One & only Sony "antipiracy" CD thread
11-04-05, 09:43 AM
#1
Senior Member
Thread Starter
Join Date: Aug 2003
Location: Location, Location
Posts: 510
Likes: 0
Received 0 Likes
on
0 Posts
Sony Issues Fix for Hidden Rootkits
After Criticism, Sony Issues Fix for Hidden Rootkits
Walaika K. Haskins, newsfactor.com Thu Nov 3, 5:35 PM ET
Sony (NYSE: SNE - news) has admitted that it included a stealth rootkit on some music CDs shipped in 2005 and has issued an update to remove the hidden software one day after it was discovered. The company had drawn criticism from security experts who warned that the technology could serve as a tool for hackers.
The nearly undetectable monitoring utility, part of the company's digital-rights management (DRM) technology, was aimed at preventing consumers from producing illegal copies of CDs. The software installed itself automatically in Windows systems whenever a CD was inserted. Any files contained in the rootkit are invisible and almost impossible to remove.
Security expert Mark Russinovich of Sysinternals discovered the hidden rootkit and posted his findings on the company blog on November 1st. Russinovich wrote that although he checked in his system's Add or Remove Programs list, as well as on the vendor's site and on the CD itself, he could not find uninstall instructions. Nor, he says, could he find any mention of it in the End User License Agreement (EULA).
Stealth Tactics
A rootkit is a set of tools commonly used by hackers to circumvent antivirus software and control a computer system. Most rootkits are engineered so that common PC monitoring mechanisms cannot detect them. The rootkits are designed to tuck themselves in to the most basic level of the operating system and remain hidden from users.
A Finnish antivirus company, F-Secure, reported that it had spent several weeks recently trying to find the cause of some unknown files reported by a user who suspected an audio CD as the cause.
Mikko Hyppnen, chief research officer at F-Secure, said hackers could use the rootkit to insert their own files by inserting a simple command at the beginning of the file name that would render them undetectable by most antivirus software. On the F-Secure blog, Hyppnen wrote that he heard rumors that Universal is using the same DRM system on its audio CDs.
Privacy? What Privacy?
Although industry analysts said they cannot fault Sony's motives, some saw the company's initial failure to disclose the hidden technology as a violation of U.S. copyright laws. According to Jared Carleton, an analyst at Frost & Sullivan, Sony is overstepping the fair-use clause that gives consumers the right to make backup copies.
"[Sony] is saying, 'No, we are not going to pay attention to U.S. copyright law that's been generally accepted for the past 30 years,' " he said.
Carleton likened the hidden DRM to malware, and said it was no different than adware and spyware. He said that if Sony was shipping DRM-protected CDs, the company needed to put a notice on its packaging. Consumers understand that artists should be paid for their music, he said, but he added that consumers don't like this type of secrecy.
Andrew Jaquith, senior security analyst at Yankee Group, said the company behaved badly and that there could be a backlash. He said that the desire to protect intellectual property is understandable, but that Sony should have been upfront about its DRM technology, and would have been better off using industry-standard software.
"I haven't seen a single positive comment about this and it makes them look at little slimy," Jaquith said. "They should have been above-board and should have used software that they hadn't cobbled together themselves."
On the Web page containing the update, which enables users to detect and remove the rootkit, Sony said its technology did not pose a security risk. "This component is not malicious and does not compromise security," the company's post said. "However to alleviate any concerns that users may have about the program posing potential security vulnerabilities, this update has been released to enable users to remove this component from their computers."
The fix can be downloaded at http://cp.sonybmg.com/xcp/english/updates.html
Walaika K. Haskins, newsfactor.com Thu Nov 3, 5:35 PM ET
Sony (NYSE: SNE - news) has admitted that it included a stealth rootkit on some music CDs shipped in 2005 and has issued an update to remove the hidden software one day after it was discovered. The company had drawn criticism from security experts who warned that the technology could serve as a tool for hackers.
The nearly undetectable monitoring utility, part of the company's digital-rights management (DRM) technology, was aimed at preventing consumers from producing illegal copies of CDs. The software installed itself automatically in Windows systems whenever a CD was inserted. Any files contained in the rootkit are invisible and almost impossible to remove.
Security expert Mark Russinovich of Sysinternals discovered the hidden rootkit and posted his findings on the company blog on November 1st. Russinovich wrote that although he checked in his system's Add or Remove Programs list, as well as on the vendor's site and on the CD itself, he could not find uninstall instructions. Nor, he says, could he find any mention of it in the End User License Agreement (EULA).
Stealth Tactics
A rootkit is a set of tools commonly used by hackers to circumvent antivirus software and control a computer system. Most rootkits are engineered so that common PC monitoring mechanisms cannot detect them. The rootkits are designed to tuck themselves in to the most basic level of the operating system and remain hidden from users.
A Finnish antivirus company, F-Secure, reported that it had spent several weeks recently trying to find the cause of some unknown files reported by a user who suspected an audio CD as the cause.
Mikko Hyppnen, chief research officer at F-Secure, said hackers could use the rootkit to insert their own files by inserting a simple command at the beginning of the file name that would render them undetectable by most antivirus software. On the F-Secure blog, Hyppnen wrote that he heard rumors that Universal is using the same DRM system on its audio CDs.
Privacy? What Privacy?
Although industry analysts said they cannot fault Sony's motives, some saw the company's initial failure to disclose the hidden technology as a violation of U.S. copyright laws. According to Jared Carleton, an analyst at Frost & Sullivan, Sony is overstepping the fair-use clause that gives consumers the right to make backup copies.
"[Sony] is saying, 'No, we are not going to pay attention to U.S. copyright law that's been generally accepted for the past 30 years,' " he said.
Carleton likened the hidden DRM to malware, and said it was no different than adware and spyware. He said that if Sony was shipping DRM-protected CDs, the company needed to put a notice on its packaging. Consumers understand that artists should be paid for their music, he said, but he added that consumers don't like this type of secrecy.
Andrew Jaquith, senior security analyst at Yankee Group, said the company behaved badly and that there could be a backlash. He said that the desire to protect intellectual property is understandable, but that Sony should have been upfront about its DRM technology, and would have been better off using industry-standard software.
"I haven't seen a single positive comment about this and it makes them look at little slimy," Jaquith said. "They should have been above-board and should have used software that they hadn't cobbled together themselves."
On the Web page containing the update, which enables users to detect and remove the rootkit, Sony said its technology did not pose a security risk. "This component is not malicious and does not compromise security," the company's post said. "However to alleviate any concerns that users may have about the program posing potential security vulnerabilities, this update has been released to enable users to remove this component from their computers."
The fix can be downloaded at http://cp.sonybmg.com/xcp/english/updates.html
11-04-05, 11:15 AM
#2
DVD Talk Hall of Fame
Beh, fuck Sony. I'm boycotting their catalog until they stop screwing over those of us who are legitimate customers that only acquire music legally. I know other record companies are doing similar things, so maybe my boycott's a bit arbitrary, but oh well. If enough of their customers give voice to how pissed off we are, they'll have to start taking notice. If anyone's curious to read my letter to them, here you go. It's a bit long.
To Whom It May Concern,
I just wanted to write in and voice my extreme displeasure with the tactics your company has resorted to in regards to copy protection. Your efforts to limit the legal usage of legitimately purchased cds does absolutely nothing to hinder illegal use. Instead, it merely serves to make it difficult or impossible for those of us legally buying the albums to create back-ups, upload them to our MP3 players or, sometimes, even to listen to them on our computers or in our automobiles. Couple this with the automatic installation of hidden software onto the hard drives of our computers, and it adds up to you taking a giant piss in the face of those who shell out the hard earned money that makes your company profitable.
In response to your increasingly disrespectful attitude towards your customers, I've made the following personal decision. Until you take steps to eliminate copy protection or, at a bare minimum, come up with a model that ceases to limit fair use by your legitimate customers, I will no longer be purchasing albums on a Sony label. The following paragraph is a list of artists whose future releases this will affect. Keep in mind, these are all artists I have purchased albums from in the past and whose future albums I would most likely be purchasing, if not for your alienation of the law-abiding consumers of your products.
Fiona Apple, Aqualung, The Ataris, Audioslave, Cake, Harry Connick, Jr., Howie Day, Bob Dylan, Ben Folds, Franz Ferdinand, Hope of the States, Modest Mouse, Our Lady Peace, Pearl Jam, Bruce Springsteen, Tenacious D, Travis, The Zutons.
Please do not misinterpret this as me threatening to acquire these artists' future releases illegally, as that is most certainly not the case. Rather, I will simply do without them. As much as I enjoy some of these musicians, there is enough good music in the world that I can get by without hearing their future albums, especially if it decreases the profits of a company who shamelessly abuses its customers.
Additionally, I'd like to mention other Sony artists who have albums I have legally purchased in the past. While for one reason or another it's unlikely I'd be purchasing future releases from them, this list gives a little more perspective on my support of your company over the years.
AC/DC, Aerosmith, Alice in Chains, The Allman Brothers Band, Black Sabbath, Blue Oyster Cult, Boston, Jeff Buckley, Johnny Cash, The Clash, Neil Diamond, The Doobie Brothers, Duran Duran, Fuel, Marvin Gaye, Billy Joel, Live, Lo Fidelity Allstars, Mad Season, Bob Marley & The Wailers, Johnny Mathis, John Mellencamp, Van Morrison, Willie Nelson, Oasis, Roy Orbison, Ozzy Osbourne, Pink Floyd, Rage Against the Machine, Carlos Santana, Simon & Garfunkle, Frank Sinatra, Soul Asylum, Switchfoot, Toto, Uncle Tupelo, Steve Winwood, Pete Yorn
Over the next several weeks, I'll be emailing each of the bands in the first list, informing them of my decision and encouraging them to do what they can to stop you from abusing your customers' rights and to refrain from resigning to your label when their contracts are up for renewal.
I will also be emailing or mailing letters to your parent and sister Sony companies. While I only plan on a total boycott of music, I will also avoid purchasing other Sony products if possible. This is coming from someone who owns a Sony digital camera, television, dvd player, surround sound system, portable stereo and god knows how many dvds.
I know that in the large scheme of things, I'm just one customer and that you could probably not care less about the loss of my business. It is my hope, though, that true music fans all over the country are reaching the same decision I have and that there are enough of us to cause you to be little more concerned about treating your customers with respect in the future.
Feel free to write me back if you like, but at this point the only thing that will cause me to change my mind will be a change in your public actions.
Sincerely,
Jim May
I just wanted to write in and voice my extreme displeasure with the tactics your company has resorted to in regards to copy protection. Your efforts to limit the legal usage of legitimately purchased cds does absolutely nothing to hinder illegal use. Instead, it merely serves to make it difficult or impossible for those of us legally buying the albums to create back-ups, upload them to our MP3 players or, sometimes, even to listen to them on our computers or in our automobiles. Couple this with the automatic installation of hidden software onto the hard drives of our computers, and it adds up to you taking a giant piss in the face of those who shell out the hard earned money that makes your company profitable.
In response to your increasingly disrespectful attitude towards your customers, I've made the following personal decision. Until you take steps to eliminate copy protection or, at a bare minimum, come up with a model that ceases to limit fair use by your legitimate customers, I will no longer be purchasing albums on a Sony label. The following paragraph is a list of artists whose future releases this will affect. Keep in mind, these are all artists I have purchased albums from in the past and whose future albums I would most likely be purchasing, if not for your alienation of the law-abiding consumers of your products.
Fiona Apple, Aqualung, The Ataris, Audioslave, Cake, Harry Connick, Jr., Howie Day, Bob Dylan, Ben Folds, Franz Ferdinand, Hope of the States, Modest Mouse, Our Lady Peace, Pearl Jam, Bruce Springsteen, Tenacious D, Travis, The Zutons.
Please do not misinterpret this as me threatening to acquire these artists' future releases illegally, as that is most certainly not the case. Rather, I will simply do without them. As much as I enjoy some of these musicians, there is enough good music in the world that I can get by without hearing their future albums, especially if it decreases the profits of a company who shamelessly abuses its customers.
Additionally, I'd like to mention other Sony artists who have albums I have legally purchased in the past. While for one reason or another it's unlikely I'd be purchasing future releases from them, this list gives a little more perspective on my support of your company over the years.
AC/DC, Aerosmith, Alice in Chains, The Allman Brothers Band, Black Sabbath, Blue Oyster Cult, Boston, Jeff Buckley, Johnny Cash, The Clash, Neil Diamond, The Doobie Brothers, Duran Duran, Fuel, Marvin Gaye, Billy Joel, Live, Lo Fidelity Allstars, Mad Season, Bob Marley & The Wailers, Johnny Mathis, John Mellencamp, Van Morrison, Willie Nelson, Oasis, Roy Orbison, Ozzy Osbourne, Pink Floyd, Rage Against the Machine, Carlos Santana, Simon & Garfunkle, Frank Sinatra, Soul Asylum, Switchfoot, Toto, Uncle Tupelo, Steve Winwood, Pete Yorn
Over the next several weeks, I'll be emailing each of the bands in the first list, informing them of my decision and encouraging them to do what they can to stop you from abusing your customers' rights and to refrain from resigning to your label when their contracts are up for renewal.
I will also be emailing or mailing letters to your parent and sister Sony companies. While I only plan on a total boycott of music, I will also avoid purchasing other Sony products if possible. This is coming from someone who owns a Sony digital camera, television, dvd player, surround sound system, portable stereo and god knows how many dvds.
I know that in the large scheme of things, I'm just one customer and that you could probably not care less about the loss of my business. It is my hope, though, that true music fans all over the country are reaching the same decision I have and that there are enough of us to cause you to be little more concerned about treating your customers with respect in the future.
Feel free to write me back if you like, but at this point the only thing that will cause me to change my mind will be a change in your public actions.
