Comments on: Sony pwns your computer

Sony pwns your computer

pjern — Mon, 31 Oct 2005 17:01:51 -0800

Do you play Sony DRM-protected CD's on your computer? If so, you might be wide open in terms of security. It seems that Sony is installing an almost-impossible to find rootkit on the computers of purchasers of their music. Their EULA doesn't mention the fact that their "small, proprietary" program goes much too far, managing to bypass security software, firewalls, etc. You might want to do this, anyway.

By: pjern

pjern — Mon, 31 Oct 2005 17:06:26 -0800

drat, the link should be here. jessamyn, or matt, help!

By: delmoi

delmoi — Mon, 31 Oct 2005 17:06:55 -0800

If you ask me, the authors of this software ought to be arrested for hacking, EULA or no.

By: caddis

caddis — Mon, 31 Oct 2005 17:13:25 -0800

Disabling autorun is one of the first things I take care of when I buy a new computer. I understand why the default is to have it on, but most people really don't need it.

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 17:13:57 -0800

How about a much, much better way of turning off AutoPlay for starters? (Tweak UI - why it's not bundled with Windows I have no idea).

By: mrgrimm

mrgrimm — Mon, 31 Oct 2005 17:14:28 -0800

(I think you had the permalink right. His site is just barfing, or there's a typo somewhere.) Reading the article now. Fascinating ...

By: mrgrimm

mrgrimm — Mon, 31 Oct 2005 17:15:35 -0800

I'll second the Tweak UI suggestion. Useful for lots of little things for fixing Windows.

By: tommasz

tommasz — Mon, 31 Oct 2005 17:16:53 -0800

Why do record companies insist of treating their paying customers as thieves? It seems to give them the idea that they can do anything they want. Like, say, installing rootkits.

By: caddis

caddis — Mon, 31 Oct 2005 17:17:26 -0800

By the way, I am hoping some aggressive lawyer decides to take this case and sue these bastards for trespass, etc. (on preview: Tweak UI is definitely the easy way to go here)

By: keswick

keswick — Mon, 31 Oct 2005 17:18:04 -0800

Lemme guess, Mac users need not worry? :D

By: clevershark

clevershark — Mon, 31 Oct 2005 17:20:46 -0800

Disabling autoplay is good, but categorically to buy these musical trojan horses is better. If you treat me like a thief I will simply not do business with you.

By: clevershark

clevershark — Mon, 31 Oct 2005 17:23:34 -0800

duh... I meant "categorically refusing to buy", of course.

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 17:24:12 -0800

So, am I right in saying that this doesn't actually prevent someone downloading Audacity, selecting What-U-Hear or Wave Out or suchlike as recording input and making a DRM-free MP3? And is hence almost worthless, since if someone intends to share music they will probably have the modicum of technical knowledge required to do this? Sony manufacturers PCs. Sony breaks same PCs. PROFIT! Does anyone know the process that would lead Symantec and co to treat this as a virus or hostile program?

By: TechnoLustLuddite

TechnoLustLuddite — Mon, 31 Oct 2005 17:26:47 -0800

...or will spyware detectors like AdAware sniff it out?

By: clevershark

clevershark — Mon, 31 Oct 2005 17:28:02 -0800

This sort of criminal BS makes me want to, say, rip such albums using a strong OS (like freeBSD, for example) and making them available on P2P networks. Then again I'll leave the law-breaking (suck cracking is a computer crime) to the record companies. I guess the music industry *is* a criminal cartel after all.

By: clevershark

clevershark — Mon, 31 Oct 2005 17:29:04 -0800

duh... "such cracking is a computer crime." I don't know why my typing is so bad today, I haven't even been drinking!

By: PurplePorpoise

PurplePorpoise — Mon, 31 Oct 2005 17:32:50 -0800

TechnoLustLuddit - you'll need something like RootkitRevealer. (- and a modicum of technical knowledge...)

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 17:44:02 -0800

Unleash the fury!

By: Ethereal Bligh

Ethereal Bligh — Mon, 31 Oct 2005 17:47:19 -0800

"...am I right in saying that this doesn't actually prevent someone downloading Audacity, selecting What-U-Hear or Wave Out" That's a strange question. We'll forever be able to make analog copies of digital recordings. They can't stop that.

