NationStates Jolt Archive

http://blogs.zdnet.com/BTL/?p=2092&tag=nl.e589

Sony Music CDs surreptitiously install DRM Trojan horses on PCs Posted by David Berlind @ 8:56 am

Reports are beginning to turn up around the Web that discuss how certain CDs from Sony Music come with a Trojan horse-based digital restrictions management (DRM) technology that surreptitiously installs itself as a rootkit on Windows PCs. When software surreptitiously installs a rootkit, it's usually doing so to cover its tracks — a technique commonly associated with malware such as viruses and Trojan horses. Rootkits generally latch themselves onto the foundation or "roots" of an operating system in a variety of ways that not only prevent their detection, but also their extraction. According to the Wikipedia's definition," a rootkit is often used to hide utilities used to abuse a compromised system."... (read article)

Also: http://www.zdnet.com/5208-10532-0.html?forumID=1&threadID=14743&messageID=294843&start=-1

But wait, it gets worse
Have you seen the Halloween Document the MPAA are trying to push through Congress in an attempt to close the analog hole? Seriously, this is getting insane:
http://www.eff.org/deeplinks/archives/004106.php
And what might these MPAA-specified, government-mandated technologies do?
They prescribe how many times (if at all) the analog video signal might be copied - and enforce it. This is the future world that was accidentally triggered for TiVo users a few months ago, when viewers found themselves lectured by their own PVR that their recorded programs would be deleted after a few days.

But it won't just be your TiVo: anything that brings analog video into the digital world will be shackled. Forget about buying a VCR with an un-DRMed digital output. Forget about getting a TV card for your computer that will willingly spit out an open, clear format.

Forget, realistically, that your computer will ever be under your control again. To allow any high-res digitization to take place at all, a new graveyard of digital content will have to built within your PC.

Freshly minted digital video from authorised video analog-to-digital converters will be marshalled here and here only, where they will be forced to comply with the battery of restrictions dictated by Hollywood. ... (go read it)

A possible avenue of resistance: http://www.zdnet.com/5208-10532-0.html?forumID=1&threadID=14743&messageID=295181&start=-1

DMCA + Other laws anyone? Read for list: Class action lawsuit
Very VERY Interesting.

This action violates many local and international laws. Lets look at some of the ones mentioned.

DMCA anyone? Whos's the one NOW circumventing security? Wouldn't be grand if the DMCA was used AGAINST the RIAA and associates for the very same thing they are sueing other people for?

By sony installing rootkits they are effectly bypassing any security put in place and IF someone uninstalls it, they can completely screw up their computer.

I know someone in fact has installed this on a government computer that has TIGHT security. How do you think they will feel knowing SONY has willingly put on and changed a ROOTKIT.

Great news for computer repair's across the country. Is SONY going to pick up the tab because THEIR DRM software screwed up the computer?

Also if buy a CD and it doesnt work, fraud anyone? It's very clear if you buy something and it doesnt work, you are entitled to get your money back else it IS considered fraud regardless of any EULAs or store rules.

What is really ironic, I know a senators child who just happened to buy a number of SONY cd's with the DRM. Won't it be interesting when they install it on DADDY's computer.

SONY did you consider what happens when you piss of a senator? You think he is going to be happy to find out about Trojans on his computer, and heaven forbid his kid try and remove it. Then he'll REALLY be mad. Then he'll have to get his computer fixed.

--------------------------------------------------

This software will be considered spyware under the ASC definition,

The ASC's most recent definition of spyware is:

Technologies deployed without appropriate user consent and/or implemented in ways that impair user control over:

* Material changes that affect their user experience, privacy, or system security;

* Use of their system resources, including what programs are installed on their computers; and/or
* Collection, use, and distribution of their personal or other sensitive information.

--------------------------------------------------

"The Securely Protect Yourself Against Cyber Trespass Act, or SPY ACT, makes spyware illegal, but it is unclear if the SPY ACT defines spyware the same way as the ASC.... "

--------------------------------------------------

INAL, but this appears to be illegal in the State of California, punishable by a $1000 fine per computer affected.