Sincerely,
Jim May
11-04-05, 12:13 PM
#3
The only thing I have to say about the original article is that I'm sick of record labels treating their customers like criminals. It's like they're constantly looking for new ways to make people not want to purchase music.
On a lighter note, I love this slight misquote from the article:
Look at Little Slimy!!! LOOK AT HIM!!!!!
On a lighter note, I love this slight misquote from the article:
Originally Posted by Andrew Jaquith
"I haven't seen a single positive comment about this and it makes them look at little slimy."
11-04-05, 12:34 PM
#4
DVD Talk Limited Edition
Is there a list of offending CDs somewhere? I don't want to bother with this unless I ownd one of them.
11-06-05, 07:31 AM
#7
DVD Talk Platinum Edition
Originally Posted by GoVegan
The only thing I have to say about the original article is that I'm sick of record labels treating their customers like criminals. It's like they're constantly looking for new ways to make people not want to purchase music.
On a lighter note, I love this slight misquote from the article:
Look at Little Slimy!!! LOOK AT HIM!!!!!
On a lighter note, I love this slight misquote from the article:
Look at Little Slimy!!! LOOK AT HIM!!!!!
Good article.
11-06-05, 12:10 PM
#8
DVD Talk Platinum Edition
Join Date: Aug 2001
Posts: 3,193
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by Jason
Wow, shitty music and spyware. A winning combination if I ever saw one.
If you're not sure if a CD you want to buy has it, a tell-tale sign is if it has these PC minimum system requirements on the back of the CD:
+Compatible With:
Playback: CD/DVD/PC/Mac PC:Widows 98SE/
ME/2000/XP, Pentium II, 128 MB RAM, IE 5.5+ Mac: OK
Ripping: PC: Windows Media Player 9.0 Mac: OK
Portable Devices: Secure Windows Media
Limited Copies
? www.sunncomm.com/support/sonybmg ; README.HTML
For what it's worth, I had previously disabled autoplay on my PC (Highly Recommended!! Downloading TWEAKUI is the easiest way to do this) and have played both these CDs that I own without any trouble through Windows Media Player just like any normal CD and the rootkit has not installed. I haven't tried ripping either because I don't have a portable device I use.
That support site they listed on the CD is interesting, if only to see how they try to spin that this copy protection and the need for min sys requirements and and an Internet connection to play the CD through their program is a good thing.
11-10-05, 08:08 PM
#9
Senior Member
Thread Starter
Join Date: Aug 2003
Location: Location, Location
Posts: 510
Likes: 0
Received 0 Likes
on
0 Posts
and now of course:
Viruses Exploit Sony CD Copy-Protection
By MATTHEW FORDAHL, AP Technology Writer
SAN JOSE, Calif. - A controversial copy-protection program that automatically installs when some Sony BMG audio CDs are played on personal computers is now being exploited by malicious software that takes advantage of the antipiracy technology's ability to hide files.
ADVERTISEMENT
The Trojan horse programs — three have so far been identified by antivirus companies — are named so as to trigger the cloaking feature of Sony's XCP2 antipiracy technology. By piggybacking on that function, the malicious programs can enter undetected, security experts said Thursday.
"This could be the advanced guard," said Graham Cluley, senior technology consultant at the security firm Sophos. "We wouldn't be surprised at all if we saw more malware that exploits what Sony has introduced."
The copy protection program is included on about 20 popular music titles, including releases by Van Zant and The Bad Plus, and disclosure of its existence has raised the ire of many in the computing community, who consider it to constitute spyware.
Sony BMG Music Entertainment and the company that developed the software, First 4 Internet, have claimed that the technology poses no security threat. Still, Sony posted a patch last week that uncloaks files hidden by the software.
On Thursday, Sony released a statement "deeply regretting any disruption that this may have caused." It also said it was working with Symantec and other firms to ensure any content-protection technology "continues to be safe."
Neither Sony spokesman John McKay nor First 4 Internet CEO Mathew Gilliat-Smith returned messages seeking additional comment.
Windows expert Mark Russinovich discovered the hidden copy-protection technology on Oct. 31 and posted his findings on his Web log. He noted that the license agreement that pops up said a small program would be installed, but it did not specify it would be hidden.
Manual attempts to remove the software can disable the PC's CD drive. Sony offers an uninstallation program, but consumers must request it by filling out two forms on the Internet.
"What they did was not intentionally malicious," Cluley said. "If anything, it was slightly inept."
The copy-protection software, which Sony says is a necessary "speed bump" to limit how many times a CD is copied, only works on Windows-based PCs. Users of
Macintosh and
Linux computers are not restricted.
The viruses also only target Windows-based machines.
The infection opens up a backdoor, which could be used to steal personal information, launch attacks on other computers and send spam, antivirus companies said.