By: jessamyn

jessamyn — Mon, 31 Oct 2005 17:55:12 -0800

the link looks ok to me, email me if you need something changed.

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 17:59:17 -0800

Ethereal Bligh, maybe I'm missing the point but I don't see what element of the method I've suggested is analog... Windows gives digital output to the soundcard, the soundcard gives digital output back to windows, Audacity records it... does it not result in a perfect copy (if you use WAV instead of MP3 I mean)?

By: Western Infidels

Western Infidels — Mon, 31 Oct 2005 17:59:31 -0800

I wonder what happens when one of these "protected" CDs is inserted into a system that no longer supports the Win32 mechanisms required to make this work. Such systems will be the norm in 5-10 years, and an awful lot of people will still have shelves full of CDs.

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 17:59:44 -0800

Link was only temporarily brok

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 18:01:15 -0800

Query: Does Sony put the "Compact Disc Digital Audio" logo on these monstrocities, even when they, um, aren't?

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 18:09:30 -0800

nb while this post is certainly public, a service and an announcement, those tags would probably be better off as one.

By: mr_roboto

mr_roboto — Mon, 31 Oct 2005 18:14:25 -0800

This really is beyond the pale. It's amazing that they'd go into a legal grey area for the (vanishingly marginal) benefit that this kind of copy protection gives them. I guess they figure a EULA will shield them from any liability; I suspect they might be wrong. Pretty_Generic writes " Query: Does Sony put the 'Compact Disc Digital Audio' logo on these monstrocities, even when they, um, aren't?" I think they're multisession discs, and the audio data does conform to the standard. That's how they play in most devices. In fact, the only device they don't behave as normal CDs on is a computer running Microsoft Windows.

By: Western Infidels

Western Infidels — Mon, 31 Oct 2005 18:14:37 -0800

Pretty_Generic: Does Sony put the "Compact Disc Digital Audio" logo on these monstrocities, even when they, um, aren't? These malware-protected discs could actually be perfectly standards-compliant, and as worthy of the CD-DA name and logo as any other music CD. There are other systems that try to confuse CD-ROM drives by corrupting the actual musical data - those are not CD-DA standards-compliant.

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 18:34:17 -0800

In fact, the only device they don't behave as normal CDs on is a computer running Microsoft Windows. I can't understand why, if the CD-DA section is truly standards compliant, it can't be read by Windows Media Player etc as a normal CD that happens to have some data on it. Please be as technical as you like in explanation...

By: mr_roboto

mr_roboto — Mon, 31 Oct 2005 18:43:24 -0800

That's the part I don't entirely get. I know that if you let it install the malware, it will be on the lookout for the disc, and won't let it be played. Based on what I've read though, even if you have autorun disabled and fail to install the malware, you can't see the music on the disc. I don't quite get that. Especially since it looks like a regular audio CD in other OSs.

By: fire&wings

fire&wings — Mon, 31 Oct 2005 18:44:40 -0800

As if the average consumer didn't have enough reasons not to purchase a CD.

By: showmethecalvino

showmethecalvino — Mon, 31 Oct 2005 18:59:47 -0800

This is why I stopped buying CDs.

By: Civil_Disobedient

Civil_Disobedient — Mon, 31 Oct 2005 19:04:15 -0800

I'd love to operate outside the confines of the law through a corporation. Then I could r00t people's computers without getting an 18 month jail sentence.

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 19:09:12 -0800

Ah, Sony BMG. This is just as great as the last time Germans and Japanese started working together.

By: five fresh fish

five fresh fish — Mon, 31 Oct 2005 19:23:48 -0800

If so, you might be wide open in terms of security. Nope. Gotta Mac. Happy days! In fact, the only device they don't behave as normal CDs on is a computer running Microsoft Windows. Nope. It doesn't play in a good number of car stereos, either. Sad days!

