Manage updates with the Download App
November 14, 2005 8:58 AM PST
Sony 'rootkit' prompts office clampdown on CD use
- Related Stories
-
Microsoft will wipe Sony's 'rootkit'
November 13, 2005 -
Will Sony's DRM nightmare affect future policies?
November 12, 2005 -
FAQ: Sony's 'rootkit' CDs
November 11, 2005 -
Sony halts production of 'rootkit' CDs
November 11, 2005 -
Are these the Sony rootkit CDs?
November 10, 2005 -
Antivirus firms target Sony 'rootkit'
November 9, 2005 -
Sony CD protection sparks security concerns
November 1, 2005
Last week, Trojan horses emerged that avoid detection by using the digital rights management, or DRM, software used by Sony BMG Music Entertainment on some of its audio CDs. This software uses the same techniques used by rootkit malicious software to hide itself from the operating system, which makes it particularly difficult to detect.
Andrew Yeomans, vice president of global information security at Dresdner Kleinwort Wasserstein, said that he is already assessing whether the Europe-based investment bank needs to tighten up its controls.
"I'm reviewing the autorun settings for music CDs, but not planning to ban their use," Yeomans said. "We certainly don't want arbitrary software to be installed."
Yeomans added that the bank cannot prevent all its employees from running executable programs from a CD or download. That's because some people have to be given administrator rights to use certain applications, which would allow them to override such restrictions.
Richard Starnes, president of the Information Systems Security Association, said that other companies should consider whether they need a policy on CD use.
"This is certainly something that would trigger a review of policies. I would advise companies to review the situation," Starnes said.
"If it's solely a Sony issue, it is easier for a company to make a decision that it will not allow particular Sony CDs. But if it becomes widespread, then it becomes difficult to decide what CDs are allowed or not allow," added Starnes, who was speaking before Sony announced it had stopped producing CDs containing the rootkit-like software, called XCP.
Other companies have confirmed that they are also watching the situation closely.
"Something that can get in and hide itself would have the security people screaming their heads off," said the capacity manager at one major financial firm, who asked to remain anonymous.
"Up until now, they thought that audio CDs are safe. I think that will change, and I wouldn't be surprised if every major bank changed their policy. The fact that this software can be used to hide other stuff means that the possibilities for getting at customer data are horrendous," he added.
Opposition to Sony's behavior has been fierce, with threats of boycotts and even legal action.
Ingrid Marson and Graeme Wearden of ZDNet UK reported from London.
42 comments
Join the conversation! Add your comment
And the sky is also falling...
Remember that when some dweeb uses the rootkit to plant a Trojan on your PC, steals your banking info, and drains your account.
I have to assume you are trying to be funny, because the rootkit problem is serious. In any event, Sony has unleashed a situation where my data is at risk.
What do you find questionable about that scenario?
Since then Sony has put up a statement saying they "deeply regret" the inconvenience caused by this.
The next time something like this happens it's up to the little people to make their voices heard. If enough people complain, their ideas of what is acceptable behavior will change.
I happen to like Sony products a lot and won't change my views on their other products, but stupid decisions like these should be challenged.
Sony created the incompatibility and expects Apple to fix Sony's flawed, poorly-designed implementation. Moreover, Sony has the gaul to redirect users to Apple's iTunes website, rather than provide a fix for it's XCP DRM.
Buy nothing Sony!
I managage a small network of 60 PC's and keep up its Intranet. All users know of Sony's breach of consumer trust and security recklessness on our intranet.
I took a new Sony CD / DVD player back to the retailer on Sunday. I have two Sony TV's and an Amp - the old Amp and 1 TV will be replaced before xmas but not with Sony. I have blank Sony media, CD's DVD's floppies - never to be purchased again. I also consult for other small busness and home consumers - 2 have been disuaded from buying Sony Vaio PC's.
I mananage a small website which gets just 3000 unique visitors a month. All visitors can read my review of Sony's irresponsible behavior
And still the infected CD's stay on the Retailers Shelves. The CD's should be recalled
Auto-Play is one of the "features" I turn off when I do a fresh Windows install. Everything from music CD's to game demo disks want to run a piece of code these days; better to not trust any of it.
I wonder what will happen to the brain donor Sony executive that authorized this disaster, now that many sources are stating that the only safe way to acquire Sony music is to download it.
The Sony XCP approach patches Windows's CD driver software. What happens when another copyright owner uses a similar, though incompatible, driver patch? Who's responsible for driver incompatibly with other software -- certainly not Microsoft? Who does the user or administrator contact to resolve the incompatibilities? Moreover, how does the user even know Windows has been patched in this way? Do copyright-protected CDs included free software tech support?
