Sony Installs 'Rootkits' On Users Machines

Advertisement (Why?)

In what's set to be 2005's hottest story yet Sony have been found to install illegal Trojan horse-based digital restrictions management (DRM) technology that installs itself as a rootkit on Windows PCs.

Users who purchase certain Sony Music CDs from online stores like Amazon are subject to this rootkit being installed on their machines. According to Sysinternals' Mark Russinovich the kit installs itself in hidden directories and attempts to mask its existence as "Essential System Tools".

What's more fun is that attempting to remove the rootkit with common tools that perform a RKR scan will render a Windows XP machine useslesss. "Users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files," Mark wrote in an online blog entry yesterday.

So what exactly is Sony playing at? Installing rootkit software that's not identified in its EULA and rendering machines useless if users try to remove the software! This is taking the RIAA effort a little too far.

View: Mark - Sysinternals Blog Entry

View: Sony Music

View: The Devil aka RIAA

What's new:

General

new: Remove old BIOS information compatibility option
new: Keyboard layout and Language group unattended options
update: .NET Framework 2.0 compatibility
update: Redesigned few pages, more readable
update: Smaller final size by compressing more files
update: KB891957-x64, KB906569, KB899589-v2, KB900725 integration
update: RVM Pack 2.0+ support
fix: Missing DATA folder error message
fix: Driver integration from read-only media

Components

new: Keyboard layouts
new: Acm Core Codecs
new: Network Location Awareness (NLA)
update: NetDDE (back)
update: Printer Support (removes spooler service)
update: BlueTooth not dependable on Modem Support
update: WMP connectivity not dependant on ICW
fix: SCSI drivers component detection

#1 Lasker on 01 Nov 2005 - 18:48

thanks god I don´t need to buy these craps

I got from others sources

(3 replies) #2 jasondefaoite on 01 Nov 2005 - 18:49

It says a lot that downloading a cd illegally is a safer option from a security point of view. Way to go Sony!

#2.1 eck0 on 01 Nov 2005 - 19:28

So.. buying it *legally* is unsafe, but downloading the CD will not only be illegal, but it is considered safer then buying it?

I'll continue with my pirated copies.

edit: oh btw, LOL @ The Devil

#2.2 sphbecker on 02 Nov 2005 - 18:05

And they wonder why people are worried about Sony having so much control over the next HD video standard...

#2.3 tophat on 03 Nov 2005 - 00:08

sony's pushing blu-ray, correct? (rather than HD-DVD)

blu-ray looked like a better technology... but, this bodes poorly.

#3 webeagle12 on 01 Nov 2005 - 18:52

way to go

(2 replies) #4 KC on 01 Nov 2005 - 18:52

Thats messed up. I really doubt I will ever buy from sony again.

#4.1 tophat on 02 Nov 2005 - 01:27

Remember to avoid their hardware. Look what they're doing to your drive now with their rootkit. What sort of crap will come with the drivers for their cd/dvd burners?

This will be integrated right into the driver, with no possibility of removal.

You can no longer trust Sony, at all.

#4.2 DigeratiPrime on 02 Nov 2005 - 01:44

This is unbelievable! Go to h311 Sony!

Mark R. you rule

#5 B0GiE on 01 Nov 2005 - 18:52

Unreal! Is anybody going to sue Sony? I certainly hope so.

#6 dhavalhirdhav on 01 Nov 2005 - 18:54

EU u read this?? now sue Sony.

#7 Ficman on 01 Nov 2005 - 18:55

This is the stuff that chaps me, installing this kind of crap (without warning) is just wrong.

(1 reply) #8 eSauce on 01 Nov 2005 - 18:55

is it still considered illegal even if they state they might install some kinda security thingy on your system thru Sony's EULA?

#8.1 tophat on 02 Nov 2005 - 01:10

As far as I can tell, there's no eula. So... take that how you may.

#9 buzlink on 01 Nov 2005 - 18:56

Really nice!

