Sony's 'secret' stirs trouble

[icecoolz]

San Jose - After a chorus of criticism, Sony Corp's music division said it is distributing a free software patch to reveal hidden files that automatically installed to hard drives when some of its music CDs were played on personal computers.

The offending technology was designed to thwart music piracy.

Sony BMG Music Entertainment and its partner, UK-based First 4 Internet, said on Wednesday they decided to offer the patch as a precaution, not because of any security vulnerability, which some critics had alleged.

"What we decided to do is take extra precautionary steps to allay any fears," said Mathew Gilliat-Smith, First 4 Internet's CEO. "There should be no concern here."

The controversy started on Monday after Windows expert Mark Russinovich posted a web log report on how he found hidden files on his PC after playing a Van Zant CD. He also said it disabled his CD drive after he tried to manually remove it.

Russinovich made the discovery while running a program he had written for uncovering file-cloaking "RootKits". In this case, the Sony program hid the antipiracy software from view. Similar technology also has been used by virus and worm writers to conceal their code.

A firestorm quickly erupted over what appeared to be an attempt by the music company to retain control over its intellectual property by secretly installing hidden software on the PCs of unsuspecting customers.

Making matters worse, Sony did not disclose exactly what it was doing in its licence agreement, Russinovich said. It only mentions that proprietary software to enable copy protection would be installed. The software affects only PCs running the Windows operating system.

Read more here:

*www.news24.com/News24/Technology/News/0,,2-13-1443_1828225,00.html

Not good news if you ask me. I have a right to know what my system contains. And also this software can be manipulated by other trojans and worms to hide themseleves, which I def do not like... Looks like were headed for rocky shores...

 

[digen]

Yeps thats something to ponder about.But if it were me writing a article about the recent happenings I would put it as "Sony sells Rootkits too !"

 

[Apollo]

In my hurry, I created a new thread in this section to report this same thing which was highlighted in the newspaper that I read. I'll add it in here instead...

Source: *epaper.hindustantimes.com

WELCOME, MUSIC fans, to a new age of anti-consumer paranoia. In case you hadn't heard, Sony BMG, a record label with almost 22 per cent of the global market in CD sales, has admitted to hiding potentially dangerous anti-piracy software inside people's computers.

Having been busted, Sony BMG has apologised, launched a recall of CDs containing the cloaked programme, and offered to remove it from any infected hard drives. But the Texas attorney general is suing Sony BMG, anyway, under that state's new anti-spyware law. Even the US department of homeland security slapped the company: An advisory from the department's US computer emergency readiness team says the software "can pose a security threat." Other than that, Merry Christmas.

How did this happen? If you bought, say, the new Neil Diamond album or any one of 51 other recent titles put out by Sony BMG, and you loaded the disc on to your computer, it started out by installing a visible and openly declared piece of software, called XCP for "extended copy protection," on your hard drive.

That programme in turn would have launched a digital music player, sort of a mini-jukebox -- not unlike WinAmp -that plays the CD's songs on the computer, helps you transfer the tracks to portable music devices and lets you make a limited number of copies to blank CDs to share with your friends.

Convenient, right? Helpful, yes? To a point. Here's what the fine print doesn't say:

-- XCP also contains something that, in software circles, goes by the rat-like name of "rootkit." This chunk of code sinks deep into a computer's hard drive and conceals itself by acting like part of the computer's core operating system.

-- According to the Austinbased computer scientist who uncovered it last month, the rootkit resisted efforts to remove it -- enough to damage a computer -- until Sony BMG provided a software fix.

-- The rootkit, even when left alone to go about its business, can degrade the overall speed and performance of your computer and its other programmes.

-- The rootkit opens a digital window into your Internet-connected computer, through which a malicious code-writer may climb in order to steal data, corrupt programmes or otherwise get control of your machine.

-- The rootkit could, in theory, quietly send data stored on your hard drive to Sony BMG.

All of which basically makes the rootkit a piece of corporate spyware -- unmentioned in the licencing agreement and secretly foisted on people buying CDs.

Sony BMG and the British company that invented XCP, First 4 Internet, said they were not spying on their customers and never intended to compromise anyone's computer security. The wormhole, they explained, was an unintended side effect of an otherwise lawful and well-intended effort to limit CD copying and online song-sharing, and to protect the intellectual property rights of the musicians.

The odd thing is, neither company has spelled out why, exactly, the copy-protection software needed a covert component and what, exactly, that component is doing on the computer's hard drive. Why the `bonus'?

Maybe the lawsuits will tell us more. In the meantime, visit sonybmg.com for a complete list of titles containing XCP and software for uninstalling it. And please remember that "rootkit" is not a band. Invading user's privacy Sony BMG has admitted to hiding potentially dangerous antipiracy software in CDs If you have loaded any Sony music label on your computer, it would've started out by installing a software, called XCP on your hard drive; XCP in turn would have launched a digital music player that plays the songs on the CD XCP contains "rootkit," a chunk of code that sinks deep into a computer's hard drive Rootkit can degrade overall speed and performance of a computer It opens a digital window into your Internet-connected computer, through which a malicious code-writer may climb in order to steal data, corrupt programmes or otherwise get control of your machine Rootkit could, in theory, quietly send data stored on your hard drive to Sony BMG All this essentially makes rootkit a piece of corporate spyware

Steps taken by Sony to set things right - *cp.sonybmg.com/xcp/