Spyware Warrior

Nick

I picked this up on The Register and a few other sites.

suzi · Posted: Thu Nov 10, 2005 10:42 am Post subject:

It's also reported by BitDefender, F-Secure and McAfee. Blogged here:

http://blogs.zdnet.com/Spyware/?p=699
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

datababe · Posted: Fri Nov 11, 2005 8:34 am Post subject:

Congratulations, Sony. You've made CNN:

http://www.cnn.com/2005/TECH/internet/11/10/sony.hack.reut/index.html

Anybody checked how Sony stock is doing today...?

suzi · Posted: Fri Nov 11, 2005 9:05 am Post subject:

I'm glad this is getting mainstream media coverage. It certainly puts the pressure on.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

Kimberly · Posted: Fri Nov 11, 2005 9:38 am Post subject:

Detect and disable "cloaking flaw" in Sony's DRM copy-protection
http://www.sophos.com/pressoffice/news/articles/2005/11/stinxe.html

datababe · Posted: Fri Nov 11, 2005 3:14 pm Post subject:

Looks like the pressure is getting Sony's attention:

http://www.cnn.com/2005/SHOWBIZ/Music/11/11/sony.copyprotection.ap/index.html

Nick · Posted: Sat Nov 12, 2005 12:53 am Post subject:

I saw a report on this on my local news. Word has definately gotten out. If you go check the feedback on any of the CD's listed in the following list, which is posted all over the net, you'lll se alot of negative feedback:

Trey Anastasio, Shine (Columbia)
Celine Dion, On ne Change Pas (Epic)
Neil Diamond, 12 Songs (Columbia)
Our Lady Peace, Healthy in Paranoid Times (Columbia)
Chris Botti, To Love Again (Columbia)
Van Zant, Get Right with the Man (Columbia)
Switchfoot, Nothing is Sound (Columbia)
The Coral, The Invisible Invasion (Columbia)
Acceptance, Phantoms (Columbia)
Susie Suh, Susie Suh (Epic)
Amerie, Touch (Columbia)
Life of Agony, Broken Valley (Epic)
Horace Silver Quintet, Silver's Blue (Epic Legacy)
Gerry Mulligan, Jeru (Columbia Legacy)
Dexter Gordon, Manhattan Symphonie (Columbia Legacy)
The Bad Plus, Suspicious Activity (Columbia)
The Dead 60s, The Dead 60s (Epic)
Dion, The Essential Dion (Columbia Legacy)
Natasha Bedingfield, Unwritten (Epic)

Bear in mind that the list isn't completely accurate. For example, the Our Lady of Peace album has 2 versions. A single CD and a double CD. The double CD version doesn't have the Sony rootkit, only the single disc version does. Never the less, the feedack on amazon.com on any of the above is pretty negative.
_________________
Nick's Security Ticker

Trpm · Posted: Sat Nov 12, 2005 3:22 pm Post subject:

Symantec now say they have a REMOVAL tool for the Sony rootkit only.
It only runs in Safe Boot mode only.
It can be found at the links below, the first link is the one I would use as there are instructions, the second is a direct download link.
This will NOT remove any third party Trojan programs that you may have encountered, only the Sony BMG rootkit.
http://securityresponse.symantec.com/avcenter/venc/data/securityrisk.first4drm.html?Open

http://securityresponse.symantec.com/avcenter/FixRyknos.exe

I would like a response from anyone who uses this.

Rex Smile

_________________
I'm a reasonable person just ask Eeyore or Christopher R.

Recon Man · Posted: Sun Nov 13, 2005 4:43 am Post subject:

Hello Everyone Smile

,

I just picked this up from ComputerWorld.com with regards to Sony's DRM RootKit. I hope that you find it informative.

............................................................................................................

