Sony’s player informs Sony every time it plays a “protected” CD
    Sony has told the press that they’ve made a decloaking patch and uninstaller available to customers, however this still leaves the following problems:
  • There is no way for customers to find the patch from Sony BMG’s main web page
  • The patch decloaks in an unsafe manner that can crash Windows, despite my warning to the First 4 Internet developers
  • Access to the uninstaller is gated by two forms and an ActiveX control
  • The uninstaller is locked to a single computer, preventing deployment in a corporation
    Consumers and antivirus companies are responding:
  • F-Secure independently identified the rootkit and provides information on its site
  • Computer Associates has labeled the Sony software “spyware”
  • A lawfirm has filed a class action lawsuit on behalf of California consumers against Sony
  • ALCEI-EFI, an Italian digital-rights advocacy group, has formally asked the Italian government to investigate Sony for possible Italian law violations

A lawfirm has filed a class action lawsuit on behalf of California consumers against Sony

ALCEI-EFI, an Italian digital-rights advocacy group, has formally asked the Italian government to investigate Sony for possible Italian law violations

bwahaha, sony is fuxored

As this spreads more & more, and the talking heads get ahold of this, pass the word onto the soccor moms & teenages boys that make up their demogrpahics…

Yes, Sony is fucked.

I dont think that I’ll buy anything from them again.

In reading alot more about this, they really, truly fucked up.

lol stupid sony…

ok, heres my take on it. It seems as if Sony is going after the wrong people here. I mean, why are they putting people at risk that are actually BUYING their albums/movies (or even downloading them legally)? Am I the only one that doesnt get that? I mean, after reading that… I’d much rather use a P2P network to get my music than buy something in the store… Atleast I know I have a better chance of keeping my system clean (or IF it did get infected with spyware/virus I’d be atleast able to detect it and fix the problem).

Way to go dickheads :tup: Just keep digging that hole deeper

If you’ve been reading Slashdot.org , or Theregister.co.uk … you’d know that sony’s already in hot shit over the rootkit software that they employed.
Their user agreement is also hilarious. If you go bankrupt… must delete songs, leave the country… deleted, get robbed, deleted.

there are multiple class action lawsuits against sony right now.

i read something about this the other day…

sony :smash2: