Slashdot Log In
Sony Rootkit Phones Home
Posted by
Hemos
on Mon Nov 07, 2005 09:10 AM
from the the-on-going-saga dept.
from the the-on-going-saga dept.
strider44 writes "Mark from Sysinternals has digged a little deeper into the Sony DRM and discovered it Phones Home with an ID for the CD being listened to. XCP Support claims that "The player has a standard rotating banner that connects the user to additional content (e.g. provides a link to the artist web site). The player simply looks online to see if another banner is available for rotation. The communication is one-way in that a banner is simply retrieved from the server if available. No information is ever fed back or collected about the consumer or their activities." Also on this topic, Matt Nikki in the comments section discovered that the DRM can be bypassed simply by renaming your favourite ripping program with "$sys$" at the start of the filename and ripping the CD using this file, which is now undetectable even by the Sony DRM. You can use the Sony rootkit itself to bypass their own DRM!" Update: 11/07 14:21 GMT by H : Attentive reader Matteo G.P. Flora also notes that an Italian lawyer has filed suit against Sony on behalf of the Italian equivalent of the EFF. Translation availabe through the hive mind. Update: 11/07 15:18 GMT by H : It does appear that in fact Sony does see through the $sys$ - see Muzzy's comment for more details.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Ha Ha! (Score:5, Funny)
Uh Oh (Score:5, Funny)
Re:Uh Oh (Score:5, Informative)
I think Blizzard in particular has a good case against them, since their crazy DRM is being used to circumvent some of Blizz' anti-cheating measures.
Parent
Re:cnet has a intresting article (Score:5, Funny)
Parent
Rip It....Rip It Good (Score:5, Informative)
Re:Rip It....Rip It Good (Score:5, Insightful)
AFAIK, the rootkit is the only protection on this CD. As they admit, it looks like a normal CD to an Apple computer - and, of course, to a Linux computer. And, for that matter, to a Windows computer with Autorun disabled... I do enjoy a truly pathetic copyrestriction system, don't you?
Parent
Re:Rip It....Rip It Good (Score:5, Insightful)
Parent
Re:Rip It....Rip It Good (Score:5, Informative)
It doesn't automatically self-propagate, so it isn't a worm. Nor does it infect files and piggyback on them to infect other machines; it isn't a virus. This particular piece of malware comes attached to something the user wants (i.e. a music CD) without his knowledge, and proceeds to infect his machine, but makes no attempts to spread itself to other machines. That makes it a trojan.
Parent
Re:Rip It....Rip It Good (Score:5, Insightful)
After finding more information about it, it sounds as if it blocks programs from accessing the CD drive that are in sony's list.
Step 1: Rename your Windows Server App to ITUNES3.EXE
Step 2: Put all the config files for that server app on a CD
Step 3: Insert Sony music CD into secondary drive
Step 4: The DRM that installed itself without your consent crashed your mission critical server. Sony is liable!
Step 5: ???
Step 6: Profit!
Parent
Re:NO you are WRONG (Score:5, Insightful)
Ah, but you didn't say illegal, you said wrong. The equation of the two is perhaps the greatest threat to liberty in the modern world.
Parent
Re:NO you are WRONG (Score:5, Insightful)
No I didn't. I entered into a contract for sale of goods with the record store, the terms of which were that I handed over some cash and they handed over a CD. That contract was fulfilled to the satisfaction of both sides. I have no other contractual obligations of any kind.
Parent
Re:NO you are WRONG (Score:5, Insightful)
Parent
No information (Score:5, Insightful)
Other then your IP address, date and time it's connected to the net, the CD you're listening to, how often you listen to it...
Re:No information (Score:5, Funny)
-jcr
Parent
Why is this posted in games? (Score:5, Insightful)
Also, First 4 Internet's rebuttle (Score:5, Informative)
Re:Also, First 4 Internet's rebuttle (Score:5, Funny)
Parent
In Sony's Japan... (Score:5, Funny)
Anyone know if the "phone home" is in the EULA? (Score:5, Interesting)
LGPL violation? (Score:5, Interesting)
Also, go check Contents\GO.EXE in the cd and search for string "LAME". This is possible LGPL violation, since LAME mp3 library has been statically linked against the executable. You can see that version.c has been compiled in since it generates those version strings, and I found tables.c as well. Didn't locate any code though, apparently removed by optimizing compiler due to being unreferenced, but I couldn't test for all LAME code as I don't have proper tools available (such as sabre-security bindiff)
Re:Common sense violation? (Score:5, Informative)
The data is there, the big question is if it was linked accidently, or if it actually uses LAME code as well.
