Boycott Sony cd's

[Mike Bourke]

Mike, hope you don't mind- I re-ordered some stuff to prevent a mix of top
and bottom posting...

via this


But that's only if you let the session 02 code run. I should have clarified:
Either don't let it autorun (hold down the shift key on insertion), or...

What happens if you REJECT the EULA? Does it still install stuff?

I'm talking about someone who KNOWS about the issue; I acknowledge the
problems faced by someone caught off guard by all of this. Now, I have
Autorun enabled, but if I put in an audio CD, and got a EULA in my face, I'd
abort the whole deal and do some investigating with windows explorer. But
then I'm not the average user.

It's my understanding that the encoding is NOT Red Book standard, and that
if you reject the EULA you can't play the CD on your computer. But that
might not be correct.

I have no problem with posts being rearranged for clarity, and I apologise
for making it necessary.

And, in answer to Ellis Jay's question, yes; Sony Rootkits are exactly what
are being discussed.

Mike Bourke

 

[Vic Dura]

This latest may be of interest to you:

http://www.realtechnews.com/posts/2106#more-2106

Thanks for keeping us posted on this issue John. Good job.

I hope SONY really gets slammed.

 

[Maris V. Lidaka Sr.]

A patch has been released at lease disabling the "cloaking" function:

http://www.sophos.com/pressoffice/news/articles/2005/11/stinxe.html

or http://tinyurl.com/bxctl

Maris

 

[John Corliss]

A patch has been released at lease disabling the "cloaking" function:

http://www.sophos.com/pressoffice/news/articles/2005/11/stinxe.html

or http://tinyurl.com/bxctl

Maris, thanks for posting the link to this tool. I'll definitely be
keeping a copy on hand for working on other people's computers. And if
it hadn't been for Angry Andrew, I and many others in this group might
have fallen victim to Sony's Trojan. My hat off, thanks and a bow to him.

By the way, here's a bit from the site with the tool from Sophos:

"This version of the tool detects and disables the Sony DRM copy
protection technology (which Sophos refers to as Troj/RKProc-Fam) and
other Trojans, including Troj/Stinx variants, which are stealthed by
Troj/RKProc-Fam."

As Mr. Burns says, "EHHHgzellent!"

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.

 

[Lou]

Maris, thanks for posting the link to this tool. I'll definitely be
keeping a copy on hand for working on other people's computers. And if
it hadn't been for Angry Andrew, I and many others in this group might
have fallen victim to Sony's Trojan. My hat off, thanks and a bow to him.

By the way, here's a bit from the site with the tool from Sophos:

"This version of the tool detects and disables the Sony DRM copy
protection technology (which Sophos refers to as Troj/RKProc-Fam) and
other Trojans, including Troj/Stinx variants, which are stealthed by
Troj/RKProc-Fam."

As Mr. Burns says, "EHHHgzellent!"

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.

The whole isue has now made the NY Times:

1. From the Desk of David Pogue: Sony BMG's Copy-Protecting
Watchdog
=============================================================

My In box usually bursts to the seams with reader reaction to
stuff I've written. What was unusual this week, though, was
the amount of mail that came in on a topic that I've never
even mentioned: the Sony BMG rootkit tactic.

The story goes like this. Starting in June 2004, Sony BMG
records began copy-protecting its pop-music CD's. Over the
months, the company has used several software schemes for
preventing you, the customer, from making illegal copies of
its discs. But 20 albums are protected by a scheme devised by
a company called First 4 Internet-and it's caused an
incredible online furor.

These CD's, all bearing "Content Protected" labels on the
packaging (meaning "copy protected"), do something very
sneaky if you try to play them on a Windows PC: they install
a proprietary watchdog program that prevents you from copying
the CD more than twice. (On a Macintosh or Linux machine,
these CD's play just fine, without any copy protection.)

Last week, a programmer and blogger named Mark Russinovich
dug a little deeper, and found out something disturbing: the
Sony watchdog program not only installs itself deep in the
core of Windows-it's what's called a rootkit-but it also
makes itself invisible.

The record company doesn't dispute Russinovich's findings.
"The cloaking is an additional level of protection to hide
the protection files themselves," Mathew Gilliat-Smith, CEO
of First 4 Internet, told me. "It's an extra speedbump to
make it that much more difficult [for prospective music
pirates] to circumvent the protection." But Sony BMG didn't
seem to be prepared for the outcry from privacy advocates and
ordinary citizens who felt violated.

