Slashdot Log In
EFF and Sony Disclose New DRM Security Hole
Posted by
CowboyNeal
on Wed Dec 07, 2005 08:45 AM
from the yet-another dept.
from the yet-another dept.
Dotnaught writes "The Electronic Frontier Foundation (EFF) and SONY BMG Music Entertainment said on Tuesday that SunnComm is offering a patch to fix a security vulnerability with its MediaMax Version 5 content protection software on 27 SONY BMG CDs. Security firm iSEC Partners discovered the hole following a request by the EFF to examine the SunnComm software. The vulnerability involves a directory installed on users' computers by the MediaMax software that could allow a third party to gain control over the affected Windows PC. The EFF and iSEC delayed disclosing the problem until SunnComm could develop a fix."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
yes we all know (Score:4, Funny)
Sue the bastards and get it over with.
Re:yes we all know (Score:5, Informative)
http://www.boycottsony.us/ [boycottsony.us] has the latest news on developments in the Sony case, and www.sonysuit.com lists the lawsuits.
A New lawsuit for Candians is being opened by http://www.glynhotz.com/ [glynhotz.com] an Ontario lawyer. The XCP CDs appear to still be on many store shelves, more than a week after the recall was announced in Canada.
Parent
Useful indeed (Score:5, Insightful)
Perhaps not (Was Re:Useful indeed) (Score:5, Insightful)
From EFF: "We're pleased that SONY BMG responded quickly and responsibly when we drew their attention to this security problem," said EFF staff attorney Kurt Opsahl. "Consumers should take immediate steps to protect their computers."
As if Sony, which already has a boatload of negative publicity, could do anything else. I think even the stuffed shirts there must now realize that they can't let anything else fall through the cracks or their music business might collapse. Don't be surprised in Sony divests itself of BMG music at some point in the future, to keep from losing customers for its home electronics business.
Parent
Re:Perhaps not (Was Re:Useful indeed) (Score:5, Insightful)
"Users don't know what a rootkit is so why should they care"
to
"We are taking the concerns of our customers very seriously, blahblahblah"
Could it be that Mr. Hesse is full of shit?
Parent
Re:Perhaps not (Was Re:Useful indeed) (Score:5, Funny)
Is he a corporate executive?
Parent
Re:Perhaps not (Was Re:Useful indeed) (Score:5, Interesting)
They already lost me. And when a company loses my business, they lose it permanently.
I had a Technics CD player in the mid-80's that had to be fixed repeatedly for the same problem under warranty. When the problem recurred shortly after the unit went out of warranty and they refused to fix or replace it, I sent a polite letter to the head of Panasonic USA explaining the situation and telling them that if they didn't replace the unit I'd never buy a another Panasonic product. They declined to fix or replace the unit and twenty years later, I still don't have another Panasonic product.
You can be sure that there will never be a Sony product in my house in the future.
Of course, this could be their attempt to implement DRM by fear. If your PC gets compromised every time you put a Sony audio disk in the drive, maybe you'll stop doing it. If you don't put the CD in your PC, they don't have to worry about you copying it.
Parent
Re:Perhaps not (Was Re:Useful indeed) (Score:4, Interesting)
Parent
Re:Perhaps not (Was Re:Useful indeed) (Score:4, Insightful)
Why, because Sony's other electronics shops won't be including any DRM built in, like DRM on HDMI and new high def TVs, DRM in new Blu-Ray DVD players, DRM in game machines and on game discs, DRM on Blu-Ray discs... I can almost guarentee that some of this DRM will prevent users from using the content they purchase the way they want to use it. Sony needs not to divest itself of BMG as a solution, because the problem exists at a much higher level - the perception that DRM is a "Good Thing." Until they resolve THAT issue, Sony is in for some hurt.
Parent
Re:Everyone should have known... (Score:3, Funny)
Assume the Position (Score:4, Funny)
Re:Assume the Position (Score:5, Funny)
I really don't want to know what the plug for the hole looks like.
Parent
Quick Question... (Score:5, Interesting)
Their software phones home and cripples your computer. Would anyone here actually trust them?
Re:Quick Question... (Score:5, Insightful)
Most of the victims have no idea that they're installing software on their computer. They're just playing a CD that they bought.
We geeks and nerds on
Blame the criminals, not their victims.
Parent
Re:Quick Question... (Score:5, Insightful)
Ah, but the great majority of victims of the first Sony rootkit still have it installed. They haven't heard about the problem, or head and didn't understand at all. If you take a look at the removal instructions, you'll see that there isn't a chance that your typical Joe Sixpack could ever follow them. If he tried, the result would probably be a machine that didn't boot.
But most of the victims haven't tried to remove it, because they don't have any idea it's there.
You might well hire the burglar if you had no clues that he was the burglar, and if friends and the BBB recommended him. This is an old sort of scam.
Parent
Thank you Sony! (Score:5, Insightful)
Re:Thank you Sony! (Score:5, Interesting)
Parent
Re:Thank you Sony! (Score:3, Insightful)
Antivirus software reporting the Sony DRM software as a virus should take care of that.
