, SecurityFocus 2005-11-10
The criticism of music giant Sony BMG Music Entertainment and its surreptitious copy protection software went up an octave this week as attorneys and law firms readied nearly a half dozen legal complaints against the company on behalf of consumers.
Ten days after two security researchers took Sony BMG to task for its invasive copy protection, labeling the software a "rootkit," a digital-rights organization and four law firms are preparing cases against the music giant. Moreover, the company's assertion that its software did not harm users' security was weakened on Thursday when a Trojan horse attempted to take advantage of the code to hide itself on freshly compromised Windows systems that had Sony BMG's technology installed.
The events raise the stakes in the battle between content companies and a variety of consumers--from legal users to casual pirates--over how much leeway media companies should have to protect their copyrights.
"The issue that has been lurking for a long time is how invasive can content companies be as to monitoring your computer," said Jason Schultz, a staff attorney for the EFF. "I think that Sony has gone too far here and violated the personal property rights of computer users."
The mounting pressure by consumers, security experts and, now, attorneys comes the week after two teams of researchers independently and separately reported that music giant Sony BMG used software hiding techniques more commonly found in rootkits to prevent removal of the company's copy protection software. A rootkit is software that hides its presence on a computer while controlling critical system functions, and security professionals have lately warned that the addition of the technology to a variety of Internet threats--from bots to spyware--makes the malicious code more difficult to find and remove.
Sony BMG's content protection scheme, developed by U.K.-based firm First 4 Internet for the music giant, has apparently been included with thousands of titles. Using Google, a search of Amazon.com for "CONTENT/COPY-PROTECTED CD"--the site's label for music CDs that include the First 4 Internet or similar protections--turns up 32,800 hits. Because of potential duplicates, the number of hits is likely much higher than the total number of titles. Moreover, other copy protection schemes, such as one from SunnComm International, are likely included in the total as well. The Electronic Frontier Foundation has verified at least 19 CD titles that have the Sony BMG copy protection code.
Both antivirus firm F-Secure and security information site SysInternals.com identified the copy protection scheme as a rootkit. F-Secure and other antivirus firms--including Symantec, the owner of SecurityFocus--have release signatures for their antivirus software suites to detect the presence of the Sony BMG code.
Other events in the last week have laid bare to consumers the security implications of having a poorly designed rootkit installed on their systems. Last week, some enterprising hackers in the online game World of Warcraft discovered that the rootkit could be used to hide other programs, including tools designed to help players cheat at the game. On Wednesday, antivirus firms reported that the first Trojan horse to attempt to use the Sony BMG cloaking code started spreading, but bugs in the program prevented it from operating correctly.
"It is the first malware to use the Sony rootkit," said Mikko Hyppönen, chief research officer for F-Secure. "It won't be the last."