#10 khurrram on 01 Nov 2005 - 18:56

well well well .. look what we found ! .. tut tut sony !

#11 b0m8er on 01 Nov 2005 - 18:59

Not that I buy CDs often

but I'd never buy from sony again.

#12 B3AN on 01 Nov 2005 - 19:08

And they wonder why their business is going down the pan when they do stunts like this.

#13 Cool4 on 01 Nov 2005 - 19:09

that would be awesome you wanted to listen these cd's in your ps2/ps3 and it cracked everything up

I'll wait some serious time before I buy a ps3, not to mention that sony cds can be downloaded

#14 CDog on 01 Nov 2005 - 19:14

That's terrible :|

#15 Lexcyn on 01 Nov 2005 - 19:15

This makes me glad I don't buy music CDs from large labels. This is effing ridiculous. I hope they get sued hardcore for this.

#16 Allan® on 01 Nov 2005 - 19:16

QUOTE

It's not in the EULA that that is being installed. Thereofre it is illegal~

And now I am NOT a Sony fan ... I won't buy from them ever agian.

(1 reply) #17 madnuke on 01 Nov 2005 - 19:19

Well thats so nice of them, I hope they get repremanded for this now. Thank god for open source music

#17.1 rm20010 on 02 Nov 2005 - 03:40

Uh... I think you meant music from independent labels. This isn't software.

(7 replies) #18 Vortech on 01 Nov 2005 - 19:23

In my opinion Sony sucks. I've been using iTunes for buying my music and haven't had a problem since. And I know Apple well enough to know that they wouldn't install some crap on my machine.

#18.1 rob.derosa on 01 Nov 2005 - 20:05

"i know apple well enough"

OKAYYY

#18.2 Jaxkesa on 01 Nov 2005 - 21:26

they wouldn't install some crap on my machine.

iTunes?

#18.3 creamhackered on 01 Nov 2005 - 21:57

Yea...ipodservice...ituneshelper - Need I continue!?

#18.4 SimplyPotatoes on 01 Nov 2005 - 21:59

becuase those are trojans. wtb examples

#18.5 SquareSoft0 on 02 Nov 2005 - 01:10

No they aren't trojans, but they do fit the original example of "crap." GEE GEE

#18.6 tophat on 02 Nov 2005 - 01:29

I agree with SquareSoft0.

Yes, itunes does install bloat, but at least it's easy to see. Itunes-helper etc show up in the process list, and you can disable them in the services menu.

Not the greatest setup, but at least you have access!

#18.7 shao on 02 Nov 2005 - 12:56

and removing iTunes doesn't disable access to your cd drive.

(3 replies) #19 dotRoot on 01 Nov 2005 - 19:26

I see how this could be considered a Trojan, but not a Rootkit. Yes, Rootkits will hide a cracker's efforts, but it is to gain Root access (superadmin). I guess maybe I'm just oldschool, but this is a trojan I would say. Not that this changes anything about the article.

#19.1 Jugalator on 01 Nov 2005 - 19:39

I think "rootkits" are often used (not sure if it's "correct" or not) nowadays as "code that hides itself in a system in a special way to evade discovery". As in discovery even by antivirus and other removal tools, by using special tricks or even unintended holes in the OS.

#19.2 dotRoot on 01 Nov 2005 - 19:41

Yeah I read the Wikipedia article about it before. Back when I used UNIX (before I used BSD and Linu

rootkits were around to gain access to the Root account (literally the accountname Root or Baron for NetBSD). I guess the meaning has changed, sort of like the meaning of a hacker and of a cracker.

#19.3 cappuchok on 02 Nov 2005 - 07:30

When in doubt, ask the Jargon File:

rootkit: /root´kit/, n.

A kit for maintaining root; an automated cracking tool. What script kiddies use. After a cracker has first broken in and gained root access, he or she will install modified binaries such as a modified version login with a backdoor, or a version of ps that will not report the cracker's processes. This is a rootkit.

