Sony Warned Weeks Ahead of Rootkit Flap

pdschmid writes "Business Week has an article describing how Sony BMG had been warned by F-Secure on Oct. 4 about the dangers of their rootkit protection, but failed to do anything until Oct. 31 when computer-systems expert Mark Russinovich revealed the rootkit in his blog." From the article: "Sony BMG officials insist that they acted as quickly as they could, and that they expected to be able to go public and offer a software patch at the same time. However, Russinovich posted his blog item first, forcing Sony BMG to scramble to contain the crisis. It recalled millions of CDs recorded by 52 artists, including Van Zant, Celine Dion, and Neil Diamond. Plus, it offered exchanges to customers."

What a load

[Microlith (54737)]

Scramble? To contain the crisis?

They almost never admitted what they had done, and continually denied the dangers posed by this rootkit.

They only started the recall after people pointed out repeatedly that their "uninstaller" didn't, and recieved criticism from the government.

"as quickly as they could" my ass.

Of course, they could have been smarter and never released it to begin with.

Don't forget Sony's other nasty DRM

[Old Man Kensey (5209)]

Lest we forget, Sony is still shipping CDs with SunnComm's MediaMax [ciocentral.com] DRM on them -- ten times as many as the XCP rootkit, in fact (that's 20 million CDs at last count, for those keeping score at home). It's still just as easy to defeat as it was in 2003 [slashdot.org], but if you make the mistake of letting it install like my wife did, it's fairly nasty. In particular it actually installs before you agree to the EULA -- the only difference between agreeing and declining is that if you decline, the software is not activated (but it remains installed).

If you have a device driver named Sbcphid.sys (which shows up as a hidden non-plug-and-play device named Sbcphid when active), you've got MediaMax and should remove it [cdfreaks.com].

Only the EFF [eff.org] has mentioned MediaMax in the various legal claims against Sony, and Sony has remained silent about it in public as well. Obviously they're not sorry about using DRM at all -- they're just sorry they got caught.

Sony made a rootkit?

[Winckle (870180)]

Why didn't Slashdot tell us before?!

Proves public disclosure is the best for security

[by Anonymous Coward]

Until a security hole is widely published (not privately communicated) it's very likely to continue spreading unchecked.

I think this is great evidence that early public disclosure is very important. At the minimum, the affected users can start using workarounds (turn off insecure systems) until fixes are available.

Re:Proves public disclosure is the best for securi

[Concerned Onlooker (473481)]

Until a security hole is widely published

I don't think this was a security hole so much as breaking and entering. I realize the players are different here but didn't Kevin Mitnick spend years in jail for stuff like this? I guess when a corporation hacks a consumer it's OK.

Re:Proves public disclosure is the best for securi

[Al Dimond (792444)]

I may be in the minority of /. readers: I don't really know the story of Mitnik. But if GP is accurate, he spent time in jail. You can't put a corporation in jail. $100,000 is a slap on the wrist; probably any fine that will be assessed is a slap on the wrist and probably is just a drop in the bucket of all the money that Sony will spend on legal matters in any given year. But if you fine a corporation enough to actually hurt it, a lot of innocent people lose jobs. So what's the solution to this?

The actual people that did the hacking were working for this "First4Internet" company. Anyone that designed, wrote or approved a part of the software deemed to be inappropriate could face jail time. There were people at Sony that approved this technology for use on CDs; they could face jail time. There were people at Sony that knew that their software included a rootkit and insecure kernel modifications, and yet claimed otherwise; they could face fraud charges (for an individual to say, "I am not a crook," is legal, but to knowingly lie about a product offered for sale is fraud). Anyone with much knowledge of the workings of this product should have known that it was illegal, just as Kevin Mitnik or any other cracker surely knows that whatever he does (like I said, I have no idea what it was that he did) is illegal. That would be equal justice.

Thats what happens...

[by Anonymous Coward]

...when a company becomes bigger than its customer base.