Sony also is facing legal headaches. On Nov. 1, Alexander Guevara filed suit in Los Angeles County Superior Court seeking class action staus. He claims Sony's actions constituted fraud, false advertising, trespass and violated state and federal laws barring malware and computer tampering.
His attorney, Alan Himmelfarb, did not immediately return calls seeking comment.
The Electronic Frontier Foundation, an online civil liberty group, said it is hearing from people who have run into problems with the copy protection software. It is considering filing its own lawsuit, said EFF staff attorney Jason Schultz.
"You can't uninstall it, you can't find it, and it's vastly more invasive in terms of privacy and personal property than any other (digital rights management) program to date," he said.
By MATTHEW FORDAHL, AP Technology Writer
SAN JOSE, Calif. - A controversial copy-protection program that automatically installs when some Sony BMG audio CDs are played on personal computers is now being exploited by malicious software that takes advantage of the antipiracy technology's ability to hide files.
ADVERTISEMENT
The Trojan horse programs — three have so far been identified by antivirus companies — are named so as to trigger the cloaking feature of Sony's XCP2 antipiracy technology. By piggybacking on that function, the malicious programs can enter undetected, security experts said Thursday.
"This could be the advanced guard," said Graham Cluley, senior technology consultant at the security firm Sophos. "We wouldn't be surprised at all if we saw more malware that exploits what Sony has introduced."
The copy protection program is included on about 20 popular music titles, including releases by Van Zant and The Bad Plus, and disclosure of its existence has raised the ire of many in the computing community, who consider it to constitute spyware.
Sony BMG Music Entertainment and the company that developed the software, First 4 Internet, have claimed that the technology poses no security threat. Still, Sony posted a patch last week that uncloaks files hidden by the software.
On Thursday, Sony released a statement "deeply regretting any disruption that this may have caused." It also said it was working with Symantec and other firms to ensure any content-protection technology "continues to be safe."
Neither Sony spokesman John McKay nor First 4 Internet CEO Mathew Gilliat-Smith returned messages seeking additional comment.
Windows expert Mark Russinovich discovered the hidden copy-protection technology on Oct. 31 and posted his findings on his Web log. He noted that the license agreement that pops up said a small program would be installed, but it did not specify it would be hidden.
Manual attempts to remove the software can disable the PC's CD drive. Sony offers an uninstallation program, but consumers must request it by filling out two forms on the Internet.
"What they did was not intentionally malicious," Cluley said. "If anything, it was slightly inept."
The copy-protection software, which Sony says is a necessary "speed bump" to limit how many times a CD is copied, only works on Windows-based PCs. Users of
Macintosh and
Linux computers are not restricted.
The viruses also only target Windows-based machines.
The infection opens up a backdoor, which could be used to steal personal information, launch attacks on other computers and send spam, antivirus companies said.
Sony also is facing legal headaches. On Nov. 1, Alexander Guevara filed suit in Los Angeles County Superior Court seeking class action staus. He claims Sony's actions constituted fraud, false advertising, trespass and violated state and federal laws barring malware and computer tampering.
His attorney, Alan Himmelfarb, did not immediately return calls seeking comment.
The Electronic Frontier Foundation, an online civil liberty group, said it is hearing from people who have run into problems with the copy protection software. It is considering filing its own lawsuit, said EFF staff attorney Jason Schultz.
"You can't uninstall it, you can't find it, and it's vastly more invasive in terms of privacy and personal property than any other (digital rights management) program to date," he said.
11-10-05, 09:16 PM
#10
DVD Talk Godfather
Interesting article. This whole thing makes me believe they are considering that encryption bit on the PS3.
So they can run this bs hidden program on a Mac? I wonder how that works.
So they can run this bs hidden program on a Mac? I wonder how that works.
11-11-05, 05:48 PM
#14
DVD Talk Platinum Edition
Join Date: Aug 2001
Posts: 3,193
Likes: 0
Received 0 Likes
on
0 Posts
Looks like I was wrong about my two CDs mentioned above, they apparently have a different copy protection scheme on them. Here's a link to photos of what you'll see on an actual rootkit infected CD:
http://www.eff.org/IP/DRM/Sony-BMG/
and a partial list of these CDs:
http://www.cdfreaks.com/news/12667
http://www.eff.org/IP/DRM/Sony-BMG/
and a partial list of these CDs:
http://www.cdfreaks.com/news/12667
11-11-05, 09:28 PM
#15
Banned
Sony to Suspend Making Antipiracy CDs
In what could be considered a continuation of this topic, here is the following news article:
http://news.yahoo.com/s/ap/20051112/...opy_protection
At least Sony is accepting now some of their mistakes when dealing with piracy.
