Sony's new CD DRM scheme == malware

[Kevin P]

Some recent Sony Music CDs have been surreptitiously installing a DRM/anti-copy driver that uses rootkit tactics to hide itself and make removal difficult:

http://www.sysinternals.com/blog/

While the media companies claim that illegal copying is hurting their bottom line, such underhanded tactics are unacceptable IMHO. Who are the real criminals here?

If anything, these protection schemes just cause people to download unencumbered music from P2P networks rather than buy restricted CDs that go as far as infecting any PC that the CD is played in.

Here's an article on Broadband Reports: http://www.dslreports.com/shownews/69027

Tell Sony how you feel: http://www.sonymusic.com/about/feedback.cgi

[Brandon B]

If you read towards the very end of the comments, an interesting comment on the situation:

First4Internet, eh?... let's see... according to public records, they were incorporated 24/11/1999. In 2004 they had a turnover of £709,941 and operating expenses of £1,301,546 -- meaning an operating loss of £591,605. In the last five years they have, on average, lost £541,067 a year. For 2004, their credit rating is "HIGH RISK" (complete with capitalisation). Meanwhile, the four directors share annual renumeration of £224,413 between them (average £56,103 each).

One of the directors, Nicholas Bingham, (appointed in 2002) was director of "Sony pictures home entertainment Ltd." from 1989 to 1997, and director of "Sony pictures television production UK Ltd." from 1996 to 2000, and director of "Sony digital radio europe Ltd." from 1994 to 2000.

A cynic might say Sony selected this inept copy protection technology because it was supplied by one of thier cronies. The reason this is a bad business practice can be seen by the software's many failings.

I actually logged into HTG to post this myself, and found you had done so this morning! Oh well, I'll post my link to a rather spiffy PC-built-into-a-wall-plate thin client instead.

BB

[Kevin P]

Here's another article: http://www.theregister.co.uk/2005/11...y_rootkit_drm/

[audioqueso]

I'll always be able to find a way to copy a music CD!
:twisted: :twisted: :twisted:

[Shane Martin]

Don't like it, don't buy their products. They are just protecting their IP. You aren't forced to buy them.

[Kevin P]

Yeah, they're "protecting" themselves right out of the market at the rate they're going. Most people buy CDs and throw them in their PCs without thinking twice about it. They have no idea what kind of monsters lurk on that shiny silver disc.

Sure, it's illegal to make unauthorized copies of their works, but isn't it also (more) illegal to intentionally cripple your customer's PCs with malware, especially with no warnings or any simple means to uninstall? A rootkit is a rootkit, regardless of its intended end purpose. No one wants them on their PCs. I spend enough time cleaning this crap off people's PCs when they hit a seedy part of the web or click an email attachment. I don't want to have to clean off crap left behind by playing a CD they bought at the store on their PC...

It's one thing to "protect" your IP, as Shane says. It's another thing entirely to place hidden drivers on a PC, with no uninstaller, that cripple the machine if removed manually, requiring one to hire a tech guru to remove it completely, or requiring a reformat to remove. This puts this scheme right smack dab in the same category as viruses, worms, trojans, and spyware.

[aud19]

It's one thing to "protect" your IP, as Shane says. It's another thing entirely to place hidden drivers on a PC, with no uninstaller, that cripple the machine if removed manually, requiring one to hire a tech guru to remove it completely, or requiring a reformat to remove. This puts this scheme right smack dab in the same category as viruses, worms, trojans, and spyware.

While you're right Shane, if you don't like it, don't buy it but I've got to agree with Kev here, that's pretty malicious. I mean it's fine and dandy to tell us "just don't buy their product then" but what about average Joe who unwittingly buys their product and ends up with this unwanted garbage on their computer? Not to mention we shouldn't have to boycot a product like this.

[gianni]

Well, I used the above link to let them know what I thought of this practice. I hope others will take the time as well.

[Shane Martin]

but what about average Joe who unwittingly buys their product and ends up with this unwanted garbage on their computer?

Does the average joe really give a crap? No. He likely and I say 90% likely doesn't even know it exists.

Yeah, they're "protecting" themselves right out of the market at the rate they're going

And Sony will try another method if they feel it has cost them money. They are a business afterall.

[Kevin P]

Does the average joe really give a crap? No. He likely and I say 90% likely doesn't even know it exists.

