Posted on 11/03/2005 8:44:21 AM PST by holymoly
Sony is apparently borrowing a tactic from hackers for its digital-rights management technology, and some security experts question the practice.
Security researchers have identified a rootkit -- software used by hackers to hide their malicious code from anti-virus and anti-spyware defenses -- within the copy protection scheme Sony BMG Music Entertainment uses to prevent music CDs from being copied to computers.
The digital rights management (DRM) technology that Sony BMG uses limits the number of times a CD can be "ripped" to a computer. To prevent the DRM software from being easily circumvented, the copy protection's creator -- a U.K.-based company called First4Internet -- uses a rootkit to hide the DRM's files.
An independent researcher, Mark Russinovich, and the Helsinki-based F-Secure security firm, published details almost simultaneously on the DRM technology Sony BMG uses, and that technology's application of a rootkit.
Both stressed that rootkits are most commonly used by malicious code writers -- hackers -- and the use of it by a legitimate company such as Sony was alarming, they warned.
"Once the rootkit is there, there's no direct way to uninstall it," said Mikko Hyppönen, F-Secure's chief research officer, in an online brief. "The system is implemented in a way that makes it possible for viruses (or any other malicious program) to use the rootkit to hide themselves, too. This may lead to a situation where the virus remains undetected even if the user has got updated antivirus software installed."
Russinovich, who stumbled across the rootkit after a long investigation that involved a number of advanced PC forensic tools, agreed. "Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall."
In fact, when Russinovich tried to uninstall the DRM software, all he got for his trouble was a dead CD drive.
"Most users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files," he said.
Removing the rootkit is so fraught with possibilities of calamity that F-Secure recommended users don't try it themselves. Instead, Hyppönen urged users to fill out a Sony BMG Web form and ask for instructions on how to remove the software. F-Secure has tested the resulting removal process -- which relies on the installation of an Internet Explorer ActiveX control -- and has confirmed it works.
According to one anti-spyware expert, Sony has no excuse for leaning on a rootkit to copy protect its content.
"Rootkits are always malicious," said Richard Stiennon, director of threat research for the Boulder, Colo.-based anti-spyware vendor Webroot. "There's no legitimate use of a rootkit, whose only purpose is to hide code from the operating system." Stiennon is intimately familiar with rootkits, since they're often by spyware writers to disguise some of their nastier work, like password keyloggers.
Stiennon's objection runs deeper than the rootkit code itself, however; he's also concerned that the copy protection software steps across another spyware line.
"The end user license agreement (EULA) doesn't mention any install [of a rootkit]," he said. "That likely makes it illegal in the U.K. and the EU, and in at least 10 states in the U.S. as well. Sony could be in a lot of trouble on this one.
"This is just the sort of thing that [anti-spyware advocates are] concerned about, that spyware laws, when written, will be too broad and won't take things like this into consideration," Stiennon added.
Even discounting Stiennon's concerns, however, Sony's use of a rootkit poses immediate danger, said F-Secure. In a technical description of the DRM software, the security vendor noted that "the hiding techniques can be abused by less technical malware authors to hide their backdoors and other tools."
All an attacker needs to do is name his files beginning with the same "$sys$" prefix used by the Sony CD copy protection files.
"It is very inappropriate for commercial software to use these techniques," said F-Secure.
Sony BMG did not immediately return a call for comment.
Sony BMG is currently using a rootkit-based DRM system on some CD records sold in USA. As far as we know, this system has been in use since March 2005.
Or we can just throw up our hands and forget any pretense that we have a rule of law that applies to everybody.
It's good work if you can get it.
Write software that breaks the law by rooting XP boxen, then sell the end user the clean up tool.
It's sick. Sick, twisted and not a legal thing to do.
Yes, but we need to keep this issu front and center. Sony/BMG are using music CDs to infect computers. I'll be going out of my way to make sure that noone in my family or immediate friends will purchase any Sony/BMG products this upcoming Christmas Holiday.
Seen this one?
http://www.securityfocus.com/brief/34
LOL! It's amazing the things people will do to cheat their way through.
i never bought a cd for 10+ years... now probably never...
They already do. They have for decades. It's called radio.
These same companies annually spend millions of dollars promoting their product on the radio for free public consumption. Recording music from the radio is legal. Calling a station to request a song, then recording the song when it's played, is legal.
The only difference between this process and P2P sharing is the technology, not the activity itself. Why is one method actively supported by the recording industry and legally upheld by the courts, yet the other is criminal?
True, but that doesn't help the folks at Blizzard - what are they going to do, ban everyone who's bought a Sony CD?
Anyway, just thought it was fun to see what sorts of things this little proggy was turning into a vector for. Aside from some sloppiness in the implementation, it's kind of a clever idea, in a perversely evil sort of way ;)
Now what happens if some other music publisher also wants to use a rootkit, and the two rootkits are incompatible? This is wild west on your hard drive. Unacceptable.
Regarding the WoW folks using it to hide things, I would imagine or hope that a patch could come out to test for it. I'm not into the gaming scene so I'm not sure how it would be enforced. Folks who cheat on such things are pretty low IMO. They probably cheat in solitaire too.
They probably cheat in solitaire too.
Hey, I only did that once and you can't prove anything anyway, pal ;)
It's sick. Sick, twisted and not a legal thing to do.
That does it. I have now lost any shred of respect I may have once had for the entertainment industry's copyright system. May the hackers bust it whenever they can and set music and film free from the Hollywood middlemen.
Oh, and there's a delicious bonus: this would strip the Democratic Party of its biggest source of funds.
There's another difference: the RIAA companies use radio stations' oligopoly over the airwaves to control what music is advertised in that fashion.
Ironically, the real threat to the RIAA comes not from people who "share" RIAA music, but people who share NON-RIAA music. If more artists start realizing they can have almost as good a shot at popularity via the Internet as via radio, but keep most of the profits from their records instead of giving them to the record companies, the RIAA companies will have a much harder time finding new slaves to work for them.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.