Parent
Brilliant marketing (Score:5, Funny)
What if. . . (Score:5, Interesting)
What happens then? Do you get an error message? Does the CD not play? What if you block the ad retrieval via your firewall?
What if I turn off the monitor and walk away while the CD plays? Am I stealing ala Jack Valenti and not watching commercials on tv?
Utterly Laughable (Score:5, Insightful)
why are sony SO unbeleivably stupid as to think otherwise. They must be wasting hundreds of thousands of pounds on this utterly useless rubbish, that even the least technical of people can bypass.
These things are so childish no hacker would even bother with them, as stated this one even defeats itself!
It only takes one breach to distribute a copy, why piss off thousands of genuine paying clients?
The mind boggles, the only people winning are the copy protection companies living happy lives doing nothing but ripping Sony off.
aren't they supposed to do maketing studdies on things before release?
maybe employ a 16 year old to independantly test the schemes for them rather than taking the word of the people selling them this rubbish
(I'd have said 10 year old but it wouldn't be legal)
revenue lost to purchasing clients who will have to return product as it wont run. $X,0000
revenue lost to potential clients who will be scared off buying in the first place. $Y,0000
estimated reputation damage to company. priceless.
estimate of no. of pirated copies prevented. ZERO.
great... (Score:5, Insightful)
I hope Microsoft is paying attention here, because this could set an EXTREMELY bad trend here. Why do we have these "certified" drivers? Because a lot of them were crap. Now we have software injecting stuff directly into the OS. I can't say this is going to help MS in the security and stability department.
The $sys$ prefixing thing was apparently wrong :( (Score:5, Informative)
Just my luck, when I make it to slashdot it's something I've analyzed wrong. I tested to rename my ripping software to begin with $sys$ and it ripped it fine, but apparently something else was the deciding factor. I can't reproduce that effect!
There's definitely something fishy going on, however, with two magic lists in the DRM system (one in installer, one in $sys$DRMServer.exe), and the drmserver scans running processes and open windows, testing them against those lists. So far I haven't figured what it does when it finds a match. The code is written in C++ and although I've found the function call, it's virtual and I need to figure which vtable is being used and it's bitchy without a debugger. I'm not going to run this crap on my development systems, and my test machine doesn't even have net access, too much work to setup debuggers on it just yet :(
Anyway, the lists for everyone to see:
http://hack.fi/~muzzy/sony-drm-magic-list.txt [hack.fi]
http://hack.fi/~muzzy/sony-drm-magic-list-2.txt [hack.fi]
The first one is from installer, the second from drmserver
Re:The $sys$ prefixing thing was apparently wrong (Score:5, Insightful)
Parent
iTunes Pro (Score:5, Interesting)
Weird.
Parent
Re:The $sys$ prefixing thing was apparently wrong (Score:5, Interesting)
Anyway, as a bonus, even though the rootkit doesn't install in virtual PC, it still calls home and tells sony about you
Parent
Re:That can't be right (Score:5, Informative)
Parent
Listing of Sony DRM'ed CDs (Score:5, Informative)
http://www.google.com/search?q=sony+site:amazon.c
In other related news... (Score:5, Informative)
According to his post, it seems Sony's fix "patch" makes a little "contact home" contacting Sony servers. This even when sony claims that their software didnt made contact with them.
Slashdot covered previously [slashdot.org] the intial XCP rootkit story.
The inquirer [theinquirer.net] has an interesting article on the Sony DRM technology overall.
And it seems community have found several alternate uses for the XCP technology which include hiding game cheating software [theregister.co.uk] and even to bypass DRM technology [sysinternals.com]
Why would you do this? This is stupid. (Score:5, Insightful)
All I've seen from people on this issue are ways to get around the DRM. Yes, there are MANY ways to get around it, audio line-out to a DAT or an iPod, using linux, a mac, CDex, Audiograbber, Audiohijack-pro...
But that is all just retarded, if you're buying this CD and you use it as Sony want you to use it, it is NO different than if you buy the CD and rip it with some workaround. Sony don't SEE a difference. The MP3s will be on DC++ anyway, it's not like they will lose sales to people ripping it for their iPods or whatever.