By: Western Infidels

Western Infidels — Mon, 31 Oct 2005 19:26:06 -0800

Pretty Generic: I can't understand why, if the CD-DA section is truly standards compliant, it can't be read by Windows Media Player etc as a normal CD that happens to have some data on it. Please be as technical as you like in explanation... As long as you keep the included self-installing stealth malware from installing, you probably can play the disc in WMP or what-have-you just fine. I'm guessing these CDs are CD-Extra discs, or "Blue Book" discs. The non-protected versions are usually marketed as "CD Enhanced" audio CDs - here's one example. They generally include some music videos, song lyrics, promos for other albums, etc. Auto-mounted in Windows, they appear to be data discs, but they respond to CD player apps like WMP as well.

By: Pretty_Generic

Pretty_Generic — Mon, 31 Oct 2005 19:28:20 -0800

As long as you keep the included self-installing stealth malware from installing, you probably can play the disc in WMP or what-have-you just fine. Can anyone verify this? I find it kinda hard to believe - it undermines the whole DRM thing entirely.

By: Eideteker

Eideteker — Mon, 31 Oct 2005 19:31:49 -0800

Geez, just download your music, people. It's the 21st Century.

By: clevershark

clevershark — Mon, 31 Oct 2005 19:33:50 -0800

Well, this copy protection bullsh*t has resulted in one lost sale as far as I'm concerned -- I was going to shell out for Paul van Dyk's Reflections album, until I saw the sticker notifying me of the copy protection on the CD. I left the store without buying anything -- if the music industry is going to treat me like a thief no matter what I do, I might as well act the part and save myself a few bucks in the process.

By: ROU_Xenophobe

ROU_Xenophobe — Mon, 31 Oct 2005 19:56:29 -0800

Can anyone verify this? I find it kinda hard to believe - it undermines the whole DRM thing entirely. It looks like that's not actually true -- if you disable autorun, the computer loads the data session, not the audio. It's still trivially easy to circumvent, it seems. (1) Disable autorun and load. (2) Make bitwise copy of disc with EAC (or otherwise rip the audio session to .wav or .flac with EAC). Badabing, badaboom. Not that I've verified this. Lots of DRM is absolutely trivial to defeat. Earlier cd protection schemes could be entirely defeated by disabling autoplay, and Acrobat encyption is/was just plain old ROT13.

By: selfnoise

selfnoise — Mon, 31 Oct 2005 20:01:32 -0800

Occasional bizarre, self-defeating attempts at DRM aside (anyone really suprised to see this coming from Sony?), seems to me that buying CDs is still a much better idea than buying DRMed music online. The only alternative that gives you more actual options is pirating the music. Of course, then you give up your right to bitch and moan, which is no fun.

By: clevershark

clevershark — Mon, 31 Oct 2005 20:02:59 -0800

I wonder if this nonsense can be defeated using a Sharpie marker...

By: Western Infidels

Western Infidels — Mon, 31 Oct 2005 20:19:24 -0800

Pretty_Generic: Can anyone verify this? I find it kinda hard to believe - it undermines the whole DRM thing entirely. It does seem hard to believe that record execs would risk so much consumer backlash for a pathetically-ineffective copy protection scheme that could very well also be lawsuit-bait, but there's precedent. From the "this" link in the OP, concerning a similar system:

The disc has "Copy Protection" from SunnComm called MediaMax, which on some Windows systems will force the user to install software in order to listen to their music, and restrict what they do with the audio (for example you cannot make MP3s). If SunnComm sounds familiar, they should. These are the folks who were going to sue a Princeton student for 10 million dollars for writing a paper that showed by pressing the shift key while inserting the CD (and of course, pressing the shift key still worked on this CD, according to all reports) you can bypass their copy protection.

Holding down the shift key while inserting the CD is just a case-by-case way to disable AutoPlay. Without SunComm's malware crippling the music-owner's PC, the SunComm "protected" audio tracks are completely exposed. I think this sort of behavior is good evidence that the decision makers at the record companies aren't very technically savvy, which isn't too surprising. What's more surprising is that they haven't done anything to rectify that situation over the last 10 years. As a result, they buy into bogus snake-oil "copy prevention" schemes again and again. What delicious irony - the record companies really are victims these days, although not quite in the way they imagine. The execs would be better off spending the dough on promotion. Or beer, even.