California Business & Protections Code Section 22947.3, Paragraph C:

A person or entity that is not an authorized user, as defined in Section 22947.1, shall not, with actual knowledge, with conscious avoidance of actual knowledge, or willfully, cause computer software to be copied onto the computer of a consumer in this state and use the software to do any of the following:
...
(c) Prevent, without the authorization of an authorized user, an authorized user's reasonable efforts to block the installation of, or to disable, software, by doing any of the following:
(1) Presenting the authorized user with an option to decline
installation of software with knowledge that, when the option is
selected by the authorized user, the installation nevertheless proceeds.
(2) Falsely representing that software has been disabled.

--------------------------------------------------

Computer Misuse Act - UK

Ever think of this one? It may be old but it's broad, however it does cover what is mentioned that they do.

"3.-(1) A person is guilty of an offence if-
he does any act which causes an unauthorised modification of the contents of any computer; and
at the time when he does the act he has the requisite intent and the requisite knowledge.

(2) For the purposes of subsection (1)(b) above the requisite intent is an intent to cause a modification of the contents of any computer and by so doing-
to impair the operation of any computer;
to prevent or hinder access to any program or data held in any computer; or
to impair the operation of any such program or the reliability of any such data.

(3) The intent need not be directed at-
any particular computer;
any particular program or data or a program or data of any particular kind; or
any particular modification or a modification of any particular kind.

(4) For the purposes of subsection (1)(b) above the requisite knowledge is knowledge that any modification he intends to cause is unauthorised.
(5) It is immaterial for the purposes of this section whether an unauthorised modification or any intended effect of it of a kind mentioned in subsection (2) above is, or is intended to be, permanent or merely temporary.

--------------------------------------------------

There are at least three sections of the Australian Cybercrime act this software contravenes.

http://www.austlii.edu.au/au/legis/cth/consol_act/ca2001112/sch1.html

Section 477.2 is quite explicit:

"477.2 Unauthorised modification of data to cause impairment

(1) A person is guilty of an offence if:

(a) the person causes any unauthorised modification of data held in a computer; and
(b) the person knows the modification is unauthorised; and
(c) the person is reckless as to whether the modification impairs or will impair:
(i) access to that or any other data held in any computer; or
(ii) the reliability, security or operation, of any such data; "

--------------------------------------------------

Even if they changed the EULA, it's been proven that the DMCA OVERULES THEM. After all the RIAA has used the DMCA to overrule EULA's before theyby setting a precendence for others to use against them AND thier associates.

I love how they shoot themselves in the foot.

Also as previously stated the rootkit and can used by other programs to future exploit the system. So SONY has thereby placed a method to where others can hack the machine.

--------------------------------------------------

I look forward to a class action suit. If nothing else, bad publicity will hurt them more then anything.

Remember the embarassing bypass with a marker anyone?

Sic 'em Cat Tribe!

This is so two days ago on slashdot.

This is so two days ago on slashdot.
And how many slashdot readers do we have here vs. people who would otherwise miss it?

And why didn't it get posted here as soon as you found out from slashdot?

Not very Social of you Fass... ;)

No Sony for me. In the argument of their property rights vs. my privacy, my privacy and right to control what goes on my computer wins every time.

And how many slashdot readers do we have here vs. people who would otherwise miss it?

What? This place is infested with nerds and other low-life.

And why didn't it get posted here as soon as you found out from slashdot?

Because I don't repost news from news aggregates.

Not very Social of you Fass... ;)

Seeing as I'm not a socialist, it's not very surprising. :p

According to something I read elsewhere about this, apparently the big reason Sony did a lot of this is because of a pissing war with Steve Jobs over iTunes and the music format used on iPod, and yet, if you play a Sony cd on a Mac and rip it, the DRM protection doesn't work, and none of this other stuff happens either. Yet another reason to switch to Mac from PC.

"but, but, sony are a NICE company... they're great and nice and wonderful and i love sucking cock"

finally, people may realise that ALL these major tech companies are just as bad as each other - microsoft is not the 'big bad bad guy', sony sucks just as much, as does cisco systems, intel (currently facing antitrust suits i believe, just as "M$" did), dell, and even fucking apple...


as a result i'm not suprised. they want to cream more money out of us, we're increasinly finding ways to stop getting ripped off by them. they don't like it and they have more leeway into the courts and law than we do - hence they can do everything they can, and more (as shown here), to stop us. we need a more coherent resistance against this sort of shit.

