Sony's DRM Rootkit Comes in Mac Flavor, Too

Sony's DRM Rootkit Comes in Mac Flavor, Too

malebolgia on 17 November 2005 - 00:20 · 35 comments & 4123 views

Advertisement (Why?)

Sony says it will discontinue distribution of its DRM software, which could pose a "rootkit" security threat to users. But does that include the OS X version?

Sony is reportedly pulling its digital rights management "rootkit" from the market. But it isn't reporting everything. "The Sony copy-protection software does not install itself on Macintosh computers or ordinary CD and DVD players," Reuters reported today. There's just one problem with that statement: it happens to be flat-out wrong. While the XCP version of copy protection is for Windows, there is another Mac-only version of copy protection installed by Sony/BMG CDs.

News source: Security IT Hub

To all you Xbox holders...will you be rushing to the stores to get your copy of HL:2?
-Enan Hawk

About the Author

Full name: Unknown
User name: malebolgia
Contact: via forum PM
Submissions: View All
More: View Profile

Post a comment · Send to friend Comments · There are 35 additional comments

#1 matt74441 on 17 Nov 2005 - 00:20

I think it would be in their best interest to pull every version of their little tool at this point.

(3 replies) #2 RobertH on 17 Nov 2005 - 00:38

When run, a EULA is first displayed (which does inform the user that software is going to be installed without saying exactly what that software will do).

The user then is prompted by the program for a user name and password. After that information is provided, the program seemingly quits. However, it actually installs two kernel extensions, PhoenixNub1.kext and PhoenixNub12.kext, in the OS X system files.

It isnt anywhere near the same thing, you have to find the file, run it, accept the EULA, give it your username/root password then it can install.

#2.1 rm20010 on 17 Nov 2005 - 00:51

Well, didn't Apple take the right step in using Unix like authentication for this kind of stuff in OS X.

#2.2 dp123 on 17 Nov 2005 - 01:48

You're right: it would be so much more desirable to use the Window method which allows this rootkit without asking permission at all rather than this relatively minor DRM technique which does ask you for permission.

#2.3 rm20010 on 17 Nov 2005 - 02:41

Whoops.. falsely detected sarcasm over there. I was acknowledging that it's good OS X had this. Maybe I should've took out the first two words and that emoticon.

(1 reply) #3 CeL_dAmAgE on 17 Nov 2005 - 00:38

Good job Sony, way to **** things up again. This'll probably take some impact on the PS3 sales too probably.

#3.1 Ji@nBing on 17 Nov 2005 - 08:32

I highly doubt that. The PS3 is like a year away. By then people will have long forgotten this and will want "the next big thing".

(1 reply) #4 M2Ys4U on 17 Nov 2005 - 00:59

QUOTE

There's just one problem with that statement: it happens to be flat-out wrong.

lol

#4.1 aristotle-dude on 17 Nov 2005 - 03:43

Keep on laughing because the article is flat out wrong or at least misleading and written in a way to spread FUD.

Last edited by 18285 on 17 Nov 2005 - 03:50

(1 reply) #5 NeoTrunks on 17 Nov 2005 - 01:04

I would be kinda wary if a CD wanted my root password just to play it.

#5.1 mr_demilord on 17 Nov 2005 - 09:59

Exactly!

(1 reply) #6 sigloiv on 17 Nov 2005 - 01:54

Honestly, this is one of the reasons I refuse to buy music nowadays. I mean, CDs have just become way too much trouble. It used to be just pop your CD in your CD player or your PC and it just worked. It was a standard, none of this proprietary DRM crap.

Plus, they're doing it all to "deter piracy". That's what pisses me off the most. It's not like you're actually going to keep people from ripping the CDs. Heck, people enjoy cracking DRM. Maybe if you stopped making it people would stop cracking it.

#6.1 kravex on 17 Nov 2005 - 16:41

Yeah, maybe if they stopped spending money on these things they could reduce the cost of the CD's and no one would pirate them.

(7 replies) #7 bilemke on 17 Nov 2005 - 02:16

All I got to say is...

Haha

Rember a few days back someone saying he was glad he wasnt a windows user because of this.

#7.1 Miran on 17 Nov 2005 - 02:30

Like others have mentioned, it needs the root password to install.

#7.2 GoogleNinja on 17 Nov 2005 - 03:59

Miran: Why bother to be intelligent and understand how it works, when you can just post a smartass trolling comment and be one of those cool Apple-haters?

#7.3 Deadpool2k on 17 Nov 2005 - 05:57

Dude he is right it needs the root password and anyone who uses any unix flavor including apple will not let any software install at this point.

