Sony DRM Installs a Rootkit?

An anonymous read writes "SysInternals.com guru Mark Russinovich has a detailed investigation of a rootkit from Sony Music. It's installed with a DRM-encumbered music CD, Van Zant's "Get Right with the Man". (Mmmm, delicious irony!) The rootkit introduces several security holes into the system that could be exploited by others, such as hiding any executable file that starts with '$sys$'. Russinovich also identifies several programming bugs in the method it uses to hook system calls, and chronicles the painful steps he had to take to 'exorcise the daemon' from his system." This house is clear.

My question:

Now is that *sony's* rootkit, or a soon-to-be-former-sony-employer's rootkit?

Re:My question:

If you read the article, there's a strong implication that this is a purchased commercial rootkit. Presumably, Sony very deliberately licensed and distributed it.

Mark didn't get into a lot of detail about all of the functions, but he didn't mention any backdoors or phone home functionality.

Re:My question:

Honestly, I see this as a real exposure to a lawsuit. If I accidently install this rootkit on my system, then try to remove it (seeing as it looks like a genuine security breach) and then disable my computer, thus having to bring it in for service what then?. If a malware company uses the rootkits ability to hide $sys$ prefixed files and uses that to steal my identity, costing me thousands of dollars and hundreds of hours of time to get my identity back, can I sue?

-nB

Sony is protected by the DMCA

I see this as a real exposure to a lawsuit. If I accidently install this rootkit on my system, then try to remove it...

If you do this, then you are deliberately disabling a copy protection system, which is illegal under the DMCA. So Sony can sue you.

[Note: this varies with your jurisdiction. No DMCA in Canada, yet.]

Doug Moen.

Re:Sony is protected by the DMCA

Doug, I think you're wrong.

I can disable a copy protection system on my own computer - specifically removing it. They didn't have permission to put it there, and I think it would be a tough case to prosecute me for repairing my own computer. My computer is not Sony's medium to do with as they please - it's MINE - I paid for it, and I licensed the software.

Now, removing the protection from their media - or extracing the content and freeing it from the DRM, yes, that's circumvention, and probably prosecutable under the DMCA.

But my computer is MINE and they don't have the right to secretly fuck with it.

Re:Sony is protected by the DMCA

I'm not sure what jurisdiction -you're- in, but the last I checked anywhere, those general "not our fault" clauses don't mean a thing against something done intentionally. If you are with full awareness doing something malicious, that is a totally different animal then accidentally releasing bugged software, and "not our fault" won't even begin to protect them.

Re:Sony is protected by the DMCA

Actually, the this fun part is from section 3:
Upon the expiration or termination of this EULA, you shall immediately remove all of the LICENSED MATERIALS from your personal computer system and delete or destroy them, along with any related documentation (and any copies thereof) that you may have received or otherwise may possess

So, pretty much what they want me to do is, if I decide to terminate the agreement I have to re-format my system.

Re:Sony is protected by the DMCA

Unfortunately, this is only something that could be dealt with at a trial. Whose rights are more valuable, the content provider, or the paying customer? A person has a reasonable expectation of privacy and security on his or her home computer. Any attempt to circumvent this privacy or security should be construed as trespass. On the flipside, recording artists and the companies that represent them have an expectation that their work is compensated, and that "legal" means to protect their interests be respected. I'm not arguing for the DMCA here, however it _IS_ law. By removing the Sony-installed malware, Mark has broken the law. But so is trespass illegal, so tell me, which is a greater abomination?

      I'd vote for trespass, but I also don't have any content to sell. Mark, how's the adminpak selling? I hope you've got some good DRM on your CD's if you're any indication of the talent that's out there...

Re:Sony is protected by the DMCA

I dont think this is right.

He didn't remove the DRM for access to songs.

He removed the DRM from his computer (effectively
a manual uninstall). They did imply in the document that he was allowed to uninstall it.

Re:Sony is protected by the DMCA

I don't know why this idea keeps cropping up, and particularly why it got modded to 5. The DMCA most certainly does NOT permit circumvention for Fair Use purposes.

US Law Title 17 section 1201: [cornell.edu]
Circumvention of copyright protection systems
(a) Violations Regarding Circumvention of Technological Measures.--
(1) (A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title.

The act of circumvention itself is indeed criminalized by the DMCA.

Note that the DMCA also says:
(c) Other Rights, Etc., Not Affected.--(1) Nothing in this section shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use, under this title.

