Comments on: Rootkit woes for Sony again?

Security researcher points to rootkit found in fingerprint authentication software in Sony's Micro Vault USB drive.

[protagonistic]

RE: Rootkit woes for Sony again?

Greed trumps common sense every time. I have not purchased
another Sony product since the las fiasco and this just reinforces
my feeling that I was right.

[superman227]

Same here

I'm happy with owning only an old Playstation and ancient cds I don't play.

[Rants&Raves]

Dubious reporting, slippery definitions

A "rootkit" isn't an application that hides itself or part of itself as a self-defense mechanism; by that standard, large swaths of Windows, most good anti-virus products, quite a few firewalls, even Sarbanes-Oxley compliance tools would be rootkits. I do not know who this reporter is, but it seems to be that he uses words he does not understand.

Here's a better definition: A root kit is a set of tools used by an intruder after cracking a computer system. These tools can help the attacker maintain his or her access to the system and use it for malicious purposes.

1. There's no cracking here; I'm sure the license agreement is very precise on what this software will or won't do.
2. There's no permanency; I'd bet the software has an uninstall tool.

moreover

3. There is no malicious intent !

Now you can try to argue that the driver itself may (who knows ?) have flaws that would allow any unrecognized applications to live under this hidden folder. Three things: a) if Windows can't find it, and the malicious file riding the door left open by the driver does not have the collaboration of the driver to let Windows find it, then it won't load, period. b) Did you obtain a disassembly of the code, or did you just guess that it may bring in vulnerabilities "cuz you never know" ? c) If the driver uses the most common types of cloaking, the cloaking will only be truly effective against nefarious software; good anti-virus software, with their greater legitimate access to a system and far greater testing and implementation resources, will locate all the files in this hidden folder in case static data is of concern to you.

This is either sensationalistic reporting, or some guy who really has no clue what he is talking about.

[markdoiron]

I Don't Like Your Definition Either

I don't like your definition. I prefer this better explanation, which disagrees with some of the basic tenets in yours, and more closely aligns with that given by the author:

http://en.wikipedia.org/wiki/Rootkit

--mark d.

[Rants&Raves]

Then don't quote the page I took the definition from !

I took that definition from that very same Wikipedia article that you cite; that definition is also pretty much in line with what you'll find in the book by the same name.

You have not established any arguments to tell us how you think your understanding differs from mine, though; that make sit difficult to figure out what your contention is.

[markdoiron]

Why I Don't Like Your Definition

I thought you'd read the article and save me the trouble. But here:

You complain that a root kit's doesn't hide itself for self-defense. But from the Wikipedia article:

"A rootkit's purpose is typically to hide files, network connections, memory addresses, or registry entries from other programs used by system administrators to detect intended or unintended special privilege accesses to the computer resources."

You complain there's no cracking. Then I guess the Sony/BMG root kit isn't a root kit by your defintion. But, referring to the Wikipedia article again:

"Rootkits are not always used to attack and gain control of a computer. Some software may use rootkits to hide from 3rd party scanners to prevent detection or tampering. Some emulation software and security software is known to be using rootkits."

You complain about a lack of permanency and presume a removal tool. Yet, two applications that use rootkits cited in the Wikipedia article include Alcohol 120 and Daemon Tools, commericial app's that I'd bet a dollar to a donut have removal tools (a much safer bet than anything from Sony having one, if history is any indication!).

--mark d.

[ElmoKajaky]

Sony owns SecuROM, doesn't it?

http://forums.2kgames.com/forums/showthread.php?t=5527

[alexab99]

sony micro vault

I have a Sony Micro vault usb memory device.
I worked for about a month and then "failed".
I was unable to access it as a drive.
It would not reformat.
Any advice appreciated.