Sony DRM Uses Hacker Rootkit

The guys at Sysinternals (http://www.sysinternals.com/), makers of great free security and diagnostic software, have discovered something unsettling with their new RootkitRevealer program: Those assholes at Sony have incorporated blackhat hacking techniques into their Digital Rights Management software, putting a rootkit onto the computer of anyone who plays music CD from Sony on their computer.

A rootkit is defined as "a type of malicious software that is activated each time your system boots up. Rootkits are difficult to detect because they are activated before your system's Operating System has completely booted up. A rootkit often allows the installation of hidden files, processes, hidden user accounts, and more in the systems OS. Rootkits are able to intercept data from terminals, network connections, and the keyboard."

Mark of Sysinternals details how he found the Sony rootkit and all the trouble he had getting rid of it:

"I deleted the driver files and their Registry keys, stopped the $sys$DRMServer service and deleted its image, and rebooted. As I was deleting the driver Registry keys under HKLMSystemCurrentControlSetServices I noted that they were either configured as boot-start drivers or members of groups listed by name in the HKLMSystemCurrentControlSetSafeBoot subkeys, which means that they load even in Safe Mode, making system recovery extremely difficult if any of them have a bug that prevents the system from booting.

I deleted the entry, but got an access-denied error. Those keys have security permissions that only allow the Local System account to modify them, so I relaunched Regedit in the Local System account using PsExec: psexec –s –i –d regedit.exe. I retried the delete, succeeded, and searched for $sys$ again. Next I found an entry configuring another one of the drivers, Cor.sys (internally named Corvus), as an upper filter for the IDE channel device and also deleted it. I rebooted and my CD was back.

The entire experience was frustrating and irritating. Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall. Worse, most users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files."

So basically, if you're not a computer badass like Mark, you've pretty much fucked yourself if you run a good rootkit detector and removal program on a computer you played a Sony CD on.

Does 'g disk1 /del /all' work for ridding yourself of the problem?

Only if you boot in true Dos. This does not surprise me at all. Microsoft, Sony, et cetera, none of them seems to be interested in creating products that suit the consumer. Anti-capitalist scum.

Mr U

In the comments section of the Sysinternals blog that made problems with Sony's Digital Rights Management software a big stinking public mess, a poster has pointed out that you can use Sony's DRM to circumvent itself.

"If you want a more concrete proof, try to rename your favourite ripping software as $sys$whatever.exe and then run it again. You'll notice that the DRM system can no longer detect it, and thus you'll get good copy of the track you try to rip instead of one filled with noise.

Thats just hilarious. I think everyone should simply not worry about removing the rootkit, as this is too difficult, and then just do at Matti says, and use the rootkit to make your favorite ripping tool immune to the DRM. On second thought, is their software breaking the DMCA? It provides a method to bypass copyright protection that they install? Hmm..."

So, should Sony's next step be to sue themselves for violating the DMCA? This whole thing just keeps getting more and more hilarious.

And another update on the fall out of this:

AUSTIN, Texas — The state sued Sony BMG Music Entertainment on Monday under its new anti-spyware law, saying anti-piracy technology the company slipped into music CDs leaves huge security holes on consumers' computers.

The lawsuit is over the so-called XCP technology that Sony had added to more than 50 CDs to restrict to three the number of times a single disc could be copied.

After a storm of criticism, Sony recalled the discs last week.

To enforce the restrictions, the CD automatically installed the copy-protection program when discs were put into a PC — a necessary step for transferring music to iPods and other portable music players.

Attorney General Greg Abbott accused Sony BMG of surreptitiously installing "spyware" in the form of files that mask other files Sony installed as part of XCP.

This "cloaking" component can leave computers vulnerable to viruses and other security problems, said Abbott, echoing the findings of computer security researchers.

"Sony has engaged in a technological version of cloak-and-dagger deceit against consumers by hiding secret files on their computers," Abbott said in a statement.

The term "spyware" has been used broadly to cover programs that are installed without users' full knowledge and consent, whether or not they actually spy on a user's activities.

A Sony BMG spokesman didn't immediately return a call Monday morning.

Sony BMG initially rejected the uproar over XCP as technobabble. But after security experts discovered that XCP opened gaping security holes in users' computers — as did the method Sony BMG offered for removing XCP — Sony BMG agreed last week to recall the discs.

Some 4.7 million had been made and 2.1 million sold. CDs that had XCP included releases by Van Zant, The Bad Plus, Neil Diamond and Celine Dion.

Abbott said some CDs remained in Texas stores as of Monday morning.

The Texas spyware law allows the state to recover damages of up to $100,000 in damages for each violation.

Abbott said there were thousands of violations, and that any money would go to the state.

Im hoping Texas wins this one. Maybe having to pay several million dollars in damages will make a few people rethink the cost of piracy and the proper way to to prevent it.

Man this is retarted...I hope sony continues to catch hell from this crap for a long time. I never saw this coming...i guess i wasnt aware enough.