Oh yes, and popular DJ's on national radio should warn their audience about the Sony DRM shit^H^H^Hoftware.
Build it into the OS (Score:3, Funny)
software, and some of these will constitute a security threat.
Surely the solution is obvious. If they built DRM software directly into the
operating system, then it could be happily updated with all the rest of the
software, using whatever update mechanisms your OS provides.
I'm sure that the security minded folks on slashdot will be the first to
support a legal requirement for DRM in all OS'es, so that we can solve this
problem before it becomes really serious.
Phil
Re:Build it into the OS (Score:3, Insightful)
Re:Build it into the OS (Score:5, Insightful)
DRM software has to do more than regular software to prevent users from circumventing it, with the latest craze being OS hooks.
Insecure software + OS hooks = HUGE security risks.
If you ever want to release a worm that takes advantage of a DRM security hole, just put it on a web site that tells you how to disable that particular DRM. People will google for a way to disable their DRM, go to your site, and WHAM.
Parent
Sorry to be rude (Score:5, Insightful)
Way to go Sony , you truly are a bunch of arse-holes .
Well at least if this gets major press coverage it may cause an even large headache to ever encroaching wave DRM
Did you catch the best part? (Score:4, Interesting)
"Sony said it will notify customers though a banner advertisement directly in the SunnComm software"
So now you get banner ads with your audio cd+DRM.
Nice.
Parent
Effective DRM (Score:5, Funny)
Revised titles for Sony Rootkit CDs (Score:5, Funny)
Alicia Keys - Unplugged, but still Infected
Amici - Forever Defined as Dishonest
Britney Spears - Hitme, but Don't RipMe
Cassidy - I'm A Hustla in Your PC
David Gray - Life In Slow Motion Since your PC has a Rootkit
Faithless - Forever Faithless Sony
Imogen Heap - Speak For Yourself, I Love Rootkits
Leo Kottke/Mike Gordon - Sixty Six Steps to Uninstall the Rootkit
Raheem Devaughn - The Hate Experience
Santana - All That I Am Allowed to Copy
Stellastarr* - Harmonies for the Haunted PC
Various - So Annoying: An All Star Tribute To Rootkits
Wakefield - Which Side Are You On? Sony or the Public?
YoungBloodZ - Everybody Know Me, Nobody Copy Me
Here's another (Score:3, Funny)
Re:You know... (Score:3, Interesting)
You might wanna check out last.fm [last.fm] instead. Not exactly to get more top-40-ish in your musical taste, but to find all sorts of cool music you would never come across otherwise. Just type the names of those bands you don't know into their interface, and listen to some preview tracks. Or let them analyze your listening habits and suggest music to you. They even give you your own personalized radio station.
No, I'
Not just age, also artificial narrowing of choices (Score:5, Informative)
I think that you missed the poster's point, since you mention old pop chart stars. The problem isn't that today's pop charts don't feature yesterday's pop chart music nor soundalikes --- expecting that would be totally dumb.
The problem is that today the music scene is ruled 99% by the pop charts as a result of the ruthless efficiency of the Big Business side of the music industry, to the extent that almost all other musical styles are marginalized to near extinction. Musicians no longer come out of art school wanting to do something novel for their own niche audience; greed has overcome artistic integrity.
Back in the day, the studios and labels were comparatively amateurish and ineffective, so public tastes were strongly influenced by radio station jockeys, through student union gigs/concerts, and by music tabloid reviews of live acts. These have almost no effect today. The image makers and immense marketting machine hold the scene in a vice-like grip.
So it's not old age, only. It's also that musical horizons have been slammed down tight all around us, with only a few wonderful exceptions to the rule offering a temporary escape.
Parent
I wonder.. (Score:5, Interesting)
No more money for Sony (Score:5, Insightful)
Great, now not only do I have to make sure all my users' applications are patched, but I have to track patches on every frigging DRM implementation out there as well.
Well, payback is a bitch.
I have already steered a friend away from a Sony stereo to another brand, making it clear that Sony is not a good "citizen" and they would do well to stay clear of any Sony products.
Yes, I am only one puny person, but I've already cost them a couple of hundred bucks, and will continue do so at every opportunity.
Onion article (Score:4, Insightful)
Now lets see (Score:4, Insightful)
Or
Sit here and rip the whole thing off the net for free and burn it to CD and copy it to my IPod.Yeah DRM is a great way to stop piracy.Maybe they should try offering value for money instead.
The only real fix ... (Score:4, Insightful)
Frankly, I want to see a major mea culpa from Sony on just about every TV and radio station that targets the audience from all of those DRMed audio CDs complete with previous said instructions and a promise (that will be kept) that such DRM techniques will never be used in the future.