Sony BMG pulls copy protection software
The move follows yesterday’s discovery of a virus that relies on the technology

News Story by Reuters

NOVEMBER 11, 2005 (REUTERS) - Music publisher Sony BMG said today that it will stop making CDs that use a controversial technology to protect its music against illegal copying

“As a precautionary measure, Sony BMG is temporarily suspending the manufacture of CDs containing XCP technology,” the company said in a statement.

The decision follows the discovery yesterday of the first virus to uses Sony BMG’s CD copy-protection software to hide on PCs and wreak havoc (see "Hacker uses Sony’s anticopy software to install PC virus"). A hacker had mass-mailed e-mail with an attachment, which when clicked on installs malware. The malware hides by using Sony BMG software -- also hidden -- that would have already been installed on a computer when consumers played one of Sony’s copy-protected music CDs.

The virus tears down a computer’s firewall and gives hackers access to a PC. Sony BMG provided a patch to protect computers against the virus, which is available on its Web site. “We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use,” the company said.

Sony BMG provided software last week to remove the “cloaking element” that enables the virus to hide inside a computer, but the software does not disable the copy protection itself.

The music publishing venture of Japanese electronics conglomerate Sony and Germany’s Bertelsmann AG is distributing the copy-protection software on several recent music CDs from artists such as Celine Dion and Sarah McLachlan, according to user groups on the Web. Sony BMG did not say which CDs or how many CDs were equipped with its software. “The XCP software is included on a limited number of Sony BMG content-protected titles,” it said.

The Sony copy-protection software does not install itself on Macintosh computers or ordinary CD and DVD players.

When the CD is played on a PC running Windows, the software first installs itself and then limits the usage rights of a consumer. It allows playback only with Sony software.

The software last week sparked a class-action lawsuit in California claiming that Sony had not informed consumers that it installs software directly into the “root” of their computer systems with rootkit software. Such software cloaks all associated files and is dangerous to remove.

British antivirus company Sophos PLC yesterday offered a tool to disable the copy protection software. ZoneAlarm, a product of Check Point, also protects against the software.

Sony BMG said it stands by content-protection technology “as an important tool to protect our intellectual property rights and those of our artists”.

..........End Of Article.....................................................................

Well, I knew that this sort of thing was going to happen. Everything is fun and games until someone gets their eye taken out.

Best Regards,

Recon Man Wink

_________________
Helping make Cyberspace a safer place.

Nick · Posted: Sun Nov 13, 2005 6:11 am Post subject:

Microsoft to add the Sony rootkit to it's Windows Defender and Malicious Software Removal Tool

http://www2.spywareinfo.com/2005/11/12/2726
_________________
Nick's Security Ticker

Recon Man · Posted: Sun Nov 13, 2005 4:56 pm Post subject:

Hey Nick

,

Nick wrote:

bob30880 · Posted: Mon Nov 14, 2005 6:49 am Post subject:

Now the Federal Govenrment has chimed in....

"Bush Administration to Sony: It's your intellectual property -- it's not your computer."

http://www.mp3newswire.net/stories/5002/admonish.html

Full story here:

http://blogs.washingtonpost.com/securityfix/2005/11/the_bush_admini.html

I wonder how much this will cost Sony in the long run?

Nick · Posted: Mon Nov 14, 2005 7:31 am Post subject:

And Sony XCP Rootkit Breaks LGPL License

aquias · Posted: Mon Nov 14, 2005 8:46 am Post subject:

You know what's funny, is people are still saying that Mac's are safe and I've several articles referencing that Mac's do not get the rootkit but they ARE getting a different file dropped onto their systems

I'm just curious as to what the file does (craps busting all over the place here so I can't really poke around or provide links, sorry!)

suzi · Posted: Mon Nov 14, 2005 10:32 am Post subject:

aquias, the best place to get the skinny on what the files do is from source.

http://www.sysinternals.com/Blog/

Mark Russinovice tells all the details. You might want to start back with his very first post about it.

http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html

Holy cow - there ave 550 comments in that post!!
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

datababe · Posted: Mon Nov 14, 2005 10:34 am Post subject:

And now for a little levity... Very Happy

http://www.bbspot.com/News/2005/11/sony_photo_sharing.html?from=rss

Although it occurs to me that based on their recent track record, this may not be so far off from what Sony (and other companies like it) might take as a next step. Rolling Eyes

Recon Man · Posted: Mon Nov 14, 2005 1:00 pm Post subject:

Hello Everyone Smile

,

Gadzooks!