That sounds pretty good, right? Except it's pure bullshit, law literally written by lawyers employed by the publishing industry. It means absolutely ZERO. It says it protects/preserves Fair Use defenses to Copyright Infringment. However CIRCUMVENTION CRIME is not copyright infringment. Circumvention crime has absolutely nothing to do with copyright infringment. There is no Fair Use defence to cricumvention crime. So what that section really says is that a NONEXISTANT defence is not affected. It sure sounded nice though, didn't it?

-

Re:Sony is protected by the DMCA

indeed. for the purpose of deciding who is running something, is autorun.inf "us" or "them" ?

Re:Sony is protected by the DMCA

An EULA in the booklet? Do you have to read and click agree on the booklet before you can use the CD? A contract like that isn't going to hold up if one party doesn't agree to it in the first place, or may not even have knowledge of its existance.

When I buy a CD, I shouldn't have to expect it to install a rootkit, and have to check the included materials to see if it does; it's Sony's responsibility to tell me they're messing with my software, and ask for consent...

Re:Sony is protected by the DMCA

They'd better hope it's them, because if it's us, then it's not circumventing their copy protection scheme to hold down shift while I load the CD, is it?

On the other hand, if it's them and they install software on my PC without my permission in the UK, my lawyer would like to talk to them about the Computer Misuse Act.

Oh dear. This sounds like a lose-lose proposition for Sony. That's really, y'know, too bad and all. :-)

Sony is flirting with trouble...

They don't put it there. You do. They just packaged it for you. If you didn't want to give them permission to run arbitrary executables on your computer, then WHY DID YOU RUN THEIR EXECUTABLE??

IANAL, however, I believe that contracts that are made in bad faith, or with the intent to decieve a particpant are not binding. If this is the case, I think that I wouldn't be hard to argue in a court that you have no obligation to keep Sony's rootkit (by deffinition an illicit and deceptive tool) on your computer. Moreover, you might also be entitled to damages resulting from said 'bad faith' agreement.

Even if my assessment isn't quite correct, it seems to me that it is probably fuzzy enough of a point to invite litigation. If I were a multimillion(billion?) dollar company I wouldn't be the one to test the legal water on something like this.

Re:Sony is protected by the DMCA

Consumer puts a cd into their computer with the intention of playing the cd. The cd takes advantage of a feature in Windows and installs software in the background without your knowledge. No court would find Sony not liable for damagaes caused because the user didn't disable autorun. It's the same as an email viruses, just because the user never turned off macros doesn't let the person who runs the virus off the hook.

This isn't the first time Sony's had this idea. Years ago they asked someone to write a virus to subliminally provide marketing to people. This motivated the person they asked to write a book called Coercion.

Re:Sony is protected by the DMCA

I call BS on this. When you put what you think is an audio CD in your CD ROM drive and click on the drive icon, you don't expect to be giving permission to anybody to install a rootkit.

Furthermore, your argument is simply insane, even if applied to software CDs. Do I give permission to any software vendor to install anything they want when I run the installer executable? Do I give them permission to wipe my hard drive? Install malicious, intentionally uninstallable programs? Monitor my activities when not using their software?

Even the most ardent proponent of EULAs couldn't make the claim that you give such permissions by default. Unless they specifically ask, they don't have permission to do anything that isn't specifically part of the product as a reasonable person would perceive it to be.

Re:Sony is protected by the DMCA

Even the most ardent proponent of EULAs couldn't make the claim that you give such permissions by default. Unless they specifically ask, they don't have permission to do anything that isn't specifically part of the product as a reasonable person would perceive it to be.

And the EULA doesn't mention this rootkit or anything like it, from what I've read. In my opinion, I have the right to create a secure environment for my data, and the rootkit subverts that. Since the EULA doesn't mention it, I'm free to remove unauthorized the unauthorized code.

Bad Sony! No biscuit!

Re:Sony is protected by the DMCA

They don't put it there. You do. They just packaged it for you. If you didn't want to give them permission to run arbitrary executables on your computer, then WHY DID YOU RUN THEIR EXECUTABLE??

See, the problem with this is you did not give them permission. You didn't even run their executable. It happened without your expectation, knowledge, or consent.

You popped in what you thought was a nice little audio CD. Because Microsoft has been configured to run the software on these CDs by default, you end up running it -- that's not permission. When you put in an audio CD, you expect to hear, well, music. Not to have something installed on your computer which compromises its security.

You can't say that someone accepted terms of use when Microsoft, acting in conjunction with these companies, decided that what needs to happen is that any CD with executable code on it needs to be executed blindly and without user confirmation.