To them, Sony BMG's tactic was dangerous, sneaky, intrusive
and maybe even illegal. Some of the problems:

* The hidden-rootkit trick has been used by virus writers to
conceal their tracks. It doesn't give you such a rosy feeling
to know that Sony BMG is treating you the same way.

* Once hidden, the copy-protection software is invisible to
antivirus programs, too. So the baddies of the Internet
could, in theory, use Sony's software as a backdoor to infect
your machine, and your virus checker would miss it.

* If you try to remove the software manually, you risk
disabling your CD player completely. (Instead you should use
the Uninstall link on Sony BMG's customer-service Web site,
whose link appears on the Help screens of Windows Media
Player. Of course, then you can't play the CD on your
computer.)

* When you insert one of these music discs into your PC, one
of those software license agreements appears. It says
explicitly what's about to occur: "This CD will automatically
install a small proprietary software onto your computer. The
software is intended to protect the audio files on this CD.
It will reside on your computer until it is removed or
deleted."

But this note does not say that the software hides itself.
And, even more damning, you don't see this note until you've
scrolled down to the third page of legalese in the license
agreement. Let's not kid ourselves: NOBODY ever reads those
license agreements. They're too long, too opaquely written
and generally of little use to anyone except the lawyers.

* Sony's copy-protection software prevents you from playing
the music you've bought on your iPod, which happens to be the
world's most popular music player.
Once the true nature of the Sony BMG software tactic became
public, the company wasted no time in attempting to defuse
the issue. Within 48 hours, it released a patch that makes
its software visible again; you can download it from
http://cp.sonybmg.com/xcp. (Click the Software Updates
button.) Sony also provided the rootkit-cloaking information
to antivirus-software companies, so that the software will no
longer be a potential virus magnet.

At that same Web site, you'll find, incredibly, a link to a
Sony-sanctioned workaround that lets you copy the protected
songs to the iPod. (Sony says it will send you the workaround
by e-mail once you supply the name of the CD and other
information.)

Finally, Sony has abandoned the rootkit protection method.
(It says, in fact, that it had planned to do so even before
the trick became public.) It still intends to install copy-
protection software on every audio CD-but it will use other
methods.

For now, then, it seems that the cloaked-rootkit issue is
dead. If you bought one of the 20 affected CD's, you can
uncloak the software, and Sony won't be using this scheme
anymore.

My take? Audio CD's that install software onto your PC are
just creepy. I believe that distributing copies of a CD to
the Internet at large is wrong, so I understand the record
companies' concern. But installing secret, self-masking code
onto customers' computers seems just as wrong.

It's an "any means necessary" approach to the problem, like
dealing drugs to raise money for charity.

Personally, I can't understand why any music fan would buy
one of these discs. If you really want a song from Sony BMG,
why not just buy it from one of the online music stores and
avoid the whole issue? Sony BMG would soon get the message
that customers don't like being treated like criminals.

I was also surprised at how dismissive Sony BMG and First 4
Internet seem to be. "It's a tempest in a teapot," Mr.
Gilliat-Smith says. "It's benign content protection. It's not
malware, it's not spyware-it's innocent.

Consumers, for eight months, have been using these discs with
positive feedback. When the issue arose, we addressed it very
quickly."

I wondered if he could even understand why consumers might
feel a bit violated. I pointed out that the usual damage-
control plan for public-relations disasters (see also
Tylenol; Perrier; Pentium bug) is not to haughtily dismiss
customer fears, but to apologize profusely.

But the closest thing Mr. Gilliat-Smith would say is, "We
understand what the concern was, but there was no intent. We
reacted as quickly as we could, took responsive issues. And
now, hopefully, we move on."

 

[Mike Bourke]

Maris, thanks for posting the link to this tool. I'll definitely be
keeping a copy on hand for working on other people's computers. And if
it hadn't been for Angry Andrew, I and many others in this group might
have fallen victim to Sony's Trojan. My hat off, thanks and a bow to him.

By the way, here's a bit from the site with the tool from Sophos:

"This version of the tool detects and disables the Sony DRM copy
protection technology (which Sophos refers to as Troj/RKProc-Fam) and
other Trojans, including Troj/Stinx variants, which are stealthed by
Troj/RKProc-Fam."

As Mr. Burns says, "EHHHgzellent!"

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.

The whole isue has now made the NY Times:

1. From the Desk of David Pogue: Sony BMG's Copy-Protecting
Watchdog
=============================================================

My In box usually bursts to the seams with reader reaction to
stuff I've written. What was unusual this week, though, was
the amount of mail that came in on a topic that I've never
even mentioned: the Sony BMG rootkit tactic.

