Slashdot Log In
Sony Warned Weeks Ahead of Rootkit Flap
Posted by
Zonk
on Tue Nov 29, 2005 01:25 PM
from the going-a-little-slowly dept.
from the going-a-little-slowly dept.
pdschmid writes "Business Week has an article describing how Sony BMG had been warned by F-Secure on Oct. 4 about the dangers of their rootkit protection, but failed to do anything until Oct. 31 when computer-systems expert Mark Russinovich revealed the rootkit in his blog." From the article: "Sony BMG officials insist that they acted as quickly as they could, and that they expected to be able to go public and offer a software patch at the same time. However, Russinovich posted his blog item first, forcing Sony BMG to scramble to contain the crisis. It recalled millions of CDs recorded by 52 artists, including Van Zant, Celine Dion, and Neil Diamond. Plus, it offered exchanges to customers."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
So corporations still lie.... (Score:4, Insightful)
Another possibility exists... (Score:5, Insightful)
That they were lying is one possible explanation. Looking on the bright side, another possibility is that they're just incompetent.
Parent
Re:Another possibility exists... (Score:5, Funny)
Parent
Re:Another possibility exists... (Score:3, Insightful)
Re:Another possibility exists... (Score:5, Funny)
True, and you should never ascribe to malice that which can be explained by incompetence. Though in fun world of corporations, the two seem to go hand in hand.
Any sufficiently advanced incompetence is indistinguishable from malice.
Parent
Re:Another possibility exists... (Score:5, Insightful)
In the case of operating systems, even Microsoft should be able to invoke ignorance, as the best minds money could buy cannot properly figure out exactly what a patent covers, and even if they could, proper enforcement would result in losses to GDP easily exceeding 20% as companies retool to avoid the use of computers and replace them with typewriters and file cabinets (typing and data storage), servos and relays (industrial processes, automobiles, microwaves, anything else currently built with computers). On top of increased staffing needs for most corporations, energy efficiency will decline as the carbeurator will replace fuel injection in autos and electric power plants retool to manual operations (certain plants, like many solar plants and photovoltaic systems, are likely to be entirely unoperable and mothballed). Efficiency might be maintained by switching to turbine-based engines (say, steam turbines or gas turbines), but such a switch would drastically increase the cost and complexity of automobiles. Telephone companies in particular will have to hire many switchboard operators and we can expect to see call costs rise back to pre-AT&T breakup costs. A modern Cold War-style military such are our own is dependant on computers from everything from remote control drones to fighter planes to secure and rapid communications. And lastly, Slashdot would not be possible without computers.
That said, I feel that Sony is entirely responsible for what they did as they should have known better. Trojan horses being no-nos is just plain common sense and they serve no legitamite purpose. Sony purposefully wrote or purchased a program to have this function, and as Sony is in the software business they can be expected to be authorities on the subject and act accordingly (as opposed to patents which require substantial knowledge in law just to understand, no less safely navigate - and the cost of compliance is so high that no reasonable corporation can be expected to fully comply with them as it would entail disbanding the corporation in many instances)
Parent
Re:Another possibility exists... (Score:5, Insightful)
MPlayer, Linux, LAME etc etc, are perfectly legal here in the UK since software patents are not enforcable. The problem is not with the software, it's with the US patent system.
Bob
Parent
Re:Another possibility exists... (Score:5, Informative)
Parent
Re:So corporations still lie.... (Score:5, Interesting)
http://www.benedelman.org/news/112105-1.html [benedelman.org]
http://www.downloadsquad.com/2005/11/23/sony-coul
Sony could use XCP to protect its customers, but won't
Spyware researcher Ben Edelman says that XCP, the software at the heart of Sony's rootkit fiasco, could also be used to inform Sony's customers that their computers have been compromised. Sony doesn't know whose computers are infected by their rootkit, but the XCP player software includes code for automatically fetching a banner from Sony's servers. Sony could easily use this to display a recall notice to the rootkit's victims, but are they going to? I seriously doubt it. While the whole affair has been gaining more and more traction with the media, Sony knows that the majority of its customers will never hear about any of it, and they want to keep it that way. While their recall was intended to be viewed as a good-faith gesture (and, indeed, there may be some actual good faith in there somewhere), the last thing Sony wants is for every Switchfoot fan to know how badly their record company screwed up their computer.