Next thing you know there will be a witch hunt for anyone that even remotely resembles a famous person and they will be charged with infringement of copyright for that very same reason Anxious

!

Imagine:

You are being sued for looking like Jon Voight from the back. Laughing

Best Regards,

Recon Man Wink

_________________
Helping make Cyberspace a safer place.

Nick · Posted: Tue Nov 15, 2005 3:03 am Post subject:

Sony's other DRM software

Seems the XCP rootkit isn't the first to install without proper notification.

quietman7 · Posted: Tue Nov 15, 2005 7:24 am Post subject:

Don’t Use Sony’s Web-based XCP Uninstaller
Monday November 14, 2005 by Ed Felten
http://www.freedom-to-tinker.com/?p=926
_________________
Microsoft MVP - Consumer Security 2007-2012

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

datababe · Posted: Wed Nov 16, 2005 9:26 am Post subject:

quietman7 · Posted: Wed Nov 16, 2005 2:18 pm Post subject:

UPDATE (11/16, 2am): Sony has removed the initial uninstaller request form. In its place is the following message:

November 15th, 2005 - We currently are working on a new tool to uninstall First4Internet XCP software. In the meantime, we have temporarily suspended distribution of the existing uninstall tool for this software. We encourage you to return to this site over the next few days. Thank you for your patience and understanding.

http://www.freedom-to-tinker.com/?p=928
_________________
Microsoft MVP - Consumer Security 2007-2012

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

datababe · Posted: Wed Nov 16, 2005 5:58 pm Post subject:

Thanks but no thanks, Sony. If I had this malware, I'd find a reliable uninstall tool from a reliable source.

Elsewhere.

chronotrigger · Posted: Thu Nov 17, 2005 12:13 am Post subject:

Hey,

has anyone here been actually infected with trojans that use the drm rootkit? can anyone give me an email attachment with the trojan specimen. i would like to do some research regarding it. Thanks!!!
_________________
Ad Majorem Dei Gloriam

wawadave · Posted: Thu Nov 17, 2005 1:48 pm Post subject:

_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

suzi · Posted: Thu Nov 17, 2005 11:48 pm Post subject:

ROFLMAO!!

Good one Dave.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

Nick

Microsoft has released signatures for the removal of the rootkit portion of the Sony XCP DRM software. There are 2 ways to get these. One is by updating Microsoft Antispyware with the November 17th update, which is numbered 5777. After updating, choose the full system scan. The other way is to try the Windows Live Safety Center and select the "Full Service Scan" followed by the "Quick scan" option.... Microsoft will also include detection and removal of the XCP rootkit with the December release of their Malicious Software Tool. That will be release on the 2nd Tuesday of the month or December 13th. ref here

Note that either Microsoft removal technique will only remove the rootkit portion of the XCP software. The digital rights management software will remain. Also, some of the other removal tools do not remove the rootkit but only uncloak it.

quietman7 · Posted: Sat Nov 19, 2005 8:21 am Post subject:

List of 52 infected Sony CDs being recalled
_________________
Microsoft MVP - Consumer Security 2007-2012

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

datababe · Posted: Sat Nov 19, 2005 11:04 am Post subject:

One rootkitted CD from Sony: $7.19
One class action lawsuit from California: $1,000,000,000+
One picture perfect post from wawadave: PRICELESS

Laughing

suzi · Posted: Sat Nov 19, 2005 2:09 pm Post subject:

wawadave · Posted: Sat Nov 19, 2005 7:43 pm Post subject:

you know i could have started up a real photo editing program. but i remembered yug,s tat,s and used the same low grade paint program and you know it gets the point across lol thx suzi and datababe!

its quite facetious isn,t it!
Laughing

_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

Recon Man · Posted: Sun Nov 20, 2005 4:33 am Post subject:

Hello Everyone Very Happy

,

To datababe:
Great take on the whole Mistercard thing Laughing

!