Sony to Suspend Making Antipiracy CDs By TED BRIDIS, Associated Press Writer
2 hours, 29 minutes ago
WASHINGTON - Stung by continuing criticism, the world's second-largest music label, Sony BMG Music Entertainment, promised Friday to temporarily suspend making music CDs with antipiracy technology that can leave computers vulnerable to hackers.
Sony defended its right to prevent customers from illegally copying music but said it will halt manufacturing CDs with the "XCP" technology as a precautionary measure. "We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use," the company said in a statement.
The antipiracy technology, which works only on Windows computers, prevents customers from making more than a few copies of the CD and prevents them from loading the CD's songs onto Apple Computer's popular iPod portable music players. Some other music players, which recognize Microsoft's proprietary music format, would work.
Sony's announcement came one day after leading security companies disclosed that hackers were distributing malicious programs over the Internet that exploited the antipiracy technology's ability to avoid detection. Hackers discovered they can effectively render their programs invisible by using names for computer files similar to ones cloaked by the Sony technology.
A senior Homeland Security official cautioned entertainment companies against discouraging piracy in ways that also make computers vulnerable. Stewart Baker, assistant secretary for policy at DHS, did not cite Sony by name in his remarks Thursday but described industry efforts to install hidden files on consumers' computers.
"It's very important to remember that it's your intellectual property, it's not your computer," Baker said at a trade conference on piracy. "And in the pursuit of protection of intellectual property, it's important not to defeat or undermine the security measures that people need to adopt in these days."
Sony's program is included on about 20 popular music titles, including releases by Van Zant and The Bad Plus.
"This is a step they should have taken immediately," said Mark Russinovich, chief software architect at Winternals Software who discovered the hidden copy-protection technology Oct. 31 and posted his findings on his Web log. He said Sony did not admit any wrongdoing, nor did it promise not to use similar techniques in the future.
Security researchers have described Sony's technology as "spyware," saying it is difficult to remove, transmits without warning details about what music is playing, and that Sony's notice to consumers about the technology was inadequate. Sony executives have rejected the description of their technology as spyware.
Some leading antivirus companies updated their protective software this week to detect Sony's antipiracy program, disable it and prevent it from reinstalling.
After Russinovich criticized Sony, it made available a software patch that removed the technology's ability to avoid detection. It also made more broadly available its instructions on how to remove the software permanently. Customers who remove the software are unable to listen to the music CD on their computer.
2 hours, 29 minutes ago
WASHINGTON - Stung by continuing criticism, the world's second-largest music label, Sony BMG Music Entertainment, promised Friday to temporarily suspend making music CDs with antipiracy technology that can leave computers vulnerable to hackers.
Sony defended its right to prevent customers from illegally copying music but said it will halt manufacturing CDs with the "XCP" technology as a precautionary measure. "We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use," the company said in a statement.
The antipiracy technology, which works only on Windows computers, prevents customers from making more than a few copies of the CD and prevents them from loading the CD's songs onto Apple Computer's popular iPod portable music players. Some other music players, which recognize Microsoft's proprietary music format, would work.
Sony's announcement came one day after leading security companies disclosed that hackers were distributing malicious programs over the Internet that exploited the antipiracy technology's ability to avoid detection. Hackers discovered they can effectively render their programs invisible by using names for computer files similar to ones cloaked by the Sony technology.
A senior Homeland Security official cautioned entertainment companies against discouraging piracy in ways that also make computers vulnerable. Stewart Baker, assistant secretary for policy at DHS, did not cite Sony by name in his remarks Thursday but described industry efforts to install hidden files on consumers' computers.
"It's very important to remember that it's your intellectual property, it's not your computer," Baker said at a trade conference on piracy. "And in the pursuit of protection of intellectual property, it's important not to defeat or undermine the security measures that people need to adopt in these days."
Sony's program is included on about 20 popular music titles, including releases by Van Zant and The Bad Plus.
"This is a step they should have taken immediately," said Mark Russinovich, chief software architect at Winternals Software who discovered the hidden copy-protection technology Oct. 31 and posted his findings on his Web log. He said Sony did not admit any wrongdoing, nor did it promise not to use similar techniques in the future.
Security researchers have described Sony's technology as "spyware," saying it is difficult to remove, transmits without warning details about what music is playing, and that Sony's notice to consumers about the technology was inadequate. Sony executives have rejected the description of their technology as spyware.
Some leading antivirus companies updated their protective software this week to detect Sony's antipiracy program, disable it and prevent it from reinstalling.
After Russinovich criticized Sony, it made available a software patch that removed the technology's ability to avoid detection. It also made more broadly available its instructions on how to remove the software permanently. Customers who remove the software are unable to listen to the music CD on their computer.
At least Sony is accepting now some of their mistakes when dealing with piracy.