By: chrominance

chrominance — Mon, 31 Oct 2005 20:45:19 -0800

Aren't very technically savvy? They've managed to infiltrate your computer to such an extent that Russinovich had to use tools he built himself to peer at the inner workings of the kernel, just to find out what this stuff was. No regular user would even think to use Rootkit Revealer; few computer savvy users who aren't system admins or IT-trained will be able to go much further without assistance. Just because it's essentially a trojan horse that you have to run doesn't mean it's not sophisticated. In addition to Sony BMG releases, a quick glance at the company's press site reveals that Upstairs Records (distributed by Universal Music) and EMI are also using the technology. Just so you know who to boycott.

By: odinsdream

odinsdream — Mon, 31 Oct 2005 21:43:25 -0800

Aren't very technically savvy? They've managed to infiltrate your computer to such an extent that Russinovich had to use tools he built himself to peer at the inner workings of the kernel, just to find out what this stuff was ... All of which, of course, has nothing to do with RIAA executives - and everything to do with their hired guns, the SunComm folks. Just because they're completely illiterate when it comes to technology doesn't mean they don't know how to find people who aren't. Unluckily for them - the folks they found are clever enough to know how much money they can siphon out of RIAA by claiming to have the perfect copy-protection solution. I'm absolutely certain that everyone at SunComm that actually touches code knows such a thing is impossible. But, that's what pays their bills - even if it is pretty unethical.

By: salmacis

salmacis — Tue, 01 Nov 2005 02:43:19 -0800

Geez, just download your music, people. It's the 21st Century. Care to point me to a legal site that wil sell me music without DRM? EMusic doesn't have any major label music, and allofmp3 is of dubious legality.

By: caddis

caddis — Tue, 01 Nov 2005 03:58:57 -0800

I am no fan of "stealing" music online. However, when the music company is trespassing in your computer like this, I think the moral compass swings much more strongly in favor of just downloading it for free. It's not really for sale legitimately anyway, not when it comes with malware.

By: Captaintripps

Captaintripps — Tue, 01 Nov 2005 04:39:04 -0800

Here's a tip on digital rights management protected discs (that probably only works with small to medium-sized labels): Call the label's customer service department and ask for a non-copy protected disc. Most will replace it for you. I know of several labels that tested the waters with digital rights management and after enough complaints, just decided to go without it. Or, as I do, when you find you've bought such a disc, return it and notify the label and distributor that released it.

By: Optimus Chyme

Optimus Chyme — Tue, 01 Nov 2005 05:41:47 -0800

I don't know who Van Zant are - maybe some hip dude could fill me in - but I definitely plan on finding this album online and permanently sharing it via ftp and bittorrent. Obviously, there are plenty of other artists who are forced to use Sony's insane DRM, but, like the 10 year-old girls the RIAA sues, someone has to be made an example of.

By: blag

blag — Tue, 01 Nov 2005 06:21:48 -0800

Jesus fucking Christ. EULA's like this send shivers down my spine.

As soon as you have agreed to be bound by the terms and conditions of the EULA, this CD will automatically install a small proprietary software program ... onto YOUR COMPUTER. The SOFTWARE is intended to protect the audio files embodied on the CD, and it may also facilitate your use of the DIGITAL CONTENT. Once installed, the SOFTWARE will reside on YOUR COMPUTER until removed or deleted. (ok. how?) You expressly acknowledge and agree that you are installing and using the licensed materials at your own sole risk. Should the licensed materials prove to be defective, you ... agree to assume the entire cost of all necessary servicing, repairs or corrections. (not sure this is possible under UK law) No SONY BMG party shall be liable for any loss or damage ... such damages include, but are not limited to, loss of profits, loss of revenue, loss of data, loss of use of the product or any associated equipment, down time and user's time, even if the SONY BMG party concerned has been advised of the possibility of such damages. The SONY BMG PARTIES may from time to time provide you with updates of the SOFTWARE in a manner that the SONY BMG PARTIES deem to be appropriate. (this worries me. can you say 'backdoor'?)

I would love to see this tested in court: isn't there a long-standing precedent which requires that the parties to an agreement need to understand fully what they're entering into?

By: Pretty_Generic

Pretty_Generic — Tue, 01 Nov 2005 06:27:59 -0800

EULAs are still subject to a lil thang we call "rule of law". Don't be too scared.