Considering that even artists themselves are starting to fight back against DRM stating that it does nothing but hurt the fans, which is true, it's about time for the heads of these companies to realize that Sony has crossed the line and that DRM for audio CDs is not only useless but can have dire consequences. I'm not going to use that silly "information wants to be free" dogma that is used too often on
Maybe they should - gasp! - try adding value that the customer wants and cannot get over the Internet through downloading rather than trying to add chains to a product that we want to legally buy. For example:
* Buy the CD and get the concert DVD for 1/2 price
* Buy the CD and get a discount on concert tickets and merchandise
* Buy the CD and accumulate points that can be redeemed for other items
Tactics like these, where items that cannot be downloaded are offered as incentive, is a much better alternative to increase sales than pissing off the customer base by nefarious methods such as DRM. This is particularly true because DRM can be defeated by one simple method: CD line out --> PC line in.
In short, make it worth my while to buy the CD and not download it. DRM, particularly the kind that Sony implemented, does the opposite.
iSecPartners (Score:3, Informative)
Funny but I feel safer with "disreputable" sources (Score:5, Interesting)
The other farce in this fiasco is that these methods of protection are so easy to defeat that "anyone" who actually uploads music would not be slowed down for even a second.
So we have an extreme example of a rights denial system that penalizes in the extreme the clueless who never were going to upload anyway, and does nothing, not one iota, to stop uploaders.
Earth to idiots at corp HQ. Sony will feel the pain for years to come on this one. If I were an artist, I would be looking for a "no DRM" clause in my contracts when dealing with these morons.
EFF (Score:5, Funny)
Sony Software (Score:5, Interesting)
Re:Sony Software (Score:4, Funny)
Parent
Doubly Screwed (Score:4, Insightful)
It's this kind of backlash now that is bustin Sony, because anything they put out from now on better be bullet-proof, or else it will wind up being counterproductive
DRM (Score:4, Funny)
Some doctors used to recommend cigarettes.
Third party? (Score:4, Funny)
This is Windows we're talking about; I wouldn't be surprised if we're on to the seventh or eighty party by now.
One thing that isn't clear in this announcement: (Score:4, Interesting)
Does this mean that once the SunnComm DRM software is patched it will go back to working as designed -- that is, do the DRM restrictions continue to constrain the end users' freedoms to use the music? Is the SunnComm software "fixed" or removed?
I would have been happier to have heard they designed a removal tool.
*grumblecakes*
The Hits Just Keep On Coming (Score:4, Insightful)
I am still waiting to see how you patch a CD -- short of replacing it entirely, that is.
For now, I wouldn't trust Sony to patch my Tinkertoys properly, let alone my computer.
Seems to be some confusion here... (Score:4, Insightful)
This is not the "rootkit" DRM software that were talking about here. This is the other DRM crapware that Sony/BMG has on its discs. I buy a moderate amount of music on CDs, then rip them to MP3s to play on my Rio and car stereo. I was planning to buy Carlos Santana's new disc when this whole flap came up. I checked, saw that Santana wasn't on the rootkit list, and briefly considered buying it, although I have avoided all DRMed music to this point. No worries, I'll rip it on my Linux box anyway.
I changed my mind, and I'm glad I did. One less bit of malware in the stream of commerce. I did go to Carlos' website and told them I had decided not to buy the disc and why. From the notes there, it seems they have been getting a lot of that. This may be the most effective way to deal with this issue. Tell the artists that you will not buy their art, if it comes packaged with such crap.
Confusing the Consumer (Score:5, Interesting)
The response was, "Which one do you want".
The clerk knew of the issue. He even helped me confirm that the catalog number for the disk was a match. The titles were still on the shelves for sale. The store was replacing the disks as new disks came in from Sony.
Two out of three record stores that I checked that day had the titles available for purchase.
This is a recall?
Also, it is not as if you can look on the spine of the CD to find out that it is a Sony disk. These disks are sold under other label names. I believe that the one I got was an Electra. Sony/BMG is in the really fine print on the back, as well as the XPC URL.
Re:Bad Music (Score:3)
I may not like most of the music there and can see your point
Re:Bad Music (Score:4, Funny)
You must be new here.
Parent
Re:Bad Music (Score:3, Funny)
On romantic evenings I turn off the music to make sure no one's home.
Re:the paranoid ac (Score:4, Informative)
To install the software originally the user had to be an administrator (a lot of software requires admin rights because most of the system won't allow a basic user to install system-wide software. e.g. It could add files in your user directory and the like, but not in Program Files). From then on the software is running as System, operating as a part of the system (which is why it's called a root kit).
My guess is that the folder where the software is stored has the ACLs set to Everyone with Full Control, or something similar. Because this root kit is run as System when the system boots up, a simple user exploit could circumvent user isolation by overwriting some of the rootkit files, and on next boot it'll be running as System, with full local permissions.
Parent
Re:the paranoid ac (Score:3, Interesting)
Hey, Paranoid, you're not paranoid enough.
I keep noticing the same misuse of the passive voice to avoid saying who's to blame. As a programmer, it's perfectly obvious to me that no computer ever installs software by accident. It takes some significant software to install something like this, and (as the Intelligent Design folks like to point out), this software doesn't get there by random flipp