Do not put Sony Music CDs in your editor's drive

[George Ellis]

Mark Russinovich recently discovered that Sony's content protected CDs will install, without warning, a rootkit on your PC. Rootkits hide themselves, prevent detection, and in some way, alter the usage of your computer. You can read more about it At the Registry and at Mark's discussion linked from The Registry here

The rootkit will alter how the CD drivers work and could possibly limit your ability to write files to disc. Trying to uninstall the kit can cause some components to be disabled. The potential exists that you could possibly lose the ability to create content that is in no way related to any Sony materials and there are no major telltales on why that has happened.

Mark Russinovich is one of the leading OS internals folks around (He and David Solomon are the kings). Mark also notes that besides underhanded, the app is very poorly written. :p

[Marco Wagner]

I had this issue and had to wipe my entire machine to byte zeros in order to remove it, DIE SONY!

[Dan Euritt]

nice post! i wonder if proper virus/spybot type of monitoring software would stop this from installing?

[Marco Wagner]

I think it would if you trained it. Maybe to look for rootkit extensions or something along those lines.

[Marco Leavitt]

There's gotta be a lawsuit in this.

[George Ellis]

Originally Posted by Dan Euritt

nice post! i wonder if proper virus/spybot type of monitoring software would stop this from installing?

At the moment, no. Cisco Security Agent may, but that is not an over-the-counter solution.

[James Llewellyn]

Originally Posted by Marco Leavitt

There's gotta be a lawsuit in this.

I was wondering the same thing.

[Boyd Ostroff]

Here's some more info on this issue...

http://news.yahoo.com/news?tmpl=stor...03/bs_nf/39083
http://biz.yahoo.com/ap/051102/sony_...tion.html?.v=5

[Graham Risdon]

Hi all
Following the previous threads, it appears Sony have posted a fix at
http://cp.sonybmg.com/xcp/english/updates.html. Thought I'd post it up here to save people trawling! Pity Sony don't stick to producing cameras - they're quite good at that!!! ;-)

[Marco Leavitt]

http://www.breitbart.com/news/2005/11/10/D8DPSA288.html

I hope they bleed Sony good over this.

[Boyd Ostroff]

http://seattletimes.nwsource.com/htm...38_paul07.html

Hardly a week goes by that I don't hear from a friend or colleague with a monumental Windows problem. I tell them I'm glad to help, on one condition: Next time they buy a computer, they agree to consider a Macintosh. A year ago, after a particularly trying week of spyware, adware, viral attacks, lock-ups and reboots, I changed my primary computer to a Mac.

I appreciated your warning on this. This article just came up on the home page for my email. I'm not sure if it's the cause of the problem you mentioned above or not, but good news to prevent this from happening in the future if it is. To bad all of the old CD's willl still remain in circulation though -

"Sony BMG Music Entertainment, promised Friday to temporarily suspend making music CDs with antipiracy technology that can leave computers vulnerable to hackers."

From what I read in your post above the hacking was not the concern in this forum, but the "antipiracy technology" may have been affiliated with the "root kit" you mentioned above.

http://news.yahoo.com/s/ap/20051111/...opy_protection

[George Ellis]

Originally Posted by Graham Risdon

Hi all
Following the previous threads, it appears Sony have posted a fix at
http://cp.sonybmg.com/xcp/english/updates.html. Thought I'd post it up here to save people trawling! Pity Sony don't stick to producing cameras - they're quite good at that!!! ;-)

This is actually not a fix. It is not an uninstall. It just exposes the materials in the rootkit.

As of last week, there is now an exploit in the wild that will take advantage of the rootkit and use it to hide its operation. As of last week, both Symantec and Microsoft had included the signature for the kit in their anti-virus/anti-spyware tools. I do not know if that includes innoculation or uninstall. Because the rootkit add low and high filters (sub-classes the CD - a special driver that intercepts any calls to and from the CD device), and those directories in the registry can vary, they may not have included an uninstall yet.

Edit - added link http://www.cnn.com/2005/TECH/interne...eut/index.html

[Boyd Ostroff]

http://biz.yahoo.com/fool/051114/113199454317.html?.v=2

Increasingly, music companies like Sony's Sony BMG arm are treating their customers like criminals who borrowed rather than purchased their products. Meanwhile, look out, this newest development points to the ways that the recording industry is going on the offensive -- it appears that the industry has moved on from tackling peer-to-peer networks to attack what they call "casual piracy"

[Jack Zhang]

The affected CDs (according to the meda) are to be returned for a Copy-protectionless copy of the disc. Guess the people who did get the virus in their computer would have to reinstall everything and format the Hard drive!