- Related Stories
-
Sony recalls risky 'rootkit' CDs
November 15, 2005 -
FAQ: Sony's 'rootkit' CDs
November 11, 2005 -
'Bots' for Sony CD software spotted online
November 10, 2005 -
Sony CD protection sparks security concerns
November 1, 2005
Websense's
Websense has uncovered only a couple of Web sites set up to attack flaws in the initial uninstall program, and the damage they cause appears to be minimal so far. One of them, hosted in the United States, simply restarts infected computers.
affect the label's policies.
"It's someone trying to make a point," said Dan Hubbard, senior director of security and technology research at Websense. "They could have done a lot worse."
Sony became embroiled in controversy earlier this month after the record label was discovered to be
The company also released programs to uninstall the rootkits, but the initial Web-based version has its own set of flaws, Princeton University computer science professor Ed Felten wrote in his blog Tuesday.
In the case of the U.S.-hosted malicious site, the attacker may have compromised the site without the owner's knowledge, Websense's Hubbard said. The site appears to be associated with Canada's version of the American Idol TV show. Websense also found the following message in the site's malicious code: "Sony DRM Christmas Gift." DRM stands for digital rights management, a type of copy-protection technology.
"Any user who has downloaded and run the Sony uninstaller program is susceptible to this attack," Websense said in a statement.
A Sony BMG representative did not immediately respond to inquiries about the alert.
However, in response to concerns about the security of its uninstall software, Sony has removed the program from its Web site, and
"We currently are working on a new tool to uninstall First4Internet XCP software," the Sony site now reads. "In the meantime, we have temporarily suspended distribution of the existing uninstall tool for this software. We encourage you to return to this site over the next few days."
The flaw in Sony's uninstall software was based on an ActiveX progam installed on hard drives, which allowed Web sites to run malicious code automatically in the Internet Explorer Web browser. Some security experts are advising people who think they might have used Sony's uninstall tool to use the Firefox Web browser, which does not support automatic ActiveX controls.
Princeton computer science professor Ed Felten and researcher Alex Haldeman have created
See more CNET content tagged:
Websense Inc.,
rootkit,
Sony BMG Music Entertainment,
Sony Corp.,
digital-rights management
****, any ports I could block?
This product is Star Wars Galaxies, by SOE. Is it possible for me
or anyone else to confirm that Sony has the copy protection
devices installed on my computer?
If so, I would appreciate an explanation of the removal
procedure, barring a total system sweep. I would also like to
know exactly what kind of infringement this is on Sony's part.
This sounds pretty illegal to me. I am going to read the liscence
agreement one more time, but I am intent upon setting this
right.
boycot blu-ray? Over HD? Are you kidding me?
HD DVD has a fraction of space compared with Blu_ray, and blu-ray
has backwards capability - unlike HD.
I can understand not buying sony - but not supporting bluray
because of this is dumb.
It's funny, I had a friend that had a sony music cd with drm and I almost allowed him to put in in my machine, but I stopped him before he got to do it.
We listened to the music through my dvd player hooked up to my dvd.
Yeah, right!!!
http://cp.sonybmg.com/xcp/english/updates.html. The .exe is dated 11/08/2005 version 1.0.1.14. Sony's statement reads:
"SOFTWARE UPDATES/ PLUG-INS
November 8, 2005 - This Service Pack removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs. To alleviate any concerns that users may have about the cloaking component posing potential security vulnerabilities, this update has been released to enable users to remove this component from their computers."
Additional info about Sony BMG:
CEO: ANDREW LACK
Sony music labels:
Arista Records
BMG Classics
BMG Heritage
BMG International Companies
Columbia Records
Epic Records
J Records
Jive Records
LaFace Records
Legacy Recordings
Provident Music Group
RCA Records
RCA Victor Group
RLG - Nashville
Sony Classical
Sony Music International
Sony Music Nashville
Sony Wonder
Sony Urban Music
So So Def Records
Verity Records
I am glad that you all are interested enough to read this.
Today I was reading up on this sony problem again. This time in the washington post. Here is an excerpt from it that really caught my attention:
Sony BMG's latest moves have not erased its legal and public relations troubles. Last week, an attorney in California filed a lawsuit seeking damages for residents who bought the defective CDs, and on Monday, a lawyer in New York filed a nationwide class-action case against the company.
Mark Russinovich, chief software architect at Sysinternals, the security expert whose initial research into the anti-piracy program sparked the controversy, welcomed the class-action suits, saying withdrawal of the software wasn't enough.
"What I'm most concerned about is: If nothing serious happens to Sony that's visible to other companies, then we run the risk of this kind of thing becoming standard corporate behavior," Russinovich said.
This last paragraph says a mouthful. Ok, so now we had to deal with this crap from sony, but they may be only the tip of the iceberg. We as consumers need to use our backbones and show not only sony, what we think of this play that they seemed to think was "not so serious", but also as a warning to other companies who just might get it in their head to follow suit, that we are not going to stand for this sort of behavior.
Personally, this did not happen to me, but I do not condone this sort of thing from any company. To those that it did happen to, I hope that you get back the normalcy that you had before sony did this to you.
Stand strong together people and put sony where they belong--out of business. Do not buy anything from them or from any company affilliated with them. Phillips is one. Boycott them. This will get the bad apple out of the barrel and let all the other apples know what is gonna happen if they try something like this.
For the full story from the washington post newpaper the link is:
http://www.washingtonpost.com/wp-dyn/content/article/2005/11/16/AR2005111602242.html
Have a good day all
Esk
I dont want a new version of Sony's virus, I don't think anyone does, if Sony had any idea of how to even start to make things right, they would remove the software, 100% and try to win back the population that knows of their evil.
the 60s with every thing from Vinyl records to 8 track reel to reel,cassette's, CD/DVDRW's including the software.
This is why we have antitrust laws, Sony should be forced to divest itself from 1 of these industries.
It's trying to control the entire dying market,with
lawsuits, malicious software and attacks on 3rd party software providers (check Lame dll)
Foreign Corporations running our lives.
Elwood Blue