[opendtv] Sony BMG DRM cloaks virus
- From: "John Shutt" <shuttj@xxxxxxxxx>
- To: "OpenDTV" <opendtv@xxxxxxxxxxxxx>
- Date: Fri, 11 Nov 2005 12:12:45 -0500
Prevent piracy by making your computer vulnerable to virus attack.
BRILLIANT! And you thought the Broadcast Flag was bad news...
John
http://news.com.com/2100-1029_3-5944643.html
'Bots' for Sony CD software spotted online
By John Borland
A first wave of malicious software written to piggyback on Sony BMG Music
Entertainment CD copy protection tools has been spotted online, computer
security companies said Thursday.
Sony's software, installed when playing one of the record label's recent
copy-protected CDs in a computer, hides itself on hard drives using a
powerful programming tool called a "rootkit." But the tool leaves the door
open behind it, allowing other software--including viruses--to be deeply
hidden behind the rootkit cloak.
The first version of a Trojan horse spotted early Thursday, which aims to
give an attacker complete remote control over an infected computer, didn't
work well. But over the course of the day, several others emerged that
apparently fixed early flaws.
What's new:
The first pieces of malicious software designed to hide in Sony BMG Music
Entertainment's copy protection tool for CDs have been spotted, say security
experts.
Bottom line:
The malicious software programs in this case are Trojan horse, or "bot,"
variants, which are intended to give the attacker remote control of any
computer they infect as they hide in Sony's copy protection tool. Security
experts say that more such attacks are likely. For Sony, concern over the
issue has prompted at least one lawsuit and plenty of criticism.
"This is no longer a theoretical vulnerability; it is a real vulnerability,"
said Sam Curry, vice president of Computer Associates' eTrust Security
Management division. "This is no longer about digital rights management or
content protection, this is about people having their PCs taken over."
Sony's use of the rootkit software has sparked a firestorm of criticism
online and off over the company's techniques, highlighting concerns that
remain over record labels' increasingly ambitious attempts to control the
ways consumers can use purchased music.
Last week, plaintiffs' attorney Alan Himmelfarb filed a class action suit
against Sony BMG in Los Angeles federal court, asserting that the company
had violated state and federal statues on unauthorized computer tampering.
The company's actions also constituted fraud, trespass and false
advertising, the suit contends.
Other attorneys say they are considering other suits. Several Italian
consumer groups also have said they are looking into the prospect of taking
legal action against Sony, although the relevant discs were distributed by
the record label's U.S. division and not intended for overseas sale.
Sony's use of the rootkit stems from record companies' growing concerns that
unrestricted music copying is undermining their sales, and they have been
looking for a technological way to limit the number of copies that people
can make of each CD they buy.
Sony BMG has experimented with several different ways to do this. The
current controversy focuses on just one of those tools, created by a British
company called First 4 Internet.
The First 4 Internet software is included on a handful of CDs, including
recent releases from My Morning Jacket and Southern rockers Van Zant. When
the albums are put in a computer's CD drive, they ask a listener to click
through a consent form, and then install the rootkit copy-protection
software on the hard drive.
A rootkit is a tool that takes a high level of control over a computer,
potentially even preventing the original computer user from performing
certain tasks. In this case, the First 4 Internet hides itself from view in
the computer's guts.
One Trojan horse discovered by security companies Thursday is a variant of a
pre-existing software distributed by spam e-mail, among other techniques.
One version of the e-mail claims to be from a business publication and says
it is using a photograph of the recipient for a soon-to-be published
article, according to security company BitDefender. Clicking on the alleged
photograph installs the malicious software, which then connects
automatically to the Internet Relay Chat chat network, opening up a channel
to control the infected computer.
In a new version of the program, the software hides itself using Sony's
rootkit tool and then tries to connect to a server on the chat network. The
first version of the Trojan was unable to function after hiding itself,
security company F-Secure said. However, several other variants have been
found that are able to successfully take over control of a computer after
hiding under the Sony software.
All virus companies are rating the danger as fairly low so far, since the
Trojans seem to be spreading slowly.
Most antivirus companies are releasing versions of their software that
identify or remove the Sony software. A patch on the Sony Web site will
uncloak the copy protection tools, but computer users must contact Sony's
customer service for instructions on removing it altogether.
Neither Himmelfarb nor a Sony BMG spokesman could immediately be reached for
comment. A Sony BMG representative contacted last week noted that the
software could be easily uninstalled by contacting the company's customer
support service for instructions.
Copyright ©1995-2005 CNET Networks, Inc. All rights reserved.
----------------------------------------------------------------------
You can UNSUBSCRIBE from the OpenDTV list in two ways:
- Using the UNSUBSCRIBE command in your user configuration settings at
FreeLists.org
- By sending a message to: opendtv-request@xxxxxxxxxxxxx with the word
unsubscribe in the subject line.
Other related posts:
- » [opendtv] Sony BMG DRM cloaks virus
