SunnComm DRM on 140 CDs
p2p news / p2pnet: The writing is now clearly on the wall: the sun is setting for US DRM company SunnComm.
Although its MediaMax DRM software has repeatedly been shown to be a guard dog that can’t bite, it’s still used by a number of companies, including the seriously discredited Sony BMG.
However, over the past few days, Version 5 has been shown to be not merely easily by-passed, but also actually dangerous to the security of anyone who’s bought and used a CD carrying SunnComm MediaMax 5.
Moreover, the danger isn’t confined to Sony BMG music discs.
MediaMax technology has appeared on over 140 commercially released CD titles across more than 30 record labels, the EFF (Electronic Frontier Foundation) points out in a FAQ.
In it, the EFF also rescinds its earlier recommendation which said, “EFF and SONY BMG urge all consumers who receive notice to download and install the patch immediately”.
“Currently our focus is on the Sony BMG CDs, but we are investigating whether the vulnerability exists on other labels, and urge every label that has used the MediaMax technology to check with security experts immediately,” says the EFF.
This follows news that tests by researchers professor Ed Felten and Alex Halderman show there’s a way a hacker can, “booby-trap the MediaMax files so that hostile software is run automatically when you install and run the MediaMax patch,” as they say on Felten’s Freedom to Tinker blog.
SunnComm recently swallowed a painfully obvious p2pnet spoof, going so far as to issue an official press release denying its veracity.
Also read:-
can’t bite – MediaMax protected CD online, June 18, 2004
actually dangerous – Sony SunnComm DRM mess worsens, December 8, 2005
FAQ – SunnComm MediaMax Security Vulnerability FAQ, December 8, 2005
Freedom to Tinker – MediaMax Bug Found; Patch Issued; Patch Suffers from Same Bug, December 7, 2005
p2pnet spoof – SunnComm falls for p2pnet spoof, November 9, 2005
December 8th, 2005 at 5:03 pm
… to make people too frightened to insert a CD into their PC? I think it will make a lot of people think twice about ripping any CD, and perhaps that was the point.
Did the big four draw straws and the lucky loser had to sacrifice their reputation and legal budget for the greater good?
Chris
December 8th, 2005 at 5:17 pm
This new piece by Felten this morning reads like he is telling SunnComm that they are a bunch of amateurs.
http://www.freedom-to-tinker.com/?p=944
December 8th, 2005 at 5:59 pm
they are a bunch of amateurs – or should we say scammers?
December 8th, 2005 at 6:28 pm
“Did the big four draw straws and the lucky loser had to sacrifice their reputation and legal budget for the greater good?”
Your first point about frightening people may be onto something. The second part about one of the big four making a “sacrifice” for the “greater good” is hilarious.
December 8th, 2005 at 6:57 pm
I put a certain new Dave Matthews CD (promo version, not dual disc) into my PC the other day that was clearly marked as containing the “MediaMax” malware. I launched Exact Audio Copy then held down a rectangular key on my keyboard while inserting the disc and continued to keep it depressed for a 1/2 a minute or so. I then selected all but the virus, er, I mean data track and made MP3 files of the songs. I can now transfer my Dave Matthews songs onto my portable MP3 player and make a copy of the CD for my car changer. Fair use.
http://www.afterdawn.com/software/audio_software/cd-da_extractors/exact_audio_copy.cfm
SHIFT
P.S. Use LAME (–preset standard) with EAC. Best ripper/mp3 encoder software out there at any price, and both are FREE!
http://sourceforge.net/project/showfiles.php?group_id=290
(copy and paste this link into your browser address bar as this text editor always ignores anything after a question mark in a URL for some reason)
December 8th, 2005 at 7:05 pm
better link for LAME above was page for source…
http://www.afterdawn.com/software/audio_software/audio_encoders/lame_mp3_encoder.cfm
December 9th, 2005 at 3:39 am
Yes, they are amateurs and scammers, but not amateur scammers. They are professional scammers.
Investors have pumped maybe $30M or more into this pos and most has gone into the pockets of those running the show, rather than into improving the product.