Sony/BMG copy-protection issues.

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   My company's IE department sent out the following this afternoon, and I thought I'd pass it along to everyone here.

This summer, Sony BMG began copy-protecting its music CD's using various methods to attempt to prevent illegal copying. Recently, it has been discovered that one such protection method installs proprietary software, contained on the protected CD, on any Windows PC on which the CD is played. Moreover, this software is regarded by many as a Windows rootkit since it installs itself without user knowledge (other than a statement within the End User License Agreement about proprietary software), intercepts certain systems calls, etc. Worse, the software also hides all of its files, registry changes, etc., from the Windows API using a dangerously unsophisticated technique. As described by Symantec (see  http://securityresponse.symantec.com/avcenter/venc/data/secu rityrisk.aries.html ), "...First4DRM is a rootkit that hides any processes, files, folders, or registry subkeys that start with the following string: $sys$...."

Why Should We Care?

The first problem is that once installed, this software requires special tools for removal in order to prevent system problems; if removed incorrectly, the Windows OS may have to be re-installed to restore CD drive functionality. The worst problem, however, is that malicious software can be written to hide files using Sony's previously installed copy-protection software; in fact, on 10 November, Romanian anti-virus firm BitDefender stated that it had discovered software that installs a backdoor Trojan on PCs that have Sony's protection software installed (  http://news.bitdefender.com/NW193-en--First-Trojan-Using-Son y-DRM-Detected.html ). As stated on BitDefender's website, "...A new Trojan which uses the cover provided by the Sony DRM component to hide has been detected by BitDefender Labs at 12.15 PM GMT today and is in the wild. This is the first ever observed instance of malware using the Sony DRM rootkit detected and analysed by Mark Russinovich.

The Trojan apparently installs an IRC backdoor on the affected system and may have other functions...."

While this new Trojan does not currently appear to be a viable threat, there is little doubt that other, more threatening, malicious software will follow in its path.

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
JMD1961 Members Profile Send Private Message Find Members Posts Add to Buddy List Music Fan Joined: 29 March 2005 Location: United States Status: Offline Points: 2	Post Options Post Reply Quote JMD1961 Thanks(0) Quote Reply Topic: Sony/BMG copy-protection issues. Posted: 11 November 2005 at 2:38pm
	My company's IE department sent out the following this afternoon, and I thought I'd pass it along to everyone here. This summer, Sony BMG began copy-protecting its music CD's using various methods to attempt to prevent illegal copying. Recently, it has been discovered that one such protection method installs proprietary software, contained on the protected CD, on any Windows PC on which the CD is played. Moreover, this software is regarded by many as a Windows rootkit since it installs itself without user knowledge (other than a statement within the End User License Agreement about proprietary software), intercepts certain systems calls, etc. Worse, the software also hides all of its files, registry changes, etc., from the Windows API using a dangerously unsophisticated technique. As described by Symantec (see http://securityresponse.symantec.com/avcenter/venc/data/secu rityrisk.aries.html ), "...First4DRM is a rootkit that hides any processes, files, folders, or registry subkeys that start with the following string: $sys$...." Why Should We Care? The first problem is that once installed, this software requires special tools for removal in order to prevent system problems; if removed incorrectly, the Windows OS may have to be re-installed to restore CD drive functionality. The worst problem, however, is that malicious software can be written to hide files using Sony's previously installed copy-protection software; in fact, on 10 November, Romanian anti-virus firm BitDefender stated that it had discovered software that installs a backdoor Trojan on PCs that have Sony's protection software installed ( http://news.bitdefender.com/NW193-en--First-Trojan-Using-Son y-DRM-Detected.html ). As stated on BitDefender's website, "...A new Trojan which uses the cover provided by the Sony DRM component to hide has been detected by BitDefender Labs at 12.15 PM GMT today and is in the wild. This is the first ever observed instance of malware using the Sony DRM rootkit detected and analysed by Mark Russinovich. The Trojan apparently installs an IRC backdoor on the affected system and may have other functions...." While this new Trojan does not currently appear to be a viable threat, there is little doubt that other, more threatening, malicious software will follow in its path.

JMD1961 Members Profile Send Private Message Find Members Posts Add to Buddy List Music Fan Joined: 29 March 2005 Location: United States Status: Offline Points: 2	Post Options Post Reply Quote JMD1961 Thanks(0) Quote Reply Posted: 12 November 2005 at 3:32pm
	Just read that, due to the outcry from the anti-virus community, that Sony has discontinued their copy-protection plans... for now.

aaronk Members Profile Send Private Message Find Members Posts Add to Buddy List Admin Group Joined: 16 January 2005 Location: United States Status: Offline Points: 84	Post Options Post Reply Quote aaronk Thanks(0) Quote Reply Posted: 12 November 2005 at 3:44pm
	That's good news. Besides, those people who want to make copies of CDs to pirate them are going to find a way around it. For the rest of us who want to make legitimate copies (i.e. to listen to on our portable mp3 players or to add tracks to our personal compilations) it's one of the most annoying damn things Sony has ever done.