Sony's incredibly dumb DMR rootkit

A

Anonymous Bob

Bill Sanderson said:
Thanks Bob--that's an eye opener indeed.

The company that developed the software is First 4 Internet Ltd. aka F4i.
Their product is XCP (Extended Copy Protection).
The full name is XCP® - AuroraT.
http://www.xcp-aurora.com/

How fitting (telling?) that they named it after some well known spyware. :p

Bob Vanderveen
 
A

Anonymous Bob

Anonymous Bob said:
oops

That "T" at the end was part of the trademark symbol.

I'll try again.<g>
XCP® - AuroraT

Well, alrighty then...it works in notepad.<bEg>

I'll go away now...

Bob Vanderveen
 
B

Bill Sanderson

That's very interesting indeed. And worrying.

Plun regularly reminds us of the dangers of DRM and of Microsoft's likely
attitude to build "blindness" towards DRM into their products.

I wouldn't expect either the Malicious Software Removal tool, or Microsoft
Antispyware, (or Microsoft Antivirus, for that matter) to disclose the
existence of this critter or offer to remove it. My reasoning is that it is
probably covered by the EULA you acknowledge in installing the CD in the
first place, and although badly programmed, is not malicious nor does it
phone home.

The lack of any mechanism to remove it certainly gives considerable pause,
however.

So--should we be happy with the DRM built-into the OS, acknowledged, open,
where we can see it? Is that better than these ad-hoc per-vendor attempts
that will drive us nuts over time?

Or is this another instance where anti-trust raises its head--can't force
the world to use Microsoft's DRM, so we've got to allow everybody and his
brother to put nasty code on our machines if we choose to play their music?

And if the Aurora folks are related will we soon be seeing advertising as
part of the "cost" of such copy-protected CD's?

A lot to think about here, and I'm none-too clear headed--another beautiful
warm halloween night here with probably over 400 trick or treaters--less
than the high of 500 last year, but a good crowd--and well behaved by and
large, too.


--
 
D

David J. Craig

Maybe we can follow the brilliant guidance of a previous First Lady. "Just
say no!", said Nancy Reagan. I know Sony would like to charge the same for
CDs as they do in Japan, where the average price is about $35. In Japan you
can rent a CD and a player with tape recording capability and buy a blank
tape of the correct length for that CD and make a copy while you have it.
They have some very interesting tape lengths. It has been almost seven
years since I was there, so it may have changed since then.
 
P

plun

Hi Bill

Now we mixes apples and bananas again.......... :)

I am against uncontrolled TPM chips with George Orwell 1984 scenarios.
ie "Big Brother" sees everything and also cuts all competition.

DRM and TPM are no solution for this challenge, it´s only a easy way
for
the media industry to make share holders happy instead of really change
attitude and see a new world with new business models instead of
keeping all old structures.

Why do we have Sony Sweden, Sony France, Sony Russia and so on with
local organisations in every country ?

We only need headhunters for new talented artists within every country
and catering/promotion firms which Sony World can hire instead.

One more maybe negative side for some users is that we don´t need
record shops but this is only normal progress that they must close
down.
Why keep something we don´t need ? and old fashion distribution models.

Of course we must protect digital rights and someones work, but now we
have a situation that it´s a community against a industry.

In Sweden we now have cases in court for file sharing and this is
turning everything against media companys and the community collects
money to pay someones penalty. A real "soap opera".

Nevertheless intellectual work must be protected but with other methods
ie price models so we can come further.

With working new business models and new infrastructures there is no
room for a stinking p2p cloak with malicious malware.

And a OS can be protected in other ways then with a TPM chip !

--
plun



Bill Sanderson submitted this idea :
 
B

Bill Sanderson

I think most consumers will do this, once they/ve been bitten by such a CD.
I don't know whether that will prompt a retreat on Sony's part, or simply
putting on everything.
--
 
A

Anonymous Bob

Bill Sanderson said:

Yep. They dropped the cloaking, but you must allow them to install an
ActiveX control to update or remove the program.
By the reports I've run into, they will determine if your reason(s) for
removing the program is(are) valid.

