Do not put Sony Music CDs in your editor's drive
 

Mark Russinovich recently discovered that Sony's content protected CDs will install, without warning, a rootkit on your PC. Rootkits hide themselves, prevent detection, and in some way, alter the usage of your computer. You can read more about it At the Registry and at Mark's discussion linked from The Registry here

The rootkit will alter how the CD drivers work and could possibly limit your ability to write files to disc. Trying to uninstall the kit can cause some components to be disabled. The potential exists that you could possibly lose the ability to create content that is in no way related to any Sony materials and there are no major telltales on why that has happened.

Mark Russinovich is one of the leading OS internals folks around (He and David Solomon are the kings). Mark also notes that besides underhanded, the app is very poorly written. :p

I had this issue and had to wipe my entire machine to byte zeros in order to remove it, DIE SONY!

nice post! i wonder if proper virus/spybot type of monitoring software would stop this from installing?

I think it would if you trained it. Maybe to look for rootkit extensions or something along those lines.

There's gotta be a lawsuit in this.

At the moment, no. Cisco Security Agent may, but that is not an over-the-counter solution.

I was wondering the same thing.

Here's some more info on this issue...

http://news.yahoo.com/news?tmpl=stor...03/bs_nf/39083
http://biz.yahoo.com/ap/051102/sony_...tion.html?.v=5

Sony have posted a fix
 

Hi all
Following the previous threads, it appears Sony have posted a fix at
http://cp.sonybmg.com/xcp/english/updates.html. Thought I'd post it up here to save people trawling! Pity Sony don't stick to producing cameras - they're quite good at that!!! ;-)

And the lawsuits start ...
 

http://www.breitbart.com/news/2005/11/10/D8DPSA288.html

I hope they bleed Sony good over this.

Here's one solution :-)
 

http://seattletimes.nwsource.com/htm...38_paul07.html

I appreciated your warning on this. This article just came up on the home page for my email. I'm not sure if it's the cause of the problem you mentioned above or not, but good news to prevent this from happening in the future if it is. To bad all of the old CD's willl still remain in circulation though -

"Sony BMG Music Entertainment, promised Friday to temporarily suspend making music CDs with antipiracy technology that can leave computers vulnerable to hackers."

From what I read in your post above the hacking was not the concern in this forum, but the "antipiracy technology" may have been affiliated with the "root kit" you mentioned above.

http://news.yahoo.com/s/ap/20051111/...opy_protection

This is actually not a fix. It is not an uninstall. It just exposes the materials in the rootkit.

As of last week, there is now an exploit in the wild that will take advantage of the rootkit and use it to hide its operation. As of last week, both Symantec and Microsoft had included the signature for the kit in their anti-virus/anti-spyware tools. I do not know if that includes innoculation or uninstall. Because the rootkit add low and high filters (sub-classes the CD - a special driver that intercepts any calls to and from the CD device), and those directories in the registry can vary, they may not have included an uninstall yet.

Edit - added link http://www.cnn.com/2005/TECH/interne...eut/index.html

What were you thinking, Sony?
 

http://biz.yahoo.com/fool/051114/113199454317.html?.v=2

CDs to be recalled.
 

The affected CDs (according to the meda) are to be returned for a Copy-protectionless copy of the disc. Guess the people who did get the virus in their computer would have to reinstall everything and format the Hard drive!