#20 snigma on 01 Nov 2005 - 19:26

I quit buying anything Sony after I bought their ridiculously expensive and retarded proprietary Digital Handycam.

It's one of the several "touted as best by popular opinion" companies that I'll never buy from again.

Sony, take your retarded music players, computers, laptops, cameras, and music store and shove it so far up your ass it knocks off your teeth.

#21 obiwankenobi on 01 Nov 2005 - 19:28

way to go, bunghole sony!

#22 Jugalator on 01 Nov 2005 - 19:37

What the hell...

It's one thing if they want to protect their media by DRM, but it's a WHOLE different story if they both try to hide it, and disguise their dirty secrets under different names... I never liked Sony, but this crap takes the prize.

#23 blu3Fusion on 01 Nov 2005 - 19:37

SONY..interesting..sucky customer service, now install trojan-wanna-be on our computers??..nice job dude..

#24 dotRoot on 01 Nov 2005 - 19:51

So that means if you get a virus that drops itself with $sys$ (which will hide itself from everything in Windows) and you lose all sorts of important data and even work, then you could sue Sony, right?

#25 Rob on 01 Nov 2005 - 19:56

Fascinating article at the source, and great that Neowin posted this, thanks.

We have to make the distinction there that Sony didn't write this software, it's licensed from a third-party DRM company. However, it's outstandingly poor judgement from Sony to employee this copy protection without knowing all that it does. Or, if they DO know... it's just plain wrong, and as was suggested, would probably go against the Computer Misuse Act.

#26 rIaHc3 on 01 Nov 2005 - 19:56

This is not turning out to be a great year at all for Sony.

I honestly wish them luck in the future because they are gonna need it.

(3 replies) #27 SkyyPunk on 01 Nov 2005 - 19:57

all this attacking on sony...yes they should have done their checking on what the DRM they sent out on their stuff, but, lets see if sony *knew* this is how this "First 4 Internet" implemented the DRM sony wanted on their cds...

#27.1 joshpo on 01 Nov 2005 - 20:00

Yes, I'm sure they were completely unaware of how the product they were licensing to protect their precious intellectual property rights worked. Idiot.

#27.2 SkyyPunk on 01 Nov 2005 - 20:14

thanks for the comment!

do you oversee sonys final production of CDs? Wait and see, tiny grasshopper.

#27.3 shao on 02 Nov 2005 - 12:59

ignorance is no excuse in a court of law, and sony would be very foolish to claim their ignorance in this matter.

(1 reply) #28 doubledragonxz on 01 Nov 2005 - 20:02

I say boicot sony.

#28.1 tophat on 02 Nov 2005 - 01:22

"boycott"

And, I agree with you completely. Include BMG & Arista as well, as they're part of the sony family.

Now, this rootkit installs itself into the actual drivers for your cd/dvd drives... Makes me wonder what they put into their actual computers and drives.

You cannot trust anything by sony anymore.

#29 trance on 01 Nov 2005 - 20:08

Microsoft is already aware of the issue, and will be going thru great efforts to BLOCK this in LH, and with their anti-malware software (for downlevel OS).

#30 Julius Caro on 01 Nov 2005 - 20:11

This is so low.
The worst of all is that this is included in CDs actually BOUGHT legally in Amazon at online stores. So sad.

(2 replies) #31 user name 2 on 01 Nov 2005 - 20:39

Yet another reason to disable completely the large Windows security hole called Autorun.

And to anyone who says "use the shift key etc", who seriously wants to remember to do that everytime they insert a certain music CD? One fatal slip of the memory, and it's in and from the blog entry, a pain in the backside to remove.

Autorun is one of the first things that goes off when I re install Windows. Along with automatic updates, hiding of file extensions and files/folders.

Message to Sony: don't bite the hand that feeds you.

