Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Sony-baloney
Scott Granneman, 2005-11-22

The big story the last few weeks has been the Sony BMG rootkit and in fact, it's the kind of story for which columnists drool: a big company does something unbelievably dumb that violates basic security principles. If you don't know what I'm talking about (and if you really don't, I'm amazed - you need to follow the news more!), you can read excellent coverage on SecurityFocus, plus a good write-up on Wired, or catch up with a timeline of events brought to you by Boing Boing (parts one, two and three).

Comments Mode:
Sony-baloney 2005-11-22
Tom Arnold
"How would those corporate, government, and scientific organizations have reacted if a group hostile to American interests had engaged in the same security violations practiced by Sony?"
I'm thinking a full-on S.W.A.T. team would greet them on the front doorstep.

"Are any members of the US Congr...

[ more ]  [ reply ]
another 2005-11-22
voline
Do Sony personal computers come with DRM like the First 4 Internet-built rootkit or the Sunncomm version factory installed?...

[ more ]  [ reply ]
Point-by-Point 2005-11-22
Matthew Murphy
#1-3: Banning CDs will eventually happen -- businesses started to ban floppies in the day of boot sector viruses. If the CD's capacity to introduce malicious code becomes better-known, we may well see an outright ban on CDs.

However, the technically-versed among us will note that the rootkit onl...

[ more ]  [ reply ]
Sony-baloney 2005-11-23
Anonymous Coward (1 replies)
Will sony included a new and improved root-kit with their playstation 3 (ps3)?
...

[ more ]  [ reply ]
Re: Sony-baloney 2005-11-25
Anonymous (1 replies)
This whole thing has brought one thing into clear focus for me, that is to never buy hardware from a company that has a vested interest in content. The temptation appears too great for the content side of the business to steamroll the hardware side into putting "secret stuff" into their hardware (i...

[ more ]  [ reply ]
Re: Re: Sony-baloney 2005-11-30
Anonymous
That is a good point. I heartily agree with you. I wasn't planning on buying a PS3 or a Sony computer, anyway, but hopefully others will decide to take this route as well.

Sony's actions during this whole saga have been reprehensible....

[ more ]  [ reply ]
Sony-baloney 2005-11-23
Anonymous (1 replies)
National Security Threat From SONY Rootkit.

It looks like the U.S. Military is finally waking up to the security implications of SONY's rootkit. Here is an article from the Stars & Stripes, a military newspaper.

http://stripes.com/article.asp?article=33184

Also on a related note, SecuROM, S...

[ more ]  [ reply ]
Re: Sony-baloney 2005-11-25
Anonymous
In all probablity, I would not be surprised if any Sony's subsidaries' PC's have also been infected by this Rootkit.

Hence anyone wanting to steal Sony's secret or to carry out industrial espionage, this is your ticket to ride, you are only using a tool offered by Sony BMG. Not really infecting...

[ more ]  [ reply ]
Sony-baloney 2005-11-23
Anonymous
So if I don't run as admin, put the CD in my computer, and rip the files, am I violating the DMCA? After all, I didn't let the DRM software run by logging in with admin rights....

[ more ]  [ reply ]
Microsoft factor - Maybe not what you think 2005-11-23
JCD
Everyone's been jumping on Microsoft for their delay in exposing Sony's rootkit/spyware but I can't see the basis for the delay if MS knew about the rootkit. Microsoft would have wanted to be first on the bandwagon to help force clients to jump on board Windows Digital Rights Management. Maybe Mic...

[ more ]  [ reply ]
Sony-baloney 2005-11-24
Scott R.
What about the anti-virus makers that couldn't or wouldn't fix the DRM kit? Can anyone say collusion?...

[ more ]  [ reply ]
Sony-baloney - know what they are doing? 2005-11-25
Anonymous
"Does anyone at First 4 Internet - a supposed technology company - really have any understanding about security?"

Sadly, in software industry, not too many know what they are doing, including security aspect of their software, but they are all too keen to take money from their customers and then ...

[ more ]  [ reply ]
Hahahahaha 2005-11-25
Eric
It's just getting really funny... and sad at the same time. I remember the enthousiasm I had in the beginning of the 80's as a teenager discovering computers. Apple was not born and PC's did not exist. It was exciting to enter this universe. Now it's getting risky ;)
But your article made me laugh ...

[ more ]  [ reply ]
Sony-baloney 2005-11-25
Anonymous (1 replies)
"How long until those bans extend to any music CD, period?"

Generally speaking seeing as how music on a CD is considered copyrighted material, and the original purchaser has "fair use" of said content, the original purchaser would not be the one wiht ownership of said server/computer the CD was o...

[ more ]  [ reply ]
Re: Sony-baloney 2005-11-30
Anonymous
If they insall or copy the music to their computers, yes. They shouldn't really be doing so, even though if they are the soul user of the computer they are still under the "fair use" of the CD and the music it contains. It is all up to the Acceptable Use Policy for your organization to determine wha...

[ more ]  [ reply ]
Sony-baloney 2005-11-29
Anonymous
Regarding the LGPL and GPL violations, open-sourcing their rootkit code would only get them off the hook for future distribution of the code in question. The copyright owners of the code may accept this as enough not to pursue Sony over their previous copyright infringement in distributing the code...

[ more ]  [ reply ]
Sony-baloney 2005-11-29
Anonymous
Now it appears that F-Secure knew about this a month before and notified Sony. What did they do to protect their userbase? Why didn't they go public if this was considered a "root kit"?...

[ more ]  [ reply ]
Crime 2005-12-06
Phillip
Will Sony face any criminal charges, such as those for unauthorized access to a computer system? (MCL 752.791-797)...

[ more ]  [ reply ]







 

Privacy Statement
Copyright 2009, SecurityFocus