By: Pretty_Generic

Pretty_Generic — Tue, 01 Nov 2005 06:32:56 -0800

From the article comments: First4Internet, eh?... let's see... according to public records, they were incorporated 24/11/1999. In 2004 they had a turnover of £709,941 and operating expenses of £1,301,546 -- meaning an operating loss of £591,605. In the last five years they have, on average, lost £541,067 a year. For 2004, their credit rating is "HIGH RISK" (complete with capitalisation). Meanwhile, the four directors share annual renumeration of £224,413 between them (average £56,103 each). One of the directors, Nicholas Bingham, (appointed in 2002) was director of "Sony pictures home entertainment Ltd." from 1989 to 1997, and director of "Sony pictures television production UK Ltd." from 1996 to 2000, and director of "Sony digital radio europe Ltd." from 1994 to 2000. A cynic might say Sony selected this inept copy protection technology because it was supplied by one of thier cronies. The reason this is a bad business practice can be seen by the software's many failings. lol.

By: mumble

mumble — Tue, 01 Nov 2005 06:41:20 -0800

salmacis: Care to point me to a legal site that wil sell me music without DRM? Audiolunchbox.com (currently down for maintenance, oops). Of course, if you mean, "point me to a legal site that sells all the music in iTunes' catalog without DRM", you're probably out of luck. But for indie stuff, you might want to check this store out.

By: Pretty_Generic

Pretty_Generic — Tue, 01 Nov 2005 06:47:32 -0800

What about all those Russian sites?

By: mumble

mumble — Tue, 01 Nov 2005 06:48:44 -0800

Whoops, sorry, salmacis, didn't read that bit about major labels. Nevermind.

By: Ethereal Bligh

Ethereal Bligh — Tue, 01 Nov 2005 09:57:37 -0800

"Ethereal Bligh, maybe I'm missing the point but I don't see what element of the method I've suggested is analog... Windows gives digital output to the soundcard, the soundcard gives digital output back to windows, Audacity records it... does it not result in a perfect copy (if you use WAV instead of MP3 I mean)?" No. Look at what's happening inside the soundcard. It's not going to be an exact copy. I think you're probably right that the CD player's output stays in the digital realm (providing it started there), but it's still been changed as the soundcard processes it. Not to mention that I don't think that what you get when you play a song via IDE is necessarily the bitwise copy you (ideally) get when you rip it with software. You might argue that this gives you something that might as well be a perfect copy, but the same thing could be said of high-quality analog copying, too. Because as long as we can hear it, it's copyable. DRM may succeed in making it very difficult for anyone to make bitwise copies of audio recordings. But then we'll just start making our copies from signals that aren't bitwise identical but for the purposes of human hearing, might as well be.

By: Jimbob

Jimbob — Tue, 01 Nov 2005 20:13:34 -0800

EB's right - as far as I know, recording your soundcard's "Wave Out" essentially re-routes the analog output of the soundcard back into the analog input. It doesn't re-route the digital output to digital input - to do that you need software like TotalRecorder that installs a virtual device driver. You can test this by playing nothing...silence...and recording your soundcard's Wave Out. Normalize it and it will be full of noise from your soundcard's amplifiers.

By: chrominance

chrominance — Tue, 01 Nov 2005 22:38:29 -0800

An interesting point about the specific way this DRM works: anyone who knows about this exploit can also cloak malicious files on your system by using the same filename convention as the DRM files. So not only have the record labels infiltrated your computer, they've left the backdoor open for everyone else as well. This just went from pretty bad to mind-numbingly horrible in terms of computer security.

By: dingobully

dingobully — Thu, 03 Nov 2005 03:22:04 -0800

I'll never buy another CD until Sony stops this shit.

By: caddis

caddis — Thu, 03 Nov 2005 14:38:16 -0800

World of Warcraft hackers using Sony BMG rootkit

By: mrgrimm

mrgrimm — Fri, 04 Nov 2005 09:53:48 -0800

The story hit NPR today.

By: zarah

zarah — Thu, 10 Nov 2005 17:37:56 -0800

A first wave of malicious software written to piggyback on Sony BMG Music Entertainment CD copy protection tools has been spotted online, computer security companies said Thursday.