To wawadave:
The picture's message does get right to the point Laughing

!

My contribution here? Dunno

Well, I can make balloon animals Rolling Eyes

!

Best Regards,

Recon Man Wink

_________________
Helping make Cyberspace a safer place.

quietman7 · Posted: Mon Nov 21, 2005 9:59 am Post subject:

Texas Sues Sony Over Alleged CD Spyware
_________________
Microsoft MVP - Consumer Security 2007-2012

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

wawadave · Posted: Mon Nov 21, 2005 11:06 am Post subject:

if yer in texas.....

Click Here For Online Complaint Form law suit agaist Sony Cor-piration!
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

datababe · Posted: Fri Nov 25, 2005 9:02 am Post subject:

And now the artists are getting ticked off, as well they should:

http://businessweek.com/technology/content...1122_343542.htm

Recon Man · Posted: Fri Nov 25, 2005 10:18 am Post subject:

Hello Everyone Very Happy

,

Oh yeah Rolling Eyes

, what a big surprise.

It was only a matter of time before the artists that Sony was trying to 'protect' were going to feel the backlash related to the whole Sony/BMG fiasco. Oh, and this is only the tip of the iceberg.

For those of you that are old enough to remember, there was the great Tylenol Scare of the 1970's when some lots of Tylenol were found to be laced with arsenic. Well, they did catch up with and arrested the guy responsible, and who was also found to be a certified lunatic. The McNeil company, makers of the famed analgesic, had to spend millions of dollars in advertising and repackaging in order to gain back the consumer's confidence by introducing tamper-free packaging.

But this Sony/BMG thing is a zebra of a different stripe because, had it not been because of Mark Russinovich discovering the rootkit, then who knows what it could have led to. I have no doubt that some people are likely to start to developing an itchy rash or nervous tick at the mere mention of Sony for quite a while.

datababe wrote:

datababe · Posted: Fri Nov 25, 2005 11:22 am Post subject:

Well Recon Man, I'm not sure how much hope I hold out for the majority of consumers paying enough attention to this to teach Sony (and others) a strong lesson:

http://www.theregister.co.uk/2005/11/22/analysis/

*sigh* Though I am hearing more reports of Sony CDs (and in at least one case, all music CDs period) being banned in the workplace for security reasons. It wouldn't surprise me if that happens where I work eventually. In the financial industry, it would only take one Sony rootkitted machine and one security breach to bring the auditors swarming.

This ain't over yet.

Recon Man · Posted: Sat Nov 26, 2005 12:21 pm Post subject:

Hello Everyone Very Happy

,

datababe wrote:

wawadave · Posted: Sat Nov 26, 2005 12:46 pm Post subject:

when the cor-pirations start useing true cor-pirate type actions to comendear and take over some ones pc because they can.
Than something needs to be done to this cor-pirate.
in the old days keelhauling ,hung by the thumbs on the yard arms,pilocking,hand removel,whipping,tar and feathering....etc.etc.

might be this is needed to day!!! to get these cor-pirations to quit fleeseing the sheeple!!!!!!!!!!!!! Evil or Very Mad

_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

wawadave · Posted: Sat Nov 26, 2005 12:47 pm Post subject:

CHANGE this to these!!!
since i cannot edit my own posts!!
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

datababe · Posted: Tue Nov 29, 2005 9:04 am Post subject:

Well well well - look who's now getting on Sony's case.