p2pnet - rss feed: New: Sony BMG rootkit DRM
p2p news / p2pnet: Sony BMG is now using rootkit-based DRM on some CDs sold in the US.
A rootkit is a set of tools developed to crack a computer system. Normally, malware authors who want to stay hidden use it but, “As far as we know, this system has been in use since March 2005,” says F-Secure research director Mikko Hypponen on the company blog.
“We’ve made some test purchases for Sony BMG records from Amazon.com and can confirm that they contained this technology.”
Hypponen says when a CD is slotted into a Windows-based PC, a license agreement is displayed, “and then it will seem install a song player software”.
However, what’s really happening is a rootkit is being planted in the system and, “there’s no direct way to uninstall it,” says Hypponen.
“The system is implemented in a way that makes it possible for viruses (or any other malicious program) to use the rootkit to hide themselves too.
“This may lead to a situation where the virus remains undetected even if the user has got updated antivirus software installed.”
F-Secure has published a technical description on the Sony BMG rootkit, with details on how to distinguish hidden items belonging to the DRM system from potentially harmful malware, it says,adding that F-Secure has a free BlackLight ‘Scan for Rootkits’ in beta.
You can download it here but, “If you find this rootkit from your system, we recommend you don’t remove it with our products,” warns Hypponen.
The Sony BMG rootkit DRM system is implemented as a filter driver for the CD drive and, “just blindly removing it might result in an inaccessible CD drive letter, he says. Rather, contact Sony BMG directly to find out how to remove the plant.
“We’ve test driven this and they will provide you with tools to do this,” promises Hypponen.
REVISED @ 8:53AM Pacific:
If you want more - a lot more - on this, “The entire experience was frustrating and irritating,” concludes Mark Russinovich on Mark’s Sysinternals blog.
“Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall. Worse, most users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files.
“While I believe in the media industry’s right to use copy protection mechanisms to prevent illegal copying, I don’t think that we’ve found the right balance of fair use and copy protection, yet. This is a clear case of Sony taking DRM too far.”
As Henry Skoglund posted in a comment, “I predict that maybe the next time you’re purchasing a music CD with similar DRM software on it, you’ll never open the package, instead downloading the MP3 files for that album through (illegal) P2P file sharing.
“For some strange reason all DRM software is missing in those P2P downloads, leaving you with just the music to enjoy… :-)”
(Thanks, Nicholas)
Stay tuned.
Something you think we should know? tips[at]p2pnet.net
See:-
blog - The “Sony rootkit” case, November 1, 2005
Mark’s Sysinternals blog - Sony, Rootkits and Digital Rights Management Gone Too Far, October 31, 2005
November 1st, 2005 at 7:05 pm
If one purchases a CD and then proceeds to download the songs from that CD from p2p to make a backup copy, then Mr. Skoglund’s assertion that act constitutes an illegal use of file sharing is incorrect. Making a backup copy has always been considered within the realm of fair use.
In fact, it’s probably best to create the backup and use it when you wish to use that slbum. This will preserve the integirty and greatly extend the operational life of the disk that you purchased to acquire the fair use rights to make the subsequent disk.
In IT, it’s common practice to NOT use the media that came in the licensing kit, MSDN, or development environment kits, but only use those to make back-up copies for every day use. In effect, you are merely designating the ‘original’ as a back up.
–TurboGeek
November 1st, 2005 at 9:05 pm
Linux time.
November 2nd, 2005 at 2:46 pm
In my BLOG entry for this story I asked people to write their MP.
http://www.digital-copyright.ca/node/1172
Someone commented to remember to mention section 430 of the Criminal Code of Canada. While he suggested “particularly the part about rendering property dangerous.”, I believe that (c) and (d) are sufficient and harder to argue against.
Remember: The only relevant “property owner” here is the owner of the computer, not the copyright holder of the music on the CD who has no legal right to damage your computer to protect the terms of their license agreements.
http://laws.justice.gc.ca/en/C-46/43282.html#section-430
Mischief
430. (1) Every one commits mischief who wilfully
(a) destroys or damages property;
(b) renders property dangerous, useless, inoperative or ineffective;
(c) obstructs, interrupts or interferes with the lawful use, enjoyment or operation of property; or
(d) obstructs, interrupts or interferes with any person in the lawful use, enjoyment or operation of property.
November 2nd, 2005 at 2:51 pm
I am wondering if anyone has a copy of this specific Sony CD. It would be interesting to see how it will respond on a more secure computer such as Apples MacOS-X (underlying operating system is Darwin, a distribution of BSD Unix) or the various Linux distributions.
Most of the so-called “Copy Control” CDs I’ve heard of simply have data tracks on them that are simply ignored by the most common audio playing software, and thus the existence of this “Copy Control” is invisible to everyone but the Microsoft Windows users.
We know for certain that this malware can not install on anything other than Microsoft Windows so at least you know that by inserting the CD in other computers that it can’t do any damage.
November 2nd, 2005 at 4:13 pm
What happens if you hold the shift key or disable autorun? Sounds like either one of these will let you bypass this rootkit DRM malware junk. Will the disc still rip or does it have some other fair use restriction to prevent that?
November 10th, 2005 at 9:47 pm
http://img469.imageshack.us/img469/1824/sonypriceless3tg.png