And if you do buy the CD, (regardless of wheter you rip it or not) you have just voted. Corporations are the Governments of today and with your purchase you vote. And buying any content protected CD regardless of what you do with it is a VOTE to Sony that DRM is acceptable to you. And that means next time it won't be some crappy nobody C&W CD that is taking over your PC, it'll be the big Sony acts. And then the big EMI acts and WB acts and so on.
Vote with your cash, buy non-DRM encumbered CDs or else just steal it. I'd prefer to take the moral issues and risk of stealing rather than just be Sony's bitch and install their shitty rootkit on my computer.
Very backward thinking on Sony's part (Score:5, Insightful)
What's the goal here? To stop the people who buy CDs and rip copies for a few friends... by driving everybody to rely on safer online distribution exclusively?
One and only one thing to fix the problem (Score:5, Insightful)
If you care about this, then don't buy Sony games, music or movies. If you don't care about DRM and spyware issues then by all means go out and buy more product from them.
Is sending a clear message that you will not tolerate corporate abuses worth going a few months without shelling out $18 for a CD that has two decent tracks on it?
Accept nothing less - the public firing of the VP who oversaw the department that gave the green light to this - or no purchase of any Sony game, music or movie.
Personally I don't think enough people value unhacked systems enough to make the sacrifice. My prediction is that Sony will essentially get away with it, may have their insurance company pay a few settlement checks, and make a better attempt next time around. Or simply write enough checks to MS to ensure that the DRM is included in the Colonel (weak joke about a police state... sorry). And write enough checks to Motorola and Intel to make sure that DRM is included at the chip level. And write enough checks to US Senators to make sure that the law will back them up next time.
Again, the only recourse is to refuse to buy Sony products until a VP is fired. Nothing else will work.
Now I'd just love... (Score:5, Funny)
Trojan detected: WIN32.DrmSony.SPY@mm - Threat: medium; class: Spyware, Rootkit, OS-damage.
Known to cause CD drive malfunction, secretly uploads third party data, prevents certain userspace programs from running, hides from the OS, installs itself without user consent.
OS infection prevented.
Warning: E:\ Volume is Read-Only. The virus cannot be removed (cause: Data written to non-erasable CD.)
Recommendation: Back up all non-infected data from the medium by re-burning it to a new blank CD, destroy infected disk.
Re:Now I'd just love... (Score:5, Informative)
Parent
Re:I wonder... (Score:5, Funny)
Parent
Re:The market provides! (Score:5, Insightful)
You're responsible for checking out a product before buying it. I won't buy any music ROM disc that doesn't have the "CD" certification logo, unless it is from an indie band. I still rip eve y CD from a CD player with an optical out into my PC. Safety first.
You obviously never read the original article. Sony didn't advertise in any way shape or form that this was on the CD, so even you wouldn't have been able to "check out" the product before buying it!
Parent
Re:The market provides! (Score:5, Informative)
Parent
Re:The market provides! (Score:5, Informative)
In the front cover, no notice of protection. On the side, no notice. On the back, facing towards front, on left side of the cover (you know), there's "Content enhanced & Protected" text. On the reverse side, it says "Certain computers may not be able to access the digital file portion of this disc. Use subject to applicable end user license agreement". It says it needs a mac or PC with windows, pentium II, IE5, DirectX 9, 128M ram. Says that ripping with windows media player 9.0 works, and is compatible with Windows Media portable devices and Sony Walkmans.
So, yea, it pretends to be a CD. I don't know the standards to know if this is really a valid audio cd since it's multisession. It's definitely about trying to screw the consumer, though, since it tries to break the cd playback ability of the computer with the malware it ships with, under guise of "DRM".
Parent
Re:The market provides! (Score:5, Insightful)
Parent
Re:The market provides! (Score:5, Insightful)
Parent
Re:The market provides! (Score:5, Insightful)
Parent
Re:The market provides! (Score:5, Interesting)
If others are apathetic about it, then that's fine, but they shouldn't complain when people who do care want to take issue with Sony's actions. If enough consumers take issue with it now, the message will become clear enough in the baby-stages of the new CD DRM that at least some companies will refrain from doing this. The idea isn't to just complain over a little thing, but to stop something that people do not want to happen. I don't see an issue with that.
And it's not necessarily that anyone denies Sony's rights to provide this either; people simply do not want it, or are indifferent to it. Those who are indifferent shouldn't care either way, and those who don't want it shouldn't have to have it, and as a corporation, Sony should listen to the consumers a little and realize this is technology that people do not want.