The story goes like this. Starting in June 2004, Sony BMG
records began copy-protecting its pop-music CD's. Over the
months, the company has used several software schemes for
preventing you, the customer, from making illegal copies of
its discs. But 20 albums are protected by a scheme devised by
a company called First 4 Internet-and it's caused an
incredible online furor.

These CD's, all bearing "Content Protected" labels on the
packaging (meaning "copy protected"), do something very
sneaky if you try to play them on a Windows PC: they install
a proprietary watchdog program that prevents you from copying
the CD more than twice. (On a Macintosh or Linux machine,
these CD's play just fine, without any copy protection.)

Last week, a programmer and blogger named Mark Russinovich
dug a little deeper, and found out something disturbing: the
Sony watchdog program not only installs itself deep in the
core of Windows-it's what's called a rootkit-but it also
makes itself invisible.

The record company doesn't dispute Russinovich's findings.
"The cloaking is an additional level of protection to hide
the protection files themselves," Mathew Gilliat-Smith, CEO
of First 4 Internet, told me. "It's an extra speedbump to
make it that much more difficult [for prospective music
pirates] to circumvent the protection." But Sony BMG didn't
seem to be prepared for the outcry from privacy advocates and
ordinary citizens who felt violated.

To them, Sony BMG's tactic was dangerous, sneaky, intrusive
and maybe even illegal. Some of the problems:

* The hidden-rootkit trick has been used by virus writers to
conceal their tracks. It doesn't give you such a rosy feeling
to know that Sony BMG is treating you the same way.

* Once hidden, the copy-protection software is invisible to
antivirus programs, too. So the baddies of the Internet
could, in theory, use Sony's software as a backdoor to infect
your machine, and your virus checker would miss it.

* If you try to remove the software manually, you risk
disabling your CD player completely. (Instead you should use
the Uninstall link on Sony BMG's customer-service Web site,
whose link appears on the Help screens of Windows Media
Player. Of course, then you can't play the CD on your
computer.)

* When you insert one of these music discs into your PC, one
of those software license agreements appears. It says
explicitly what's about to occur: "This CD will automatically
install a small proprietary software onto your computer. The
software is intended to protect the audio files on this CD.
It will reside on your computer until it is removed or
deleted."

But this note does not say that the software hides itself.
And, even more damning, you don't see this note until you've
scrolled down to the third page of legalese in the license
agreement. Let's not kid ourselves: NOBODY ever reads those
license agreements. They're too long, too opaquely written
and generally of little use to anyone except the lawyers.

* Sony's copy-protection software prevents you from playing
the music you've bought on your iPod, which happens to be the
world's most popular music player.
Once the true nature of the Sony BMG software tactic became
public, the company wasted no time in attempting to defuse
the issue. Within 48 hours, it released a patch that makes
its software visible again; you can download it from
http://cp.sonybmg.com/xcp. (Click the Software Updates
button.) Sony also provided the rootkit-cloaking information
to antivirus-software companies, so that the software will no
longer be a potential virus magnet.

At that same Web site, you'll find, incredibly, a link to a
Sony-sanctioned workaround that lets you copy the protected
songs to the iPod. (Sony says it will send you the workaround
by e-mail once you supply the name of the CD and other
information.)

Finally, Sony has abandoned the rootkit protection method.
(It says, in fact, that it had planned to do so even before
the trick became public.) It still intends to install copy-
protection software on every audio CD-but it will use other
methods.

For now, then, it seems that the cloaked-rootkit issue is
dead. If you bought one of the 20 affected CD's, you can
uncloak the software, and Sony won't be using this scheme
anymore.

My take? Audio CD's that install software onto your PC are
just creepy. I believe that distributing copies of a CD to
the Internet at large is wrong, so I understand the record
companies' concern. But installing secret, self-masking code
onto customers' computers seems just as wrong.

It's an "any means necessary" approach to the problem, like
dealing drugs to raise money for charity.

Personally, I can't understand why any music fan would buy
one of these discs. If you really want a song from Sony BMG,
why not just buy it from one of the online music stores and
avoid the whole issue? Sony BMG would soon get the message
that customers don't like being treated like criminals.

I was also surprised at how dismissive Sony BMG and First 4
Internet seem to be. "It's a tempest in a teapot," Mr.
Gilliat-Smith says. "It's benign content protection. It's not
malware, it's not spyware-it's innocent.

Consumers, for eight months, have been using these discs with
positive feedback. When the issue arose, we addressed it very
quickly."