They shouldn't have recalled the CDs

[Pac (9516)]

Van Zant, Celine Dion, and Neil Diamond

They should have left the rootkit in place so we could download some good music directly to these misguided buyers' hard drives.

Still on the Shelves

[by Anonymous Coward]

Not only is Sony not moving fast, NY AG Elliot Spitzer reports that affected CDs are still being sold at various retail outlets. I'm not sure how much control Sony has over recalling CDs at some Wally World in Drum Nebraska, but this snafu puts them right up there with Adobe in corporate arrogance and stupidity.

If this is true...

[julesh (229690)]

If this is true, then sony just lost them court cases we've been hearing about. Having been told about it and not issued a product recall at the earliest opportunity (i.e. within a day or two) means that they were intentionally subverting people's computers.

The only defence available to them was that they didn't realise this was happening. They've just lost that.

Impressions

[A beautiful mind (821714)]

When the Sony rootkit case first hit the news, I considered F-Secure to be quite good for an anti-virus company because they were reasonably quick adding the rootkit to their signature file.

They've just lost that credit for me. They knew for a month and were sitting on it! That is not acceptable. There should have been no warning to Sony, just a public statement from F-Secure at the beginning of October about the rootkit.

Re:Impressions

[Tmack (593755)]

Its called proffesional courtesey. If they immediatly notified the public, there would have been an exploit that many days sooner, before ANY action could be taken to fix it. This is the same as any MS or other exploit. Once a firm knows about it, they notify the software's management to fix it and wait a few days to release the news to the public. That gives the developers time to at least create a patch to prevent any further damage. Is it F-Secure's fault Sony did something stupid in the first place? Are you going to blame Semantic on the next exploit they find, tell microsoft about, and wait a few days before alerting the public? How about the IE bug just moved to cirtical status thats been around for many months, is that to be blamed on Secunia? They knew about it since june and waited until this weekend to escalate it to critical, only after a proof of concept was released.

Its easier to prevent a fire by notifying management to fix the sparking wires than to put one out after notifying a world full of pyros to come dump gasoline on it.

tm

Re:Impressions

[by Anonymous Coward]

This isn't the equivalent of a bug in IE. Sony deliberately infected their customers' computers with malware. Sure it was buggy malware but that's hardly the main issue. If you see a Sony executive breaking into someone's house, would you let the Sony exec know so that he could have a month to fix the problem before anyone else found out?

Re:Impressions

[A beautiful mind (821714)]

Someone mod parent up.

The difference between a Microsoft security issue and the Sony rootkit is earth and sky.

If F-Secure would have identified a flaw in Microsoft's software, then it's ok if they give the company a grace period to get a patch ready.

There was no such patch to be prepared in the case of Sony.

The following things are sensible to be done when someone finds a new rootkit spreading in the wild:

• Identify it's source [Sony DRM on cd's - CHECK]
• Find a way to stop the infections/prevent further infections - this can be only done by forcing Sony to stop shipping infected cds - a public disclosure is essential. Also adding the rootkit to the signature file is required. [FAIL]
• Clean up the infections - most anti-virus companies write even small utilities to remove rootkits/viruses/trojans. [???]

Let's face it: By telling Sony about it and not going for public disclosure F-Secure accomplished nothing but let even more users get infected by this rootkit. Sony is not a software company, there wasn't a flaw in a software that needed to be fixed, but the software itself removed! That requires no cooperation on behalf of Sony.

Full Disclosure is Hard

[Daedala (819156)]

I disagree. I think F-Secure did great. I also think Mark Russinovich did great.

I think that it would have been much better if the news could have broken with a worken, well-engineered patch. This is always preferable. F-Secure was trying to make this happen. A month is not a long time. Yes, a lot of people were infected in that month; but a lot of people were infected anyway. F-Secure did a right thing.

On the other hand, Russinovich also did a right thing. This software was not a mistake; it was deliberate. People were getting infected and had no idea. Clearly, people should know about this. Clearly, the corporation did not give a rat's ass about their users.

I like responsible full disclosure: give the maker time to fix it, and publish with a patch when possible. But don't allow eternal "patch development," and make sure disclosure happens. There is room for disagreement among people of good will and high ethics.