#7.4 HawkMan on 17 Nov 2005 - 10:04

fact is the majority of users will just insert the password thinkign "well well, that'sthat's a bit unusual" at best.

#7.5 Lt-DavidW on 17 Nov 2005 - 10:28

I believe that on Windows, the XCP infected disks pop up a description of the software upon loading the disk for the first time and you have to click 'Agree' for the rootkit to install.
Switching to Mac will not make a computer any more secure if this problem lies between the keyboard and chair.

#7.6 Miran on 17 Nov 2005 - 14:46

It will if only one person has the root password. If your kids, for example, have their own account, then they have to ask you, the more informed and diligent user for the password. Face it, anyone can click on "agree", at least with the password it offers one more level of protection.

#7.7 dp123 on 17 Nov 2005 - 17:42

Lt-DavidW, what we are saying is: read the ****ing article and do some research! This is not XCP. Firstly, this is not an autorun isntall on CD isnert; the user would have to browse around the CD, click on the installer, and install software that is entirely unnecessary using an admin password -- which is, in fact, rather unlikely for both average and advanced users. Secondly, this is not a root kit. Yes, it installs a couple of .kexts, but it does not phone home, it is not stealth, it is not at all similar to the problems that Sony has exposed Windows users to.

* do not bypass the swear filter *

Last edited by 36818 on 17 Nov 2005 - 19:26

#8 Valkyre on 17 Nov 2005 - 02:35

OH TEH IRONY!1!!!

#9 Narlzac85 on 17 Nov 2005 - 02:44

how is this the same thing at all? one's a rootkit, the other is just your ordinary DRM right? Nothing legally wrong with that I would assume. I'll still be buying my PS3 and other sony HARDWARE, who cares about the music division?

(1 reply) #10 betasp on 17 Nov 2005 - 03:18

Why the heck would you give the computer your admin password when you pop in a music CD? I guess the OS can only be so smart...

#10.1 matt74441 on 17 Nov 2005 - 07:21

True enough.

#11 aristotle-dude on 17 Nov 2005 - 03:40

There is no auto run in OSX and two sessions pop up (one audio and the other is data).

The user would have to open up the data session and double click on the start.app file and then provide an admin password.

This is a non-story. This article is flat out wrong. The CD does not install anything. A stupid user has to "manually" install it and the audio session is available for drag and drop ripping as AIFF files or via iTunes before installing any of this crap. It is also really easy to remove these kernel extensions, unlike the windows version which hides itself after silently installing via autorun.

(3 replies) #12 Gary_Player on 17 Nov 2005 - 08:36

I noticed that upon inserting the latest NIN album "with teeth" my pbook wouldn't even mount the damn thing, it just spat it back out at me

Though I suppose that's preferable to this

#12.1 darkstar559 on 17 Nov 2005 - 11:20

I have the same album and it popped into my ibook just fine and iTunes happily ripped everything without any trouble.. maybe your copy is a special edition?

#12.2 Tirnaog on 17 Nov 2005 - 17:53

Try flipping the CD over and play the otherside.
This is a DVD-A/CD disc.
One side CD
One Side DVD-Audio
You probably stuck the DVD-A side in. CD player would have no idea what it was.

If you have a DVD-Audio player then listen it on it. Sounds friggen awesome.

#12.3 Gary_Player on 17 Nov 2005 - 22:06

Yea, no kidding

The DVD side worked just fine, it was the audio side that had issues. I don't think it was a special edition or anything, honestly I don't even know where I put it... it kind of sucked anyway

#13 capeche on 17 Nov 2005 - 09:01

When will these criminal acts perpetrated by big corporations stop?!

#14 indiehead on 17 Nov 2005 - 09:37

that's it.

no more cd's for me pronto, never a bloddy gain!

#15 mr_demilord on 17 Nov 2005 - 10:01

I will never enter a root password only for playing a CD

#16 generalnewbie on 17 Nov 2005 - 15:57

i think its amazing how this issue went unnoticed and nonexsistent until someone wondered hey whats that on my pc!

gob bless him for doing the research but damn sony you would think knows better then to piss people off. Now this has become a way way bigger issue then i think sony would have ever thought and they have to fix it!

#17 Galley on 18 Nov 2005 - 09:23

Sony XCP exchange program
http://cp.sonybmg.com/xcp/english/home.html

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)

Neowin.net

Sony's DRM Rootkit Comes in Mac Flavor, Too

Share this Article

About the Author

Related news