*******************************

UPDATE!

Sony XCP DRM - What does it mean to YOU?

*******************************

EDIT
-------------------------------------
A lot of people have asked me how to disable AutoPlay in Windows - details on this are at the bottom of the post.
-------------------------------------
Response to the announcement by Sony is here.
-------------------------------------

It would seem that the music industry is now sinking to new depths to keep the gear they install of people's PC secret - and all of this is done without the user's knowledge or consent. These techniques are more spyware tricks that how a legitimate company is supposed to operate. 

I have no reason to doubt Mark Russinovich of Sysinternals so I'm forced to conclude that these nasty techniques are in use by at least Sony and that users are seeing some major tinkering done to their system when they play these CDs on their PCs. What's worse is that if you try to undo this tinkering, things stop working!

The article is well worth reading and goes into some detail about detecting and removing these hidden tools using some powerful utilities.

I'm going to have to do some looking into this myself later ...

(via TechBlog )

Here's some more information on rootkits for you:

Wikipedia 

WhatIs 

Combatting rootkits 

Remove rootkits 

RookitRevealer 

Picked up by Bruce Schneier  and The Washington Post  and Ed Bott .

EDIT
-------------------------------------
Edited to add that this Sony DRM system is very dangerous to Windows Vista systems and seems to break the OS badly. Be careful!

To get this malware uninstalled you can fill in this form  on the Sony site, after which someone will call you and demand loads of answers to questions!

Also, if you want to be protected against CD installers the best way if to disable AutoPlay for the optical drives (AutoPlay is the feature that allows applications to be run when the disc is placed in the drive). Disabling AutoPlay is easy and prevents any program running automatically when you insert a disc in the CD or DVD drive. Details on how to do this are posted in the page "Disabling AutoPlay in Windows XP".

Secunia  now picks up on this:

Description:
A security issue has been reported in First4Internet XCP DRM software used to playback Sony copy-protected music CDs, which can be exploited by malicious, local users to hide certain actions on a vulnerable system from the Administrator.

The security issue is caused due to the "aries.sys" device driver hiding all files, registry keys and processes on the system that have names that start with "$sys$", regardless of whether the file is part of the XCP software. This can be exploited by malicious users and malware to hide files and processes from the Administrator by prefixing their names with "$sys$".

Solution:
Use another product.

• Immunization against the Sony uninstaller
• Removing the Sony rootkit without using the installer (PDF download)
• XCP/First 4 Internet information
• Secunia - Sony CD First4Internet XCP CodeSupport uninstallation ActiveX control vulnerability
• You can no longer uninstall Sony XCP DRM
• Sony DRM on 500,000 networks (oh, and another flaw discovered)
• Sony DRM code violates open source LGPL license and uninstaller opens a big security hole!
• Don't like the Sony rootkit? Don't run the uninstaller!
• December - Freak-out month for Sony music customers
• Removing the Sony DRM rootkit (and some good news from Microsoft)
• It’s MY PC!
• Second variant of the Sony DRM trojan detected by BitDefender
• SonyBMG DRM Customer Survival Kit
• Sophos releases tool to “detect and disable” cloaking for Sony’s DRM copy-protection
• Sophos to unmask Sony DRM
• Bot uses Sony DRM to hide on PCs
• The EFF on Sony-BMG XCP copy protection
• Sony installs hidden utilities when you play CDs
• It’s not just Sony that use rootkits …
• Sony patching copy-protected CDs … kinda
• BBC News picks up on Sony’s bad behavior
• Sony and CD standards
• Sony replaces rootkit DRM technology with non-rootkit technology
• Another thing that Sony needs to do

This entry was posted by the PC Doctor on Tuesday, November 1st, 2005 at 16:10 and is filed under Stay Secure, PC Doctor's Thoughts, Cartoons. Responses are currently closed, but you can trackback from your own site.