For the vast majority of users, playing a CD in their computer is shockingly like playing a CD in their CD player. It is neither a tacit nor an explicit agreement to run any and all software they may have installed on it.

It is a complete mis-representation to claim that you gave permission for them to do anything they wanted to do with it. If I open my door to a solicitor, that doesn't give them the right to enter my home and do anything they damned well please.

This absurbd notion that what is, in effect, trojan software has been accepted by the user simply because they decided to play an audio CD in their computer is complete and utter tripe. And saying that you "should have known better" is a complete cop-out -- we already know that the vast majority of computer users simply lack the knowledge to prevent this sort of thing. Especially when the OS manufacturer has decided a priori for you that is what will happen.

Now, if they put in big honking letters on the CD case that if you play this CD on a Windows machine, software will be installed on your machine, your argument might have merit. But the simple fact that it is NOT spelled out in big font, means that, for all intents and purposes, this is a trojan.

Imagine extending this totally absurd argument to credit cards -- 'by handing your credit card to the waiter to pay your bill, you tacitly agree to paying for the staff trip to Aruba'; Oh, didn't know? How dare you? It's a bullshit argument in either case, because you imply consent where, clearly, none was given.

In either case, you show me where the user has actually agreed to anything, and your point might be valid. Otherwise, it's after-the-fact rationalization based on the absurd notion that the user knew what would happen.

Now, I realize as I'm writing this that your ID lists you as Andrew Tanenbaum -- so I'm forced to conclude one of two things -- 1) It's a popular, but misleading name on Slashdot, or 2) the Great Andrew Tanenbaum has absolutely no clue about what is reasonable for a company to do to the end-users machines. In either case, I'm not impressed. If 2), then you're just a standard Slashdot schmoe, and I expect nothing more, but you're still misinformed. If it truly is 1), then I've lost a great deal of respect for you -- because a professor of this stuff should know better, because you bloody well get paid to be informed about this stuff. Asserting that you somehow gave permission somewhere in that process is utter crap! An agreement I was never shown is null-and-void.

Cheers

_WHAT_ EULA?!?!

It's SUPPOSED to be a fucking AUDIO CD!!

Re:Sony is protected by the DMCA

Suing them IS trying to remove it, so suing them invokes the DMCA.

Legal Precedent in other forms

If I kill you to prevent you from killing me, killing you is self defense and not a crime. Seems reasonable that if I kill Sony's process to prevent it from stealing my ID that it's self defense and not a crime. The DMCA is one of those laws that is so out of whack, nevermind the US Constitution. It probably violates Brittish common law, the Magna Carta, and if you look hard enough it probably violates the code of Hammurabai and the social order of primitive hunter-gatherer cultures too.

Re:Sony is protected by the DMCA

I'll wager you a Coke against a Pepsi that Mark Russinovich's computer was password-protected. Sony deliberately and surreptitiously evaded that password protection to invade and change settings on Mark's computer. Tell me why he should not sue SONY for DMCA violation!

Re:My question:

You can always sue. The real question is: will you win? And even though IANAL, I'd say you have a pretty good case here; if the EULA does not even *mention* any of this, then it probably constitutes an illegal act.

Re:My question:

Actually this is a major limited access high speed expressway to seriously fuck with Sony.

It'll go like this: Somebody out there with an axe to grind against Sony is going to lift this code intact, with no modifications, and marry it with a worm that goes around and infects peoples machines with some nasty or other that executes with a file that has a name beginning with $sys$ and cause some real trouble with it.

Net result, the infected folks are going to have a SERIOUS beef with Sony over the fact that the "invisible" file was able to install itself and run its merry course completely under the radar. All because of a piece of shit attempt by a fucked up Giant Corporation that was attempting to further line its pockets by installing some ... shall we say, hmm, unsavory code?

Ok script kiddies, you have your assignment. Now get to work!

Re:My question:

I hereby offer $200 toward this goal.

Answer: This is truly evil

So should I sell all of my Sony stock, or buy more?

Seriously speaking, this shows two things. One is yet another demonstration of the fundamental evil of Microsoft's "security" model. Even if you weren't running as root/Administrator (and everyone does, don't they?), then the "reputable" installation from the "reputable" company would just ask you to elevate your privileges.

The other thing is that power is always abused. If not now and by Sony, then tomorrow by some other "reputable" company. (Or put on your tin hat and say "Yesterday by the NSA.")

I hope they track this story, and if it is not another misguided /. rumor, I certainly hope that Sony repudiates the technique and the software. Soon.