11-12-05, 01:04 AM
#16
DVD Talk Special Edition
Join Date: Apr 2001
Posts: 1,061
Likes: 0
Received 0 Likes
on
0 Posts
I may be in the minority but this technology stopped me from buying CDs.
My preference is to buy the actual CD and then add it to itunes. That way I get the physical product and have it on my IPod. The last few months I haven't had a CD player in my Car or at home so I only use the iPod. So I didn't buy CDs that couldn't be used with the iPod. For the first time ever, I downloaded some free copies because I'm not paying $10 to itunes, when i can go to the store and have the best of both worlds.
My preference is to buy the actual CD and then add it to itunes. That way I get the physical product and have it on my IPod. The last few months I haven't had a CD player in my Car or at home so I only use the iPod. So I didn't buy CDs that couldn't be used with the iPod. For the first time ever, I downloaded some free copies because I'm not paying $10 to itunes, when i can go to the store and have the best of both worlds.
11-12-05, 01:07 AM
#17
Banned
Join Date: Feb 2001
Location: NYC
Posts: 15,957
Likes: 0
Received 0 Likes
on
0 Posts
I just tried to add Sarah McLachlan's latest through Itunes and guess what? YOU CAN'T. I bought the friggin album and i can't even listen to it. Sucks. 
Now i have to search the net for the site that tells me how to crack the code.
Now i have to search the net for the site that tells me how to crack the code.
11-15-05, 09:22 AM
#18
DVD Talk Gold Edition
Join Date: May 2002
Location: waiting for forum.dvdtalk.com ...
Posts: 2,755
Likes: 0
Received 1 Like
on
1 Post
i'm really surprised how little discussion this is generating here (perhaps because it was not in either the tech or political forums). if you cruise over to groklaw you can get more detailed examples of what sony was planning to do to your computer WITHOUT your explicit consent. sony has really gone overboard by exposing potentially millions of computers to risk -- well, i should say windows computers because osx/linux boxes are immune to the rootkit and osx must explicitly approve installation as an admin for the mediamaxx program.
edit -- more info here.
edit -- more info here.
Last edited by kms_md; 11-15-05 at 09:41 AM.
11-15-05, 10:09 AM
#19
DVD Talk Godfather
Originally Posted by kms_md
if you cruise over to groklaw you can get more detailed examples of what sony was planning to do to your computer WITHOUT your explicit consent. .
Was it written by a high schooler? Sheesh.
11-15-05, 02:35 PM
#20
DVD Talk Hero
When you first fill out Sony’s form to request a copy of the uninstaller, the request form downloads and installs a program – an ActiveX control created by the DRM vendor, First4Internet – called CodeSupport. CodeSupport remains on your system after you leave Sony’s site, and it is marked as safe for scripting, so any web page can ask CodeSupport to do things.
At this point, I think the entire Windows OS should be considered a security risk.
11-15-05, 02:42 PM
#21
DVD Talk Godfather
Originally Posted by Michael Corvin
I started reading but they lost any credibility when they describe Sony as "Wigged Out."
Was it written by a high schooler? Sheesh.
Was it written by a high schooler? Sheesh.
11-16-05, 03:33 PM
#23
I think I only have 1 cd from their list. Life of Agony "Broken Valley". I didn't put it in my computer and have no plans to, so I don't think I'll swap.
Also, I know the new Foo Fighters cd is also copy protected, but they are on RCA. Is this copy protection software totally different than what Sony uses?
I'm a little concerned about Blu-Ray now. I mean, Sony is behind this antipiracy disaster and they are also the ones that are bringing us Blu-Ray. I trust them alot less now after this whole cd mess occurred. I just hope they don't do anything with that technology that will screw us over.
Also, I know the new Foo Fighters cd is also copy protected, but they are on RCA. Is this copy protection software totally different than what Sony uses?
I'm a little concerned about Blu-Ray now. I mean, Sony is behind this antipiracy disaster and they are also the ones that are bringing us Blu-Ray. I trust them alot less now after this whole cd mess occurred. I just hope they don't do anything with that technology that will screw us over.
11-16-05, 04:00 PM
#24
Banned
And now a recall! Sony Yanks Copy-Protected CDs
Sony Yanks Copy-Protected CDs Robert McMillan, IDG News Service
Wed Nov 16,11:00 AM ET
After two weeks of relentless criticism over its XCP copy protection software, Sony BMG Music Entertainment is pulling CDs that contain the software from store shelves. The company is also planning to offer customers a way to exchange CDs that contain the flawed copy-protection software.
"We share the concerns of consumers regarding discs with the XCP software, and we are instituting a program that will allow customers to exchange any CD with XCP software for the same CD without copy protection," Sony said in a statement posted on Tuesday.