I certainly understand that a business would ban all CDs rather that attempt to identify which ones might cause problems. The situation is a nightmare for system administrators in a business environment!
mark d.
-Sony Recalls ALL Root kit "infected" CDs
-Has on their website an uninstalled option on there main page, with NO emails or "HOOPS" one has to jump through to get it (NOT providing information to get it).
-Offer FULL refunds to anybody that wants to return his or her infected CD
-Publicly admit they made a mistake, and should have not installed software without an "FULL UNINSTALL OPTION" and not notified the consumer about the "hacker" technology being installed.
-Revised their EULA so that paying consumers actually own the CD content they purchased, and INCLUDE "Fair Use" provisions.
-Bend over backwards in offering goodwill gestures.
Boycott for at least 6 MONTHS until they listen, take notice, and comply with these reasonable provisions. If not take another six months.
TELL YOUR FRIENDS&
POST IT AT CAMPUS&
POST IT AT WORK&
BLOG IT&
DIGG IT&
Your almighty DOLLAR is what SONY listens to, make it count;
curtail your SONY purchase, buy another brand.
Other companies will think twice before they violate consumers choice, privacy and security.
This is the flash point&this is the last straw&
SPREAD THE WORD&
Tell SONY why you are not buying from them and tell them why
here
<a class="jive-link-external" href="http://www.sonymusic.com/about/feedback.cgi" target="_newWindow">http://www.sonymusic.com/about/feedback.cgi</a>
NO SONY ITEMS FOR CHRISTMAS
Sony should therefore RECALL and REPLACE FREE all of the FrankenSony DRMed discs.
Secondly, the privelege of listening to music at work has to be taken away, not because of abuse but because of Sony's actions. It's just like when you forbid a child from playing with a friend who is a bad influence. The actions of someone else sometimes have drastic consequences affecting large groups of innocent bystanders.
All of the Sysadmin headaches that this opens up, combined with Sony's lack of a solution to remove, disable, and insure no reinstallation made the decision for the Sysadmins. Sysadmins must be concerned with their computers and networks, not the employees ability to listen to Barry Manilow.
Just like I had to wait until I was 21 (instead of 18, like my parents), to buy alcohol, because of drunkdrivers, these employees cannot listen to music CD's at work, because of Sony. Besides, if music is that important to them, they can stay home.
I ,and countless millions of others like me, listen to music at work almost everyday (though certainly not Barry Manilow!). A great many of us are probably calmer and more productive because of this, that is until Sony pulled this crap (I'm a sysadmin). Are you trying to insinuate something with this line of questioning?
The whole point here is that Sony screwed up BIGTIME, not that people who listen to music at work are somehow slackers.
Furthermore, yes Admin really has no choice but to take this priviledge away from their employees because of Sony's reckless, immoral, and possibly illegal activities.
One thing I think we have learned from P2P is that you can be liable for how you market your software. Did the creators of the rootkit market it as safe? Did they tell Sony that it software uses techniques of hackers? How did the company market it to Sony?
I'm not taking Sony's side or trying to pick on the company that create the software. I just think that they should go after all culpable parties.
<a class="jive-link-external" href="http://www.idiotabroad.com/2005/11/cds-affected-by-the-sony-bmg-spyware/" target="_newWindow">http://www.idiotabroad.com/2005/11/cds-affected-by-the-sony-bmg-spyware/</a>
I pity the person or organisation who would take such risk to protect their ends. . .
entirely Mac-based network and I was wondering if we are immune
to this flaw. As far as I know, autostart music CDs don't "autostart"
on a Mac. Thanks in advance.
I personally do not want MY bank to be allowing employees to put MY data and money at risk merely so the employee can enjoy their favorite CD!
Does it suck that companies may now be forced to deny their employees what has, up until now, been a normal daily activity? Yes it does! But us employees need to remember to put the blame where it belongs:
ON SONY!
"Most" people may not have known what a rootkit is, and "most" people may not care to know the details of what it is. But "most" people will sure be mad as hell that they can't listen to music at work anymore!
And this isn't just about CD's.... think about the other Sony software you install (and have installed via firmware and drivers) these cannot be trusted either!
Sony has been totally irresponsible, first by using a sneaky, cheating rootkit kind of copy protection, second, by not owning up to the extent of where it put this kind of copy protection, and third, by not recalling all of the products as soon as the knowledge of its misdead became public,
I hope many people BOYCOTT ALL kinds of Sony products - hardware, music, videos, etc.
Maybe loosing sales and profit will teach Sony to be a socially responsible company!