Parent
What a load (Score:5, Insightful)
They almost never admitted what they had done, and continually denied the dangers posed by this rootkit.
They only started the recall after people pointed out repeatedly that their "uninstaller" didn't, and recieved criticism from the government.
"as quickly as they could" my ass.
Of course, they could have been smarter and never released it to begin with.
Don't forget Sony's other nasty DRM (Score:5, Informative)
If you have a device driver named Sbcphid.sys (which shows up as a hidden non-plug-and-play device named Sbcphid when active), you've got MediaMax and should remove it [cdfreaks.com].
Only the EFF [eff.org] has mentioned MediaMax in the various legal claims against Sony, and Sony has remained silent about it in public as well. Obviously they're not sorry about using DRM at all -- they're just sorry they got caught.
Parent
Re:Don't forget Sony's other nasty DRM (Score:5, Informative)
However, yesterday word came out [freedom-to-tinker.com] that in some cases the software can become permanently activated even though the user declined to have it installed.
Parent
Re:Don't forget Sony's other nasty DRM (Score:5, Insightful)
Haven't you learned by now that any lost sales are blamed on piracy? Which means it will probably just lead to more DRM bullshit. I mean, it's gotten to the point where I can no longer justify buying a CD. Why shouldn't I be able to backup a cd I payed 20 bucks for? It will end up with me doing something illegal either way. It's cool because the stuff I download doesn't have DRM!
Parent
Sony made a rootkit? (Score:5, Funny)
Re:Sony made a rootkit? (Score:3, Funny)
You're reading on a Vaio, in which case you won't be able to see any stories containing the sequence $sys$
Proves public disclosure is the best for security (Score:5, Insightful)
I think this is great evidence that early public disclosure is very important. At the minimum, the affected users can start using workarounds (turn off insecure systems) until fixes are available.
Re:Proves public disclosure is the best for securi (Score:5, Insightful)
I don't think this was a security hole so much as breaking and entering. I realize the players are different here but didn't Kevin Mitnick spend years in jail for stuff like this? I guess when a corporation hacks a consumer it's OK.
Parent
Re:Proves public disclosure is the best for securi (Score:4, Informative)
Oh man nothing like sucking up to
Parent
Re:Proves public disclosure is the best for securi (Score:5, Insightful)
The actual people that did the hacking were working for this "First4Internet" company. Anyone that designed, wrote or approved a part of the software deemed to be inappropriate could face jail time. There were people at Sony that approved this technology for use on CDs; they could face jail time. There were people at Sony that knew that their software included a rootkit and insecure kernel modifications, and yet claimed otherwise; they could face fraud charges (for an individual to say, "I am not a crook," is legal, but to knowingly lie about a product offered for sale is fraud). Anyone with much knowledge of the workings of this product should have known that it was illegal, just as Kevin Mitnik or any other cracker surely knows that whatever he does (like I said, I have no idea what it was that he did) is illegal. That would be equal justice.
Parent
Re:Proves public disclosure is the best for securi (Score:5, Interesting)
Nothing like trashing someone else to get modded up.
Aside from that, I guess the Sony case will be nothing like the Mitnick case as he was held without bail and spent time in solitary confinement. It seems a safe assumption that the Sony execs will suffer no similar fate. Not to mention the other poster here who points out that they are only facing a civil suit, not a criminal one.
Parent
Thats what happens... (Score:5, Funny)
They shouldn't have recalled the CDs (Score:5, Funny)
They should have left the rootkit in place so we could download some good music directly to these misguided buyers' hard drives.
