A quick update: Sony have been releasing CDs containing a piece of software which can, at best, be used by hackers to bypass just about all existing anti-virus, anti-spyware, anti-trojan software. At worst, Sony’s rootkit can harm your pc without any intervention from hackers.
From what I can make out, the ‘good’ news is that this software has only been released on 20 titles so far, but… these have sold millions. More ‘good’ news is they’ve only been sold in the USA. But some may have found their way across to the UK (etc) via Amazon. And the company may issue this crap on more titles in the future. Or an advanced version of this crap.
This discovery has caused an uproar and been featured on the BBC and the Washington Post, as well as on websites, blogs, etc.
According to most sources, e.g. the BBC, Mr Russinovich, a renowned Windows programming expert, came across the Sony BMG anti-piracy system when performing a scan of his computer with a utility he co-created that spots so-called rootkits.
Rootkits are used to hide malicious software once it is installed and ensure it is not found and removed by anti-virus (etc) programs.
In fact, it seems it was first reported on August 12 by ‘jgk4cfc‘ at CastleCops (Thanks to wawadave at CARMA for pointing that out to me).
But let’s not quibble. It was certainly Mark Russinovich who really brought it to peoples’ attention when he posted his findings on the SysInternals web site, where he said, "Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall."
Intended to enforce digital rights management (DRM), the software was slowing his pc by scanning running processes every two seconds, even when no CD was playing. When he deleted these unwanted drivers, which he had to do manually as there was no uninstall, the CD drive disappeared from Windows explorer. Russinovich was able to fix his system with low-level tools, but the average consumer would have no chance without expert help.
Due to public pressure, Sony have now come up with a way to – supposedly – uninstall this crap… more on that further on.
Windows users cannot listen to tracks on the CD without agreeing to install the anti-piracy program, which merely advises that "it will install a small proprietary software program" that will remain there "until removed or deleted." Washington Post
What this seems to mean is that you can’t play these CDs using Windows Media Player or your favourite player, but only on a player that comes with the CD. I don’t really like that idea.
And what about that bit “until removed or deleted” ???
According to Mikko Hypponen, director of research for Finnish antivirus company F-Secure Corp., users who want to remove the program may not do so directly, but must fill out a form on Sony's Web site, download additional software, wait for a phone call from a technical support specialist, and then download and install yet another program that removes the files. Washington Post
Not quite so easy to remove this piece of crap, then. If, indeed, it removes it. Here’s what Sony say:
Please note, in addition to removing the cloaking, (Sony) Service Pack 2 includes all fixes from the earlier Service Pack 1 update. In order to ensure a secure installation, (Sony) Service Pack 2 includes the newest version of all DRM components. http://cp.sonybmg.com/xcp/english/updates.html
So, does Sony’s ‘cure’ remove their crap, or just update it with more crap?
Hypponen agreed that Sony's software could help hackers circumvent most antivirus products on the market today.
He added that installing the Sony program on a machine running Windows Vista -- the beta version of the next iteration of Microsoft Windows -- "breaks the operating system spectacularly." Washington Post
Oh boy, bet Microsoft just love Sony!
And I’ve just read Mark Russinovich’s latest blog.
Sony refuses to admit blame and to make an uninstaller readily available. The uninstall question on Sony’s FAQ page directs you to another page that asks you to fill out a form requesting for uninstall directions to be emailed to you.
There’s no way to access the uninstaller without providing this information, and clicking on the Sony privacy policy link at the bottom of the page takes you to a notice that your email address will be added to various Sony marketing lists.
… I dug a little deeper and it appears the Player is automatically checking to see if there are updates for the album art and lyrics for the album it’s displaying. This behavior would be welcome under most circumstances, but is not mentioned in the EULA, is refuted by Sony, and is not configurable in any way. I doubt Sony is doing anything with the data, but with this type of connection their servers could record each time a copy-protected CD is played and the IP address of the computer playing it
Read Mark Russinovich’s latest blog here.
You’ll see that:
The update is more than 3.5 megabytes in size, and it appears to contain new versions of almost all the files included in the initial installation of the entire DRM system, as well as creating some new files. In short, they’re not just taking away the rootkit-like function — they’re almost certainly adding things to the system as well. And once again, they’re not disclosing what they’re doing.
No doubt they’ll ask us to just trust them. I wouldn’t. The companies claim to have developed “new ways of cloaking files on a hard drive”. That is, new ways of hiding them from anti-malware programs. freedom-to-tinker.com