#31.1 Sub on 01 Nov 2005 - 21:51

Whats the diffrence if it Auto Runs? In order to listen to the CD, you need to install this player and "spyware". No matter what if you want to listen to the CD on your computer, your going to be infected. Who cares if it AutoRuns, its not going to stop this...

#31.2 lloydo on 02 Nov 2005 - 00:47

You obviously haven't heard of EAC.

#32 xpgeek on 01 Nov 2005 - 20:44

Shame on Sony, shame. Me sticks with downloading.

#33 obake on 01 Nov 2005 - 20:57

Stuff like this makes me want to pirate music. I try to get my stuff from iTunes most of the time, but if any of that is getting back to ass*ole companies like this (which, of course, it is), then it's time to go back to the way things used to be.

#34 Chanser on 01 Nov 2005 - 21:02

Recently we had Ken Kutaragi going insane and now this

#35 domgrimm on 01 Nov 2005 - 21:06

It doesn't matter if Sony employed a 3rd party to create this, they have a responsibility to know what they're putting on their cds. And if they did know this happened, I see trouble brewing in the future. Sony have really screwed up this year

(1 reply) #36 Imaginos on 01 Nov 2005 - 21:33

So let me see if I got this straight..

This only affects Windows users? Bummer.

#36.1 Chanser on 01 Nov 2005 - 21:43

Except some 64bit Windows XP users.

(1 reply) #37 bucko on 01 Nov 2005 - 21:47

Sony = £££ so I don't have any of there stuff anyway. Maybe a Playstation1, can you get a RootKit on that

j/k

#37.1 Express on 01 Nov 2005 - 23:35

$ony

#38 thenay on 01 Nov 2005 - 21:48

I'll never buy a Sony CD again then

From now on i'm downloading any CD made by Sony!
Thanks for the heads up!

#39 bilemke on 01 Nov 2005 - 21:48

This was really a mistake on Sony's behalf. At a time where spyware and the likes are as much or more of a concern to the average user then an actual virus... Secretly installing the software, that while intended for a good cause in this case may not 100% stable or bug free, is a misuse of DRM.

I say it is buggy or not 100% stable because as Mark shows, this app after run uses 1-2% cpu usage is not acceptable when the content to be protected is not even on/in the machine.

BTW, not to start a flame war.. Some peope here are poking at Windows users.. Apparently they though the rest of teh computer users in the world were to small of a percentage to care about now.. But keep saying those thing, and we will get CDs that soon require some sort of Windows DRM based machine to even read the file system of the disk..

#40 Airlink on 01 Nov 2005 - 21:52

Wow. Good thing I don't buy music cds, huh?

(4 replies) #41 MajinDark on 01 Nov 2005 - 22:03

First Sony makes shoddy products (PS1, PS2), and now they're screwing around with ppl's computers. Way to go, Sony.

#41.1 Miran on 01 Nov 2005 - 22:50

I'm not a fan of Sony, but I really don't think you can call PS1 and/or PS2 "shoddy".

#41.2 tophat on 02 Nov 2005 - 01:35

Ever open up a PS2?

"High quality parts" is a phrase I'm only able to use sarcastically.

PS2s had a lot of various issues. Hunt around about mods or copied games. They'll list a bunch of variations on the hardware, each of which was due to a certain fix for something or other.

#41.3 Miran on 02 Nov 2005 - 05:05

Really? i didn't realize that (I don't own any of the current gen consoles). I just assumed that the PS2, being Sony's only real lucrative piece of technology, would have at least average build quality.

I think I'll buy a Gamecube soon. If only for the new Zelda.

#41.4 tophat on 03 Nov 2005 - 00:11

We're told that most game consoles are sold at a loss, and the money is all made on games. (This may be a blatant lie, of course)

I think the only important thing about a game console, from the manufacturer's point of view, is that it works for slightly longer than the warranty is good for.