The Anti-Spyware Coalition has published their guide lines for public
comment until 28 Nov.
http://www.antispywarecoalition.org/documents/riskmodel.htm

Even without cloaking I think they're in trouble.

Then there's this:
http://www.washingtonpost.com/wp-dyn/content/article/2005/11/02/AR2005110202362.html

Mikko Hypponen, director of research for Finnish antivirus company F-Secure
Corp. reports that "... installing the Sony program on a machine running
Windows Vista -- the beta version of the next iteration of Microsoft
Windows -- "breaks the operating system spectacularly."

Bob Vanderveen
 
B

Bill Sanderson

The Anti-Spyware Coalition has published their guide lines for public
comment until 28 Nov.
http://www.antispywarecoalition.org/documents/riskmodel.htm

Even without cloaking I think they're in trouble.
GOOD!


Then there's this:
http://www.washingtonpost.com/wp-dyn/content/article/2005/11/02/AR2005110202362.html

Mikko Hypponen, director of research for Finnish antivirus company
F-Secure
Corp. reports that "... installing the Sony program on a machine running
Windows Vista -- the beta version of the next iteration of Microsoft
Windows -- "breaks the operating system spectacularly."

That sounds like fun--I could actually try that out--but I guess I'd have to
give money to Sony..Wonder if there are stacks of these CD's in the used
record stores near me--might be worth checking out.
 
G

Guest

Some good news folks:

Sony today announced they admit their mistake and they have, together with
First 4 Internet who created the malware, decided to remove it.

Removal program can be found at http://cp.sonybmg.com/xcp/english/updates.html

I think the main problem is that record companies are really having a hard
time since the audience would prefer buying individual tracks rather than
full length records and that is in conflict with their traditional business
model where you like one track but have to pay for all 14-20 other ones as
well.

I never download illegal music from the internet but I do convert all my
legally purchased CD:s into MP3 tracks on my music library. The current
actions of the record companies are making this LEGAL copying more and more
difficult. I really do not want to swap records all the time- I want to
create hour long playlists and burn my own "best of" CD's for car usage.

Best regards,
Pandy
 
A

Anonymous Bob

Pandy in NL said:
Some good news folks:

Sony today announced they admit their mistake and they have, together with
First 4 Internet who created the malware, decided to remove it.

Removal program can be found at http://cp.sonybmg.com/xcp/english/updates.html
Sorry Pandy, but that's an update that after installation of an ActiveX
control removes the cloaking, but the program is still there.

Bob Vanderveen
 
D

Donald Anadell

Comments inline:

Pandy in NL said:
Some good news folks:

Sony today announced they admit their mistake and they have, together with
First 4 Internet who created the malware, decided to remove it.

Removal program can be found at http://cp.sonybmg.com/xcp/english/updates.html

Hi Pandy in NL,

As I read the statement at the Sony site you provided:

<quote>This Service Pack removes the cloaking technology component</quote>

As I understand this statement, this Patch will only remove the cloaking component of the software so that it will be exposed to
view on the users machine. It doesn't not however remove the software as a whole from the users machine.

As stated in the article posted by Bill:

<quote>Consumers who want to remove the copy-protection software altogether from their machine can contact the company's customer
support service for instructions, a Sony BMG representative said.</quote>

As I understand this statement, complete removal of the software involves the download of additional software and additional
instructions. And then only if the Sony people agree that you have a legitimate reason for complete removal of the software.

This is how I understand the issue at present, if I'm wrong I'm sure someone will come along and enlighten us:blush:)

Don
 
P

plun

Anonymous Bob explained on 2005-11-03 :
Sorry Pandy, but that's an update that after installation of an ActiveX
control removes the cloaking, but the program is still there.

Bob Vanderveen

Hi

It´s Ok with a visible program for this so users knows............

http://www.f-secure.com/weblog/

One more scandal is that First 4 Internet tried to convience antivirus
vendors to not detect this "cloak". Also read yesterdays weblog about
flaming F-Secure.

"But every road goes against TPM"................ this cannot
have been a secret for all members within Trusted Computing Group
including Microsoft.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top