Rootkit woes for Sony again?

Remember the hubbub over Sony BMG Music Entertainment's rootkit debacle, involving its CDs?

Well, another arm of Sony, this time Sony Electronics, may face a little of the brouhaha, as well.

According to a blog posting Monday by F-Secure, Sony's Micro Vault USM-F thumb drive comes with software that contains a rootkit.

For those who missed out on the Sony BMG fiasco, a rootkit is a tool that can cloak the presence of certain files or processes and prevent users from performing certain tasks on their computer. While Sony BMG used the rootkits as a means to prevent the pirating of their artists' work, it also had the potential side affect of allowing attackers to hide their malicious software if it made its way onto users' systems.

F-Secure says Sony's Micro Vault USB drive fingerprint reader software installs a driver that hides a directory under "c:\windows\". As a result, that directory and the files within it don't show up in the Windows API, when trying to count files and subdirectories.

It's an ironic twist, considering fingerprint readers are designed to add another lay of security.

"It is our belief that the Micro Vault software hides this folder to somehow protect the fingerprint authentication from tampering and bypass," F-Secure's blog posting notes. "However, we feel that rootkit-like cloaking techniques are not the right way to go here."

The security firm also notes that when the Sony BMG rootkit debacle flared up in 2005, malicious software with rootkits was not pervasive. But over the past two years, a number of malicious versions have popped up that include rootkit cloaking techniques.

UPDATE

Users who are out shopping for a Sony Micro Vault USB this year won't have the same problem, said a Sony spokesman. He noted that the USM-F version was discontinued last year and it was the only Micro Vault that came with a fingerprint reader feature.

[protagonistic]

RE: Rootkit woes for Sony again?

Greed trumps common sense every time. I have not purchased
another Sony product since the las fiasco and this just reinforces
my feeling that I was right.

[superman227]

Same here

I'm happy with owning only an old Playstation and ancient cds I don't play.

[Rants&Raves]

Dubious reporting, slippery definitions

A "rootkit" isn't an application that hides itself or part of itself as a self-defense mechanism; by that standard, large swaths of Windows, most good anti-virus products, quite a few firewalls, even Sarbanes-Oxley compliance tools would be rootkits. I do not know who this reporter is, but it seems to be that he uses words he does not understand.

Here's a better definition: A root kit is a set of tools used by an intruder after cracking a computer system. These tools can help the attacker maintain his or her access to the system and use it for malicious purposes.

1. There's no cracking here; I'm sure the license agreement is very precise on what this software will or won't do.
2. There's no permanency; I'd bet the software has an uninstall tool.

moreover

3. There is no malicious intent !

Now you can try to argue that the driver itself may (who knows ?) have flaws that would allow any unrecognized applications to live under this hidden folder. Three things: a) if Windows can't find it, and the malicious file riding the door left open by the driver does not have the collaboration of the driver to let Windows find it, then it won't load, period. b) Did you obtain a disassembly of the code, or did you just guess that it may bring in vulnerabilities "cuz you never know" ? c) If the driver uses the most common types of cloaking, the cloaking will only be truly effective against nefarious software; good anti-virus software, with their greater legitimate access to a system and far greater testing and implementation resources, will locate all the files in this hidden folder in case static data is of concern to you.

This is either sensationalistic reporting, or some guy who really has no clue what he is talking about.

[markdoiron]

I Don't Like Your Definition Either

I don't like your definition. I prefer this better explanation, which disagrees with some of the basic tenets in yours, and more closely aligns with that given by the author:

http://en.wikipedia.org/wiki/Rootkit

--mark d.

[Rants&Raves]

Then don't quote the page I took the definition from !

I took that definition from that very same Wikipedia article that you cite; that definition is also pretty much in line with what you'll find in the book by the same name.

You have not established any arguments to tell us how you think your understanding differs from mine, though; that make sit difficult to figure out what your contention is.

[markdoiron]

Why I Don't Like Your Definition

I thought you'd read the article and save me the trouble. But here:

You complain that a root kit's doesn't hide itself for self-defense. But from the Wikipedia article:

"A rootkit's purpose is typically to hide files, network connections, memory addresses, or registry entries from other programs used by system administrators to detect intended or unintended special privilege accesses to the computer resources."

You complain there's no cracking. Then I guess the Sony/BMG root kit isn't a root kit by your defintion. But, referring to the Wikipedia article again:

"Rootkits are not always used to attack and gain control of a computer. Some software may use rootkits to hide from 3rd party scanners to prevent detection or tampering. Some emulation software and security software is known to be using rootkits."

You complain about a lack of permanency and presume a removal tool. Yet, two applications that use rootkits cited in the Wikipedia article include Alcohol 120 and Daemon Tools, commericial app's that I'd bet a dollar to a donut have removal tools (a much safer bet than anything from Sony having one, if history is any indication!).

--mark d.

[ElmoKajaky]

Sony owns SecuROM, doesn't it?

http://forums.2kgames.com/forums/showthread.php?t=5527

[alexab99]

sony micro vault

I have a Sony Micro vault usb memory device.
I worked for about a month and then "failed".
I was unable to access it as a drive.
It would not reformat.
Any advice appreciated.