I wondered if he could even understand why consumers might
feel a bit violated. I pointed out that the usual damage-
control plan for public-relations disasters (see also
Tylenol; Perrier; Pentium bug) is not to haughtily dismiss
customer fears, but to apologize profusely.

But the closest thing Mr. Gilliat-Smith would say is, "We
understand what the concern was, but there was no intent. We
reacted as quickly as we could, took responsive issues. And
now, hopefully, we move on."

OK, so sony have reacted to the lawsuits and growing media attention by
waving the white flag - but the lack of an apology suggests that they still
have not learned their lesson. The fallout will undoubtdly continue for some
time. As for NY Times article, while there were some factual errors, they
got most of what they reported right - while leaving out some of the juicy
bits. And no mention of the lawsuits....

Mike

 

[charles]

This latest may be of interest to you:

http://www.realtechnews.com/posts/2106#more-2106

and here's something that came by via Afterdawn.com -

Trojan takes advantage of Sony BMG DRM
10 November 2005

The uproar about the Digital Rights Management (DRM) technology in use
on some CDs distributed by Sony BMG is set to heat up again following
the confirmation that a trojan has now appeared that takes advantage of
the DRM's file hiding capabilities. It was picked up by Sophos in an
email that poses as an email from a British magazine. Here..

<http://www.afterdawn.com/news/archive/7015.cfm>

 

[Vic Dura]

OK, so sony have reacted to the lawsuits and growing media attention by
waving the white flag - but the lack of an apology suggests that they still
have not learned their lesson. The fallout will undoubtdly continue for some
time. As for NY Times article, while there were some factual errors, they
got most of what they reported right - while leaving out some of the juicy
bits. And no mention of the lawsuits....

And no mention of how difficult, and how many hoops you have to jump
through, to actually get the patch.

 

[dpogue]

And no mention of how difficult, and how many hoops you have to jump
through, to actually get the patch.

Actually, I must point out that Mark Russovich's second blog entry is
incorrect on this point. You don't have to go through ANY hoops to get
the patch! It's a direct .zip file at the link I provided in my article
(http://cp.sonybmg.com/xcp). You do NOT have to supply your name or any
other information, you do NOT have to wait for a reply for Sony, etc.
You just click Software Updates, and then there's the link!

The "hoops" and screenshots described by Mr. Russovich were for getting
the iPod workaround. They were not for getting the DRM uncloaking
patch.

(Otherwise, though, I'm totally with you all. It's clear that Sony BMG
has learned absolutely nothing from this outcry.)

--David Pogue
The New York Times

 

[Daniel Mandic]

Actually, I must point out that Mark Russovich's second blog entry is
incorrect on this point. You don't have to go through ANY hoops to get
the patch! It's a direct .zip file at the link I provided in my
article (http://cp.sonybmg.com/xcp). You do NOT have to supply your
name or any other information, you do NOT have to wait for a reply
for Sony, etc. You just click Software Updates, and then there's the
link!

The "hoops" and screenshots described by Mr. Russovich were for
getting the iPod workaround. They were not for getting the DRM
uncloaking patch.

(Otherwise, though, I'm totally with you all. It's clear that Sony BMG
has learned absolutely nothing from this outcry.)

--David Pogue
The New York Times

--



Russinovich.

The same like I would say Poe to you. Do you write afrikaans at the New
York times?



_Best Regards,

Daniel Mandic

 

[Peter Seiler]

Mike Bourke - 11.11.2005 14:22 :

[snipped]

Mike, is it really useful and necessary reposting mostly with full
quotings - in this case over 200! quoting lines again? Everybody may
read back the thread.

 

[Peter Seiler]

Daniel Mandic - 12.11.2005 09:26 :

(e-mail address removed) wrote:

[quoting snipped]

what's your message please?

 

[John Corliss]

Actually, I must point out that Mark Russovich's second blog entry is
incorrect on this point. You don't have to go through ANY hoops to get
the patch! It's a direct .zip file at the link I provided in my article
(http://cp.sonybmg.com/xcp). You do NOT have to supply your name or any
other information, you do NOT have to wait for a reply for Sony, etc.
You just click Software Updates, and then there's the link!

The "hoops" and screenshots described by Mr. Russovich were for getting
the iPod workaround. They were not for getting the DRM uncloaking
patch.

(Otherwise, though, I'm totally with you all. It's clear that Sony BMG
has learned absolutely nothing from this outcry.)

David,
The average surfer isn't going to catch that though. Instead, they're
going to click on "through this link"
(http://cp.sonybmg.com/xcp/english/form14.html) and see exactly the
"hoops" described by Mark Russovich.