Then they should apologize.

Then sack the person responsible.

Then sack the person responsible for not sacking the responsible person earlier.

[Infinite loop warning.]

Re:Answer: This is truly evil

So should I sell all of my Sony stock, or buy more?

Offtopic, but..
If you think a stock will move but don't know in which direction, buy get and put options at the current price. They'll be in the money after any significant stock movement. Called a Long Straddle [riskglossary.com].

Re:My question:

The rootkit is by First 4 Internet [first4internet.co.uk]. It's possible that Sony simply purchased this DRM from this outside company, not realizing that the DRM contained a rootkit.

Still, one would hope that Sony would only choose reputable suppliers, ones who wouldn't allow a virus/trojan to be distributed intentially or even through neglect.

Re:My question:

And nobody at Sony bothered to vet a piece of software that was destined to be shipped with millions of CDs? It's beyond absurd that a company of Sony's size would allow a piece of software to appear on any of its products without Sony having tested the hell out of it first.

I think it's far more likely that Sony knew what this software did, and chose to distribute it anyway. This could have been a result of incompetent testers, poor communication between QA and management, overbearing management anxious to get a product out on a strict deadline, or any number of other things.

Re:My question:

> It's beyond absurd that a company of Sony's size would allow a piece of software to appear on any of its products without Sony having tested the hell out of it first.

You never played Star Wars Galaxies, did you?

Re:My question:

However, it might not protect them from a product liability suit. Simply put, if that had happened to me, I would have bought a new hard drive, reinstalled everything and then copied the data that I needed over, and then filed a product liability suit. I would claimed everything from illegal computer trespass, product liability, vandalism, and anything else that might have sounded half-way reasonable. The fact that a root-kit was installed on the computer to protect music shows that privacy now takes a second place seat to some one-else's property rights, when that person isn't even present. In this case one the music industry, if allowed to get away with it is violating privacy and property rights of another person in order to protect their property rights.

In democratic america...

corporations exploit YOU!

hrm, so much for humor. I don't find it funny at all :/

Re:In democratic america...

damn... you know it's getting scary when the soviet russia joke is not only unfunny, but frightening....

i don my tinfoil hat and robe...

Re:In democratic america...

i don my tinfoil hat and robe...

Wow, a tinfoil hat and robe! When do the pants and underwear come in? :)

However when you said "hat and robe", my first thought was of Bloodninja's cyber adventures [albinoblacksheep.com].

Re:In democratic america...

Or as Osama says: "I'm free - what about you?"

Re:In democratic america...

corporations exploit YOU!

Insightful indeed.

The thing is that there is more than a corporation here. The artist that chose to sign with Sony is now going to feel the repercussions of this dirty little trick Sony tried to play. Do you think that Sony really cares if they loose a few sales of this one CD because they got caught red-handed? Of course not.

These record labels are not only exploiting the consumer, but they are screwing over the artists that depend on them for advertising and distribution. Here is contact information [thevanzants.com] for Van Zant [thevanzants.com]. Let them know that you're pissed. Let them know you won't be buying their CD. Let them know that they were screwed by Sony. While you're at it, why not let First4Internet [first4internet.com] know that you hate them and hope they burn in Hell for writing malware like this. A few thousand emails will do wonders for these jerks.

If enough artists move away from these corporate labels it can only mean good things for the consumers. It's not impossible for this to happen, just extremely difficult.

Re:In democratic america...

Yeah, screw this. I'm never buying another cd again! I hear there's this concept on the internet called "file-sharing." With this technology around, why would people risk buying these dangerous cds? That'll teach Sony.

iTunes Australia and Japan

Sony still hasn't agreed to come on board with iTunes, which I find damn annoying. Everytime I search for an artist and don't find them (considering they're a big artist), I go and search for that artists publisher.. and what do ya know, always sony.

I'm really starting to hate that company. This BS "DRM" is just the icing on the cake. Sure, iTunes has DRM, but it's quite benign (5 computers, unlimited ipods, unlimited burns per song, 7 burns per album).

They're too big, and have their hands in too many pots. Time for Sony artists to take a stand and go with somebody else (quite difficult, considering the ass-raping contracts they probably had to sign). Essentially, Sony are denying their artists a source of income to satisfy the needs of their consumer electronics department. I'd be pissed.

Re:In democratic america...

In democratic America... corporations exploit YOU!

I've read two relevant quotes.

"Democracy is the theory that the people know what they want and deserve to get it good and hard."

"In communism, man exploits man. In capitalism, it's the other way around."