Chances are he'll notice when it causes some sort of conflict and causes his PC to crash. Or a real piece of malware slips in and takes advantage of the rootkit's cloaking mechanism to hide itself (the article describes this), and do some real damage.

Also, note that this scheme is poorly coded and causes resource utilization even when the protected CD isn't being played. It behaves much like spyware or a trojan horse (a non-spreading virus of sorts), injecting itself into the operating system in unconventional ways, and deliberately tries to hide itself and provides no means of removal short of extensive registry surgery. No legitimate software should ever have to resort to these tactics. In short, if you play one of these CDs on your PC, it gets infected with a virus, for all intents and purposes. It also injects itself into the CD-ROM/CD-RW driver in the operating system, which can cause unwanted side effects when legitimately using your CD burner.

People have been jailed for releasing damaging viruses. Sony should immediately recall any and all CDs that use this protection scheme, and offer a free uninstaller which completely removes the malware from victims' systems.

Then they need to seriously rethink their strategy. Not only do these schemes NOT stop piracy, they encourage it, since the illegal copies are unencumbered with any DRM crap, while the legitimate, legal version is.

Intuit used a similarly invasive scheme in TurboTax a couple years ago, and they got lots of flak (and lost a lot of customers) over it. Hopefully Sony Music will learn their lesson, even if they have to do it the hard way.

[aud19]

Does the average joe really give a crap? No. He likely and I say 90% likely doesn't even know it exists.

That was actually my point

At least we're aware of it and can try to protect ourselves. Most of the population will just be hapless victims

[Brandon B]

Don't like it, don't buy their products. They are just protecting their IP. You aren't forced to buy them.

What they have done is quite probably illegal in some states and/or countries.

Your comment is basically pointless. It is fairly obvious that anyone who has read the article would NOT buy this "CD", even an average Joe. Probably the only exception is someone for whom this is a must-have album.

But it is sure as hell worth pointing out the method they have chosen to "protect" their IP as it is in no way explained accurately on the CD itself.

BB

[Brandon B]

Well, they've at least made it slightly less egregious, they have released a patch which lessens the vulnerability of your machine once this stuff is installed.

BB

[Kevin P]

You have to wonder what the world is coming to, when you have to download patches to your music collection... :roll:

[ThomasW]

I'll always be able to find a way to copy a music CD!

Correct!. Turn off 'autorun' for CD/DVD players and rip using EAC .... :wink:

[Brandon B]

Or put it in your Mac . .

[ThomasW]

Turning lemons into lemonaide.....

I read this and thought about the irony...... :B

http://www.securityfocus.com/brief/34

[autio]

I thought this was pertinent. Sony recalls copy-protected CDs

http://news.bbc.co.uk/1/hi/technology/4441928.stm

Thomas it looks like you are going to have to take that Ricky Martin cd out of heavy rotation and send it in to get a new one


Anastasio - Shine
Celine Dion - On ne Change Pas
Neil Diamond - 12 Songs
Our Lady Peace - Healthy in Paranoid Times
Chris Botti - To Love Again
Van Zant - Get Right with the Man
Switchfoot - Nothing is Sound
The Coral - The Invisible Invasion
Acceptance - Phantoms
Susie Suh - Susie Suh
Amerie - Touch
Life of Agony - Broken Valley
Horace Silver Quintet - Silver's Blue
Gerry Mulligan - Jeru
Dexter Gordon - Manhattan Symphonie
The Bad Plus - Suspicious Activity
The Dead 60s - The Dead 60s
Dion - The Essential Dion
Natasha Bedingfield - Unwritten
Ricky Martin - Life

[aud19]

Hahaha!!!! I wonder how much this "cost saving" security feature is going to end up costing them!!! :rofl: Hahahaha!!!

If this doesn't prove how counterproductive and anti-profit copy protection schemes are, I don't know what will!! :lol:

[cinema bob]

Or put it in your Mac . .

thats what i was going to say

[Brandon B]

Oh this gets better. Apparently First4Internet's DRM software lifted some of it's code from other software (LAME) in violation of their copyright.

http://dewinter.com/modules.php?name=News&file=article&sid=215

So Sony violated someone else's IP copyright to "protect" their own. And their latest uninstall patch completely undermines your machine's security, far beyond (IMO) what the DRM did:

The consequences of the flaw are severe. It allows any web page you visit to download, install, and run any code it likes on your computer. Any web page can seize control of your computer; then it can do anything it likes. That's about as serious as a security flaw can get.