Thanks to you and your article though, far fewer people will fall
further victim to Sony's demand for personal information.

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.

 

[Vic Dura]

Actually, I must point out that Mark Russovich's second blog entry is
incorrect on this point. You don't have to go through ANY hoops to get
the patch! It's a direct .zip file at the link I provided in my article
(http://cp.sonybmg.com/xcp). You do NOT have to supply your name or any
other information, you do NOT have to wait for a reply for Sony, etc.
You just click Software Updates, and then there's the link!

The "hoops" and screenshots described by Mr. Russovich were for getting
the iPod workaround. They were not for getting the DRM uncloaking
patch.

(Otherwise, though, I'm totally with you all. It's clear that Sony BMG
has learned absolutely nothing from this outcry.)

Thanks for the correction.

 

[Daniel Mandic]

John Corliss wrote:

(http://cp.sonybmg.com/xcp/english/form14.html) and see exactly the
"hoops" described by Mark Russovich.

Thanks to you and your article though, far fewer people will fall
further victim to Sony's demand for personal information.

Russinovich. Mark Russinovich.




Best Regards,

Daniel Mandic

 

[John Corliss]

Russinovich. Mark Russinovich.

Best Regards,
Daniel Mandic

I should have caught that. I stand corrected...

Sorry.

80)>

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.

 

[Mike Bourke]

There are now at least two trojans, including the one reported by Charles. I
am involved in several other groups and affilliations which are actively
discussing this at the moment, these links contain the latest info.

http://www.dashes.com/anil/stuff/doctorow-drm-ms.html

It would also appear that the U.S. Department of Homeland Security is not
happy with Sony either.

http://blogs.washingtonpost.com/securityfix/2005/11/the_bush_admini.htm

and finally,

http://dewinter.com_modules.php_name=News&file=article&sid=215

I found the dashes.com aticle especially interesting reading. I was
immediatly reminded of Robert Heinlein's very first published story,
Lifeline. To paraphrase it, a scientist figures out how to predice exactly
when someone will die, and the insurance companies take him to court. They
wheel out all sorts of experts to testify against him, but they all fall
foul of being experts in everything related to the science involved but not
the science itself. This made them the equivalent of a bioligist claiming
that a car wouldn't work because it didn't have feet. The court in the story
eventually ruled - and I'll actually quote this part - "There has grown up
in the minds of certain groups in this country the notion that because a man
or corporation has made a profit out of the public for a number of years,
the government and the courts are charged with the duty of guaranteeing such
profit in the future, even in the face of changing circumstances and
contrary to public interest. This strange doctrine is not supported by
statute nor common law. Neither individuals not corporations have any right
to come into court and ask that the clock of history be stopped, or turned
back."

Prophetic words indeed; the analogy is clear. Yet this is exactly what the
recording industry have achieved, and seek to continue to achieve, over the
last decade or so. The artists they represent may be entitled to damages
from file-sharing and MP3; those are protected by the constitution for the
express purposes of encouraging them to continue. The record companies
distribution mechanism is NOT. If they were smart, they would have built a
better P2P service instead of even forming the acronym, DRM. They seem to
have confused their rights with those of the artists they represent.

Mike

 

[Querulantus]

http://blogs.washingtonpost.com/securityfix/2005/11/the_bush_admini.htm

"The requested URL /securityfix/2005/11/the_bush_admini.htm was not
found on this server."

http://dewinter.com_modules.php_name=News&file=article&sid=215

"Cannot Find Server - The web site you typed in could not be found on
the internet."

Querulantus

 

[John Corliss]

"The requested URL /securityfix/2005/11/the_bush_admini.htm was not
found on this server."




"Cannot Find Server - The web site you typed in could not be found on
the internet."

Querulantus

Heh. As slippery as an eel soaked in snot.

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.

 

[ellis_jay]

Heh. As slippery as an eel soaked in snot.

Lots of links here:
http://blogs.washingtonpost.com/securityfix/

The 20 offending cd's so far:
http://slashdot.org/~xtracto/journal/121088

the link not found can be found here:

http://sstern.ccim.com/2005/11/11/homeland-security-and-sony-rootkit/

just click on the Washington post link to read it



--

Their ethics are a short summary of police ordinances: for them the
most important thing is to be a useful member of the state, and to air
their opinions in the club of an evening; they have never felt the
homesickness for something unknown and far away, nor the depths which
consists in being nothing at all. ___________Soren Kierkegaard

Ellis_jay