Re:They shouldn't have recalled the CDs (Score:4, Funny)
Parent
Still on the Shelves (Score:5, Informative)
If this is true... (Score:5, Insightful)
The only defence available to them was that they didn't realise this was happening. They've just lost that.
Re:If this is true... (Score:4, Interesting)
Parent
Re:If this is true... (Score:4, Interesting)
Sony is a BIG company, huge enough to be considered a part of The Man. Therefore, there's no way that (1) they will lose any suits, or (2) they will be hit with damages that will have any practical impact whatsoever.
I would love to have to eat these words... here's hoping.
Parent
Re:If this is true... (Score:4, Insightful)
Sony is primarily a foreign company, so they won't get a free pass. However, the majority way these things usually work out is one or more politically ladder-climbing motivated Attorney Generals sue Sony "on behalf of the people" or somesuch hollow excuse. The proceedings drag on at a glacial legal-system pace, bad PR fades out of the public eye, and eventually AG announces an out of court "settlement" between company and the State. Said settlement money goes straight into State's coffers, never to be seen or heard about again.
All in the end, you are still out $18 for a dodgy CD disc and stuck with a rootkit infecting your PC.
Parent
Impressions (Score:5, Insightful)
They've just lost that credit for me. They knew for a month and were sitting on it! That is not acceptable. There should have been no warning to Sony, just a public statement from F-Secure at the beginning of October about the rootkit.
Re:Impressions (Score:5, Insightful)
Its easier to prevent a fire by notifying management to fix the sparking wires than to put one out after notifying a world full of pyros to come dump gasoline on it.
tm
Parent
Re:Impressions (Score:5, Insightful)
Parent
Re:Impressions (Score:5, Insightful)
The difference between a Microsoft security issue and the Sony rootkit is earth and sky.
If F-Secure would have identified a flaw in Microsoft's software, then it's ok if they give the company a grace period to get a patch ready.
There was no such patch to be prepared in the case of Sony.
The following things are sensible to be done when someone finds a new rootkit spreading in the wild:
Let's face it: By telling Sony about it and not going for public disclosure F-Secure accomplished nothing but let even more users get infected by this rootkit. Sony is not a software company, there wasn't a flaw in a software that needed to be fixed, but the software itself removed! That requires no cooperation on behalf of Sony.
Parent
Re:Impressions (Score:4, Insightful)
Parent
Re:Impressions (Score:4, Insightful)
This analogy doesn't work.
This wasn't a flaw being exploited by some immoral third party. This wasn't a bug, this wasn't an unforeseen error in functionality.
This was malware, doing precisely what it was intended to do.
F-Secure was acting in the best interest of the people who had been infected by this rootkit.
No, they weren't. What would have been acting in the best interested of the people who had been infected would be to tell people "You've been infected by a rootkit."
However, they gave Sony BMG a reasonable chance in fixing the security holes, as they do give any other company rightly so.
They do?
They give the authors of viruses and trojans the chance to fix their viruses and trojans before they offer fixes for them?
Oh, they don't do that? Then why should they do that for Sony when Sony deliberately releases malware into the wild?
Once again, this was not a bug. This was malware. You don't notify authors of malware that you've found their stuff, and give them an opportunity to rewrite it to be slightly less mal before you go public. You write a fix, and notify the public.
Parent
Full Disclosure is Hard (Score:5, Interesting)
I think that it would have been much better if the news could have broken with a worken, well-engineered patch. This is always preferable. F-Secure was trying to make this happen. A month is not a long time. Yes, a lot of people were infected in that month; but a lot of people were infected anyway. F-Secure did a right thing.
On the other hand, Russinovich also did a right thing. This software was not a mistake; it was deliberate. People were getting infected and had no idea. Clearly, people should know about this. Clearly, the corporation did not give a rat's ass about their users.