The root of the problem is a serious design flaw in Sony's web-based uninstaller. When you first fill out Sony's form to request a copy of the uninstaller, the request form downloads and installs a program called CodeSupport. CodeSupport remains on your system after you leave Sony's site, and it is marked as safe for scripting, so any web page can ask CodeSupport to do things. One thing CodeSupport can be told to do is download and install code from an Internet site. Unfortunately, CodeSupport doesn't verify that the downloaded code actually came from Sony or First4Internet. This means any web page can make CodeSupport download and install code from any URL without asking the user's permission.

http://www.freedom-to-tinker.com/?p=927

BB

[aud19]

Freaking idiots! 8O :roll:

Seriously, when is the entertainment industry going to realize that if they only produce quality and hence valuable product and sell it for reasonable prices they wouldn't even have to worry about pirating!?!?! They need to fire all the dinosaurs they have working for them that keep trying to work from and salvage their old, antiquated and obviously failing business model.

The money they would save on not paying for the developement and use of copy protection schemes, not to mention the costs of cleaning up messes such as the ones in this thread on top of the volume increases they could have if they sold more product at lower costs.... I just don't get it!!! :??

[NMyTree]

Freaking idiots! 8O :roll:

Seriously, when is the entertainment industry going to realize that if they only produce quality and hence valuable product and sell it for reasonable prices they wouldn't even have to worry about pirating!?!?! They need to fire all the dinosaurs they have working for them that keep trying to work from and salvage their old, antiquated and obviously failing business model.

The money they would save on not paying for the developement and use of copy protection schemes, not to mention the costs of cleaning up messes such as the ones in this thread on top of the volume increases they could have if they sold more product at lower costs.... I just don't get it!!! :??

AMEN !!!!

Not to mention the money and man hours they waste in Attorney fees :roll: :roll:

You know, when I was a little kid growing up in the early 70's, we always taped (audio cassettes) our vinyl records and shared it with each other. It was always albums we didn't have, but our friends did. Or albums I had, but my friends did not.

So we would record and swap, for the purpose of turning each other on to new bands/new music. A majority of the time, we would like the tape and then we would do extra chores or odd jobs around the house and neighborhood, to earn some more money (other than our standard allowance) so we could buy the vinyl records we wanted. I'm certain that my friends, I and our rather extensive circle of music lovers were not the only one's in the world doing this. Because we shared our music and turned friends on to new bands/artists, everyone would go out buy the vinyl records and then eventually CDs.

We did this through out our grammar school years, high school years and even in adulthood. When CDs came along, it was the same thing.

Of course this was before the whole downloading off the internet thing.

But what "aud19" has said here, has some real bearing on people's attitudes towards the subject at hand.

I have known and still know many people (both young and old) who have been fed up with the Record Companies and some of the bands (think KISS), because of their greedy, money-mongering tactics and what many perceive as a disrespectful, patronizing, and insulting approach to the way they run their business and treat their customers (us).

This kind of perception has contributed greatly to people downloading and sharing files.

Of course there's always going to be some thieves and criminals who will always have an idea and a scam for ripping someone else off. Those types should be dealt with appropriately.

But let us not forget, some of those scammers are the Record Companies or bands.

[NMyTree]

One more thing.

I have always loved making compilation tapes and CDs. I've been doing that since I was 7-8 years old. I even make by hand (without the assitance of computer software or printers) tape covers and CD covers (for the tape boxes and or jewel boxes). I like to either draw the cover myself or I make it out of clipped pictures from magazines and so forth. It's a lot of fun and it gives me a little creative outlet.

Yeah, I sometimes make them for other people. But more times than not, those people end up buying a few CDs of some of the artists on the compilation.

Is this hurting anyone? I think not.

Check out some of the covers I made....LOL Don't make fun of me , now :B

http://i4.photobucket.com/albums/y147/NMyTree/GooGooDollsCover.jpg

http://i4.photobucket.com/albums/y147/NMyTree/SaraMcLachlanCdCover.jpg

http://i4.photobucket.com/albums/y147/NMyTree/UFOCdCover.jpg

[Brandon B]

Sony has published a list here which lists all affected disks, for inquiring minds.

BB