Sony need not apply to that group,though.

recalled?

[wazzles (729440)]

It recalled millions of CDs recorded by 52 artists, including Van Zant, Celine Dion, and Neil Diamond. CDs by these artists should have been recalled anyway, rootkit or not.

Obligatory

[LilJC (680315)]

"I'm a recall coordinator. My job was to apply the formula. It's simple arithmetic. It's a story problem. A new car built by my company leaves Boston traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now: Do we initiate a recall? You take the number of vehicles in the field (A) and multiply it by the probable rate of failure (B), multiply the result by the average out-of-court settlement (C). A times B times C equals X. If X is less than the cost of a recall, we don't do one."

Re:Obligatory

[nb caffeine (448698)]

What car company do you work for?

Re:Obligatory

[Minwee (522556)]

Now a question of etiquette. In response to your post, do I give you the ass or the crotch?

As quickly as they could?

[Jerry Coffin (824726)]

Sony BMG officials insist that they acted as quickly as they could,

In this case, "as quickly as they could" seems to really mean "as slowly as they could get away with."

How long is it going to be before these companies realize that attacking their customers and treating them like criminals really is NOT a good way to do business? Microsoft's "product activation", Sony's rootkit, etc. ad naseum do essentially nothing to stop real hackers from copying software, music, etc., as much as they want, so the only thing they really accomplish is hurting the legitimate customers.

These lousy business practices are reflected in their (lack of) sales too. I don't mean to say a boycott of Sony would necessarily be a bad thing, but for those who haven't looked, take a look at Sony's stock prices [yahoo.com] -- boycott or no, they're not exactly burning up the charts right now.

Now, Sony (etc.) will undoubtedly point to Napster and such as the reason they're not doing as well recently. I don't think that's the case. I think what's happened is that Sony is now concentrating more on forcing customers to pay than they are on producing things customers want. As is visible in their stock price, that simply leads to oblivion, not prosperity.

--
The universe is a figment of its own imagination.

Scrambling to contain the crisis

[digitaldc (879047)]

Phony Sony put its CDs on a shelf
Phony Sony had a rootkit which installed itself.
But all of Sony's lawyers and all of Sony's PR men,
Could not put the integrity back into Sony again.

Yeah...

[penguinbrat (711309)]

""Most people, I think, do not even know what a Rootkit is, so why should they care about it?"

You can just hear the urgency can't you...

Another possibility exists...

[bigtallmofo (695287)]

So Sony was lying its collective arse off when saying it reacted as quickly as it could?

That they were lying is one possible explanation. Looking on the bright side, another possibility is that they're just incompetent.

Re:Another possibility exists...

[Vengeance (46019)]

That they were lying is one possible explanation. Looking on the bright side, another possibility is that they're just incompetent. OK, OK, let's keep politics out of this discussion.

Re:So corporations still lie....

[by Anonymous Coward]

I tried submiting this to Slashdot but apparently the editors didn't find it newsworthy.

http://www.benedelman.org/news/112105-1.html [benedelman.org]
http://www.downloadsquad.com/2005/11/23/sony-could -use-xcp-to-protect-its-customers-but-wont/ [downloadsquad.com]

Sony could use XCP to protect its customers, but won't

Spyware researcher Ben Edelman says that XCP, the software at the heart of Sony's rootkit fiasco, could also be used to inform Sony's customers that their computers have been compromised. Sony doesn't know whose computers are infected by their rootkit, but the XCP player software includes code for automatically fetching a banner from Sony's servers. Sony could easily use this to display a recall notice to the rootkit's victims, but are they going to? I seriously doubt it. While the whole affair has been gaining more and more traction with the media, Sony knows that the majority of its customers will never hear about any of it, and they want to keep it that way. While their recall was intended to be viewed as a good-faith gesture (and, indeed, there may be some actual good faith in there somewhere), the last thing Sony wants is for every Switchfoot fan to know how badly their record company screwed up their computer.