Rootkit by Sony

[PigDog]

http://news.bbc.co.uk/1/hi/technology/4427606.stm

[bob3160]

Here is some more information that might be helpful and informative:

Sony sued over copy-protected CDs
http://news.bbc.co.uk/1/hi/technology/4424254.stm
 
 
List of CDs infected with Sony's rootkit DRM
http://www.eff.org/deeplinks/archives/004144.php
 
The patch can be obtained from the following link:
http://updates.xcp-aurora.com/

P.S.
By the way... EFF is looking to hear from potential plaintiffs for their
Sony suit. If you match the criteria below email allison@eff.org.
 
1. you have a Windows computer;
2. First 4 Internet's "xcp" copy protection has been installed on your
computer from a Sony CD (for more details, see our blog post referenced
above or SysInternals blog);
3. you reside in either California or New York;
4. you are willing to participate in litigation.

[bob3160]

Sony proves lawsuits have loud voices
Sony has graciously agreed to stop production of copy-protected CDs containing DRM technology that installs itself as a root kit on your PC.
It took two lawsuits, countless angry consumers, and at least one Trojan horse designed to exploit the backdoor they opened to get us there,
but hey, it's a start.

[DavidR]

Thankfully they have made this decision to stop this practice.

Now all we need is for Sony to make available a revoval tool (for easy direct link download) that you don't have to jump through many hoops, including installing an activeX item before you can come close to removing it, or should I say uncloaking it). So we will have to wait and see if a complete removal tool is made available.

[bob3160]

Microsoft will wipe Sony's 'rootkit'
Looks like Sony went just far enough over the line for big daddy Microsoft to step in.
The company says that the root kit that disguises Sony BMG's DRM software is a threat to Windows' security,
and Microsoft security tools will now detect and remove it. Saved by Microsoft. 

[Lisandro]

Saved by Microsoft.  [/b]

At last, good news...
It's ridiculous that to avoid piracy the good ones should pay for the bad guys.
Thanks for the news Bob 

[SonWon]

Experts: Sony BMG Rootkit 'Fix' Only Makes Things Worse

http://www.foxnews.com/story/0,2933,175649,00.html

SonWon

[Lisandro]

Sony Using Rootkit in Music CD DRM

This story whipped up a storm during the month after PC SysInternals Mark Russinovich discovered a rootkit installed by a Sony copy protected audio CD. "Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall. Worse, most users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files." Sony initially tried to defend their software but finally caved in and announced they would suspend the copy protection scheme. Several security vendors have released removal tools including Microsoft who will include that capability in the their Malicious Software Removal Tool distributed via the Windows Update service.
http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html

[SonWon]

Sony's removal tool leaves your system open to attack after the removal of the rootkit.  Read the link two post up.

SonWon

[polonus]

Hi SonWon,

If the Sony removal tool for their rootkit is buggy, and can still leave your system open. After you have taken your disks back to the shop to change them for non-rootkitted versions. Then download this removal tool for the Sony Rootkit, that can be trusted:
http://securityresponse.symantec.com/avcenter/venc/data/securityrisk.aries.html

I hope this will be the last chapter in this drama,

polonus

[garyb]

Got this over at Calendar Of Updates.
For any who are truly adventurous (not me  ) Kevin McAleavey, one of the makers of Boclean, has posted a manual fix that doesn't need Sony's patch.
http://www.dozleng.com/updates/topic7048

[Umath]

Software writers spot open source in Sony BMG CDs

Disrespect to another IP to "protect" "their" IP…  Now what can justify what Sony BMG did in this whole incident?

In case you don't know, LAME is one of the most recommendable MP3 encoders.  You may be using it through other music apps.

[SonWon]

Sony should issue a full apology and restructure their management to move Sony into the future so this never happens again.  Or they are likely to die a slow death like GM is going through.  And just like GM can turn the tide so can Sony but now is the time to declare an emergency and begin the progress upward.

For now I will never buy another Sony product until they admit their mistakes ans issue a full apology.  I will also recommend to all of my friends to never buy any Sony product.

About 15 years ago I did the same thing when GM failed to fix a problem with a truck I owned.  There must have been thousands of others who felt the same way and we can see the results on GM.  The same can happen to Sony.

SonWon

[dr pat]

Hi All,

I have been following the Sony rootkit fiasco since it was initally reported (http://www.sysinternals.com/) and the developments since. The abovestated site has a good summary.

Sony was interviewed by NPR (http://www.npr.org/templates/story/story.php?storyId=4989260) and they had  an amazing viewpoint --- the executive said (listen to the audio file - amazing!) - that as most people do not know what a root kit is, they should not worry about it!

I have been using Avast now for almost 2 years (great program), but I also have to agree with SonWon in regards to all his previous posts (quite obvious actually).

I was startled that there was not even an annoucement on the AVAST web site in regards to the Sony rootkit issue.

Yes, I agree with the fact that the anti-virus program may not be able to detect it (initally) on installation, BUT once the code of the rootkit has been established, I would have thought AVAST would be able to at least disable the 'cloaking'  element (so other files and viruses can not hide in the $sys$ directory that the rootkit creates). Or at least Avast could place an announcement on the website with links to other sites that could help.

Pat.

 

[bob3160]

hi dr pat
Maybe there wasn't an announcement on the website but since this thread was started by igor,
those of us on the forum where made aware of it by Alwil.