Of course, this leads a lot into the discussion of wanted technology vs unwanted technology and how a lot of the larger corporations nowadays just put enough money into things so that they live long enough to be considered common place, and hence gain acceptance, which is altogether a frustrating business model which made me stop watching television long ago...but yeah...different topic.
Parent
Re:The market provides! (Score:5, Insightful)
You know as well as I do that if you don't do the bidding of the right people, you won't find yourself with any "shelf space". Its white bread or wheat bread, anything else is illegal. Feel free to vote in the checkout aisle, just don't complain to anyone when your rye bread is nowhere to be found.
Parent
Re:The market provides! (Score:5, Interesting)
But, by not adding an uninstaller, not putting it it in the EULA what it is doing and playing the blaim game to apple*, their software is not better than the worst spyware. They think they can install anything on a users PC, but this might be plain illegal.
If you do not care about spyware and viri, please let it pass, but if you care for your privacy and/or your pc you should not "vote with your wallet", but name it what it really is.
*(their faq keep babbling you can not transfer it ot itunes because apple did something to make their api incompatible, instead of watching their DRM solution)
Parent
Re:The market provides! (Score:5, Interesting)
If something isn't done about this soon, clearly network effects will result in pretty much every "CD" being DRM-encumbered, containing, as Sony did, software that actively damages the configuration of the systems the CD is meant to play upon. However, it would be entirely wrong to hold companies like Sony to account for this. They, after all, are merely trying to make money. It is entirely right that they should do so by taking advantage of ignorance to encourage people to do things that are entirely not in their best interest. If businesses were not able to do this, if businesses had incentives to make money when honest, then freedom itself would be at risk. Liberty would be in peril.
What kind of "choice" is it where you do not need to be a technology geek to decide whether or not to buy a "CD" of music? What kind of "freedom" does one have if every vendor of cellular service is telling the truth about their talk plan prices? How are we free if we do not, in practice even if we rarely do, have to hire a lawyer before taking a job or even installing software? Can we be described as supportive of liberty when a shop cannot put a price label on an item that actually reflects the retail price minus some "mail in rebate" the customer might not even qualify for, and if they do, might not get anyway?
Those who defend the intervention of government into these matters ignore market forces. Just as, say, if people like purple cars, the market will eventually end up producing purple cars, so it follows that what we're seeing here is market forces. People, through their unwillingness to spend every waking moment researching every aspect of the products they buy before they buy them, refusing to visit factories to determine environmental and employment issues, refusing to educate themselves about 14 bit 44.1KHz encoding, refusing to examine the contracts of the artists who produced the works, refusing to understand the lower level Win32 APIs and the registry, refusing to even design proxy-device drivers to understand these basic concepts, demonstrate that they want ignorance, and they consider being taken advantage of, being fooled, as actually a thing of value. We cannot have honesty in business when the market wants dishonesty.
But, no, there are those who want to smother consumers in regulation and red-tape. They want to prevent consumers from getting the products and services they deserve. And why? Because the more dishonest the market becomes, the more they scream and think something needs to be done.
This quagmire of people complaining about the market when the market is actually providing them with what they asked for will not disappear by itself. Resources need to be devoted, and unless people are prepared to actually act, not just talk about it on Slashdot, nothing will ever get done. Apathy is not an option.
You can help by getting off your rear and writing to your congressman [house.gov] or senator [senate.gov]. Tell them that the market is important to you. Tell them that you appreciate the work being done by Sony, Steam, Kevin Jones Staples and Off
Parent
Re:I need to thank Sony (Score:5, Informative)
I've always been under the impression that Japanese companies (or those largly held by) were a bit more ethical than their American counterparts. Sony has proven to me that my impression was completely in error.
http://www.sonybmg.com/management.html [sonybmg.com]
2 Americans, 1 Australian & 1 European.
Parent
Re:why is this even possible? (Score:5, Informative)
In this case, the rootkit patches the system call table, so that calls to functions to look at directory contents are intercepted by the driver, which just pretends that no files starting with $sys$ exist.
There is nothing that Windows can do to stop drivers from doing this while they run in kernel mode. It can make it harder to do, though - I think the 64-bit versions of Windows check the system call table and blue screen if they find it's been changed. To get around that, the driver would either have to take over from Windows completely (not too practical) or find the code that checked the system call table and patch it.
Of course, you do need to have the right privileges to install a driver in order to install this rootkit. Usually, that means being an adminstrator.
Parent