I like responsible full disclosure: give the maker time to fix it, and publish with a patch when possible. But don't allow eternal "patch development," and make sure disclosure happens. There is room for disagreement among people of good will and high ethics.
Sony need not apply to that group,though.
Parent
recalled? (Score:5, Funny)
Obligatory (Score:5, Funny)
Re:Obligatory (Score:5, Funny)
Parent
Re:Obligatory (Score:5, Funny)
Parent
As quickly as they could? (Score:5, Insightful)
In this case, "as quickly as they could" seems to really mean "as slowly as they could get away with."
How long is it going to be before these companies realize that attacking their customers and treating them like criminals really is NOT a good way to do business? Microsoft's "product activation", Sony's rootkit, etc. ad naseum do essentially nothing to stop real hackers from copying software, music, etc., as much as they want, so the only thing they really accomplish is hurting the legitimate customers.
These lousy business practices are reflected in their (lack of) sales too. I don't mean to say a boycott of Sony would necessarily be a bad thing, but for those who haven't looked, take a look at Sony's stock prices [yahoo.com] -- boycott or no, they're not exactly burning up the charts right now.
Now, Sony (etc.) will undoubtedly point to Napster and such as the reason they're not doing as well recently. I don't think that's the case. I think what's happened is that Sony is now concentrating more on forcing customers to pay than they are on producing things customers want. As is visible in their stock price, that simply leads to oblivion, not prosperity.
--
The universe is a figment of its own imagination.
I call b.s. (Score:3, Insightful)
They're telling the truth, in part: they reacted as fast as they could to the bad press. But not to the real issue - the flawed software.
One hand stabs and the other doesn't know it (Score:4, Interesting)
That said, I wouldn't be surprised if the people who received this warning never had any contact with the people responsible for the rootkit. Intra-company communication is horrid in large corps, and often the people implementing solutions get little or no real information beyond requirements and specs from those making the decisions above them.
One manager tells another manager who tells a team to hire people to write a DRM. Another manager gets a message about how dangerous these "rootkits" are, and forwards it to another manager who thinks "we're not making a rootkit, we're making a DRM."
Sony's music division cannot reconcile its business with Sony's technology division. They're competing directly, and eventually one of them is going to win. I'm hoping this was another nail in the former's coffin.
Hesse Is Amazing - Sony needs to promote him (Score:4, Interesting)
How anyone in his position could use the words "rootkit" and "benign" in the same sentence and expect to be taken seriously is beyond me.
How about:
'err, this e-mail seems to be about a routine matter. While it did introduce the notion of 'death and dismemberment', it did not suggest that the actions were anything but benign.
I don't think that any competent techie would consider the word "rookit" as something to ignore in an e-mail ... and if Sony doesn't have techies reviewing things when mgt doesn't understand what they are, then they deserve everything coming to them.
At this time, I'd like to thank Mr. Hesse for doing a world of favour to the anti-DRM community. Keep up the good work!
And when you think of Infected by DRM , think/thank Hesse...
Parent
"... it offered exchanges to customers." (Score:4, Interesting)
For all the flak that Microsoft gets in regards to security... at least they're bugs, by bad design or not. This is something Sony deliberately put into their products. I want heads to roll.
I wonder... (Score:3, Interesting)
This is wonderful! (Score:3, Insightful)
Scrambling to contain the crisis (Score:5, Funny)
Phony Sony had a rootkit which installed itself.
But all of Sony's lawyers and all of Sony's PR men,
Could not put the integrity back into Sony again.
Who cares when Sony was warned... (Score:4, Insightful)
F-Secure warned Sony about the dangers on October 4th, yet still failed to protect any of it's users in a timely manner.
Yeah... (Score:5, Insightful)
You can just hear the urgency can't you...
Re:Sony LOVES DRM (Score:4, Insightful)
Sony's way ahead of you. Buy a sony Walkman "MP3" player and it won't play anything but propriatery ATRAC files. It won't even play MP3s, hence the quotation marks on MP3 above.
Parent