'Sneaky' Software
XCP, which stands for Extended Copy Protection, is Windows software designed to limit the number of copies a PC user can make of a CD, but it uses controversial cloaking techniques to hide itself on the computer. Critics had warned that these techniques could gum up a computer's performance or possibly even be used by attackers to attack the machine.
Late last week, the first examples of malicious software that exploited the XCP cloaking mechanism began surfacing, prompting Sony to temporarily cease production of XCP-enabled CDs.
Sony had originally defended its use of XCP, and had downplayed the security and privacy risks associated with the software. With Tuesday's recall, however, the company finally appeared to acknowledge the seriousness of the matter. "We deeply regret any inconvenience this may cause our customers," Sony's statement said.
Still, Sony has some important questions to answer, according to the computer expert who first discovered the problems with XCP.
The biggest problem Sony now faces is helping customers who have installed the nearly undetectable software to remove it from their machines, said Mark Russinovich, chief software architect with Winternals Software LP, who originally identified the potential problem. Users who want to take XCP off their computers had been forced to send an e-mail to Sony and then download an ActiveX control that exposes them to further security risks, he said.
Mop-Up Still Needed
Sony on Tuesday suspended use of this uninstall process and promised to provide a "simplified and secure procedure" for uninstalling XCP. But the company provided no details on what this new procedure might be, or on how customers might exchange their XCP CDs. It also failed to address concerns about a second type of copy-protection software, called MediaMax, that ships with Sony CDs. Computer experts have said that this software suffers from many of the same problems as XCP.
Russinovich had some advice for Sony on how to simplify things. First off, the company should drop the dangerous ActiveX software, he said. Secondly, they should release a secure uninstaller that is easier to obtain. "They should just say, 'If you want the uninstaller, here it is: Click this link to execute it,'" he said. "I've seen no valid reason to have the uninstall process be what it is."
XCP is included in about 20 Sony titles including CDs by Van Zant, Sony has said. Security researcher Dan Kaminsky has estimated that at least 500,000 computers have installed the software.
Wed Nov 16,11:00 AM ET
After two weeks of relentless criticism over its XCP copy protection software, Sony BMG Music Entertainment is pulling CDs that contain the software from store shelves. The company is also planning to offer customers a way to exchange CDs that contain the flawed copy-protection software.
"We share the concerns of consumers regarding discs with the XCP software, and we are instituting a program that will allow customers to exchange any CD with XCP software for the same CD without copy protection," Sony said in a statement posted on Tuesday.
'Sneaky' Software
XCP, which stands for Extended Copy Protection, is Windows software designed to limit the number of copies a PC user can make of a CD, but it uses controversial cloaking techniques to hide itself on the computer. Critics had warned that these techniques could gum up a computer's performance or possibly even be used by attackers to attack the machine.
Late last week, the first examples of malicious software that exploited the XCP cloaking mechanism began surfacing, prompting Sony to temporarily cease production of XCP-enabled CDs.
Sony had originally defended its use of XCP, and had downplayed the security and privacy risks associated with the software. With Tuesday's recall, however, the company finally appeared to acknowledge the seriousness of the matter. "We deeply regret any inconvenience this may cause our customers," Sony's statement said.
Still, Sony has some important questions to answer, according to the computer expert who first discovered the problems with XCP.
The biggest problem Sony now faces is helping customers who have installed the nearly undetectable software to remove it from their machines, said Mark Russinovich, chief software architect with Winternals Software LP, who originally identified the potential problem. Users who want to take XCP off their computers had been forced to send an e-mail to Sony and then download an ActiveX control that exposes them to further security risks, he said.
Mop-Up Still Needed
Sony on Tuesday suspended use of this uninstall process and promised to provide a "simplified and secure procedure" for uninstalling XCP. But the company provided no details on what this new procedure might be, or on how customers might exchange their XCP CDs. It also failed to address concerns about a second type of copy-protection software, called MediaMax, that ships with Sony CDs. Computer experts have said that this software suffers from many of the same problems as XCP.
Russinovich had some advice for Sony on how to simplify things. First off, the company should drop the dangerous ActiveX software, he said. Secondly, they should release a secure uninstaller that is easier to obtain. "They should just say, 'If you want the uninstaller, here it is: Click this link to execute it,'" he said. "I've seen no valid reason to have the uninstall process be what it is."
XCP is included in about 20 Sony titles including CDs by Van Zant, Sony has said. Security researcher Dan Kaminsky has estimated that at least 500,000 computers have installed the software.
http://news.yahoo.com/s/pcworld/2005...NlYwMlJVRPUCUl
This should go with the things that shouldn't be created in the first place, along with the DIVX and the EZ-DVD. Just imbeciles running big corporations these days, eh?