#42 toadeater on 01 Nov 2005 - 22:26

Sony and any other company that installs covert software on PCs should be held accountable for anything that happens to that PC as a result. It's not just the security threat, or the threat to privacy, but an impairment of computer stability and efficiency. What are users supposed to do when you have companies installing software that interferes with other installed software and hardware? How do you maintain your system when you have these threats working in the background causing conflicts, BSODs, maybe even data corruption. Will Sony pay to replace users' lost data?

I think it's time for some kind of legislation to stop this kind of activity, these corporations are out of control, they think they can get away with anything.

#43 Tjalian on 01 Nov 2005 - 22:39

So f**king sorry for wanting to legally buy music >.> If I wanted Spyware while I get music, I download a trial version of Kazaa. At least if you removes theres, only the program stops working.

Personally, I hope Microsoft opens up a can and hands their asses to 'em. No, this is not 'omg lol ur xbox fanboy' style, this goes WAY beyond any silly little gaming dispute, this is the big time. Although, considering Microsoft are taking care of Spyware, and Sony are making Spyware, could this be Sony Vs. Microsoft on a whole new level?

This has personally left a foul taste in my mouth, and I refuse to buy any type of Sony endorsed CD, purely because of this. I mean, whats next, the PSP Media Manager having the same thing? WATCH OUT FOR YOUR PSPs!

I know Sony are assholes tat dig pretty low, but this is gawd awful. I hope they get whats comin' to'em.

#44 Pliskin on 01 Nov 2005 - 22:48

LOL now they're gonna put spyware on the PS3

#45 Subaru on 01 Nov 2005 - 23:09

HAHAH .. i stick with MPTHREE downloads

#46 n301 on 01 Nov 2005 - 23:26

All your desktops are belong to us!!!

#47 djesteban on 01 Nov 2005 - 23:40

if there's a class action lawsuit...count me in

#48 divertom15 on 01 Nov 2005 - 23:48

someone should forward this neowin article to the EFF.

#49 soldier1st on 01 Nov 2005 - 23:49

thats another reason i never buy sony garbage.it tends to conk out to fast and now this prooves that sony stuff sucks.

#50 icaras on 02 Nov 2005 - 00:23

thats utterly disgraceful - not the kind of thing they should be doing when they are trying to persuade people to buy music legally!

(1 reply) #51 j0j081 on 02 Nov 2005 - 01:08

I doubt this will effect Sony's music sales much if at all. You think the latest teeny bopper going to the mall to get the latest pos will have read about this or even care.

#51.1 domgrimm on 02 Nov 2005 - 07:04

But if they get sued, it might affect the way the whole company operates... we can only dream

(1 reply) #52 JackandJohn on 02 Nov 2005 - 01:15

This is absolutely perfect!

Now, if anyone steps up to the plate, we get to test whether making a rootkit or a virus as a form of copy protection protects it under the DMCA!

Does this mean that if I create an NT rootkit, or a self-replicating virus as a form of copy protection, that I could sue the AV companies for trying to remove it?

Before you dismiss this off-handedly; In the purely legal sense, this is perfectly solid grounds. It's only when you inject subjectivity that a judge would rule against it.

#52.1 tophat on 02 Nov 2005 - 01:19

I was writing my post at the same time...

As far as most of us can tell, you're 100% right. This is something that needs to be put to the test in court to see if it survives.

By the book, that'd be legal. But it hasn't faced a court challenge yet.

(2 replies) #53 tophat on 02 Nov 2005 - 01:16

I don't think you all have explored all the really nasty bits.

1) The rootkit potentially opens up a security hole on your system, since it sets up a way to hide files from the OS and the user. Imagine a worm built to exploit that...

2) Anyone looked at the DMCA lately?

US Law Title 17 section 1201:
Circumvention of copyright protection systems
(a) Violations Regarding Circumvention of Technological Measures.--
(1) (A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title.

IANAL, but that makes it illegal to remove the rootkit.

#53.1 mrbester on 02 Nov 2005 - 10:18

IANAL either, but the EULA doesn't say you can remove it only if you h

Neowin.net