"but, but, sony are a NICE company... they're great and nice and wonderful and i love sucking cock"

Well, you got the last part right.

Good thing i buy TDK DC-R's....

So, theoreticly, how would you remove such a file from your rootkit?

So, theoreticly, how would you remove such a file from your rootkit?
Not easily - if at all. Some of the threads I linked talk about it.

So, theoreticly, how would you remove such a file from your rootkit?

What you want to remove is the rootkit, as that's what's installed. Slashdot from Oct 31 had a link to the original source and it included removal instructions.

Oh, here it is. (http://it.slashdot.org/article.pl?sid=05/10/31/2016223&tid=172&tid=158)

What you want to remove is the rootkit, as that's what's installed. Slashdot from Oct 31 had a link to the original source and it included removal instructions.

Oh, here it is. (http://it.slashdot.org/article.pl?sid=05/10/31/2016223&tid=172&tid=158)

Ok....

Any other way for someone that does not have a masters in computer science?

Any other way for someone that does not have a masters in computer science?

But the article tells you exactly what to do:

Armed with the knowledge of what driver implemented the cloaking I set off to see if I could disable the cloak and expose the hidden processes, files, directories, and Registry data. Although RKR indicated that the \Windows\System32\$sys$filesystem directory was hidden from the Windows API, it’s common for rootkits to hide directories from a directory listing, but not to prevent a hidden directory from being opened directly. I therefore checked to see if I could examine the files within the hidden directory by opening a command prompt and changing into the hidden directory. Sure enough, I was able to enter and access most of the hidden files:

I deleted the driver files and their Registry keys, stopped the $sys$DRMServer service and deleted its image, and rebooted. As I was deleting the driver Registry keys under HKLM\System\CurrentControlSet\Services I noted that they were either configured as boot-start drivers or members of groups listed by name in the HKLM\System\CurrentControlSet\Control\SafeBoot subkeys, which means that they load even in Safe Mode, making system recovery extremely difficult if any of them have a bug that prevents the system from booting.

When I logged in again I discovered that the CD drive was missing from Explorer. Deleting the drivers had disabled the CD. Now I was really mad. Windows supports device “filtering”, which allows a driver to insert itself below or above another one so that it can see and modify the I/O requests targeted at the one it wants to filter. I know from my past work with device driver filter drivers that if you delete a filter driver’s image, Windows fails to start the target driver. I opened Device Manager, displayed the properties for my CD-ROM device, and saw one of the cloaked drivers, Crater.sys (another ironic name, since it had ‘cratered’ my CD), registered as a lower filter:

Unfortunately, although you can view the names of registered filter drivers in the “Upper filters” and “Lower filters” entries of a device’s Details tab in Device Manager, there’s no administrative interface for deleting filters. Filter registrations are stored in the Registry under HKLM\System\CurrentControlSet\Enum so I opened Regedit and searched for $sys$ in that key. I found the entry configuring the CD’s lower filter:

I deleted the entry, but got an access-denied error. Those keys have security permissions that only allow the Local System account to modify them, so I relaunched Regedit in the Local System account using PsExec: psexec –s –i –d regedit.exe. I retried the delete, succeeded, and searched for $sys$ again. Next I found an entry configuring another one of the drivers, Cor.sys (internally named Corvus), as an upper filter for the IDE channel device and also deleted it. I rebooted and my CD was back.

The entire experience was frustrating and irritating. Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall. Worse, most users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files.

Ok....

Any other way for someone that does not have a masters in computer science?

With a hamer?;)

But the article tells you exactly what to do:



Thanks, Fass... :rolleyes:

So, theoreticly, how would you remove such a file from your rootkit?
http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html

http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html

Fass already posted it.

I've never put a sony CD in my comp, but, in the future, I'd like to know how to get rid of these without fucking around in my directory thingies.

And how many slashdot readers do we have here vs. people who would otherwise miss it?

And why didn't it get posted here as soon as you found out from slashdot?

Not very Social of you Fass... ;)
I do as well as digg

Lets just put it this way ... let sony try to install such with me

I dare them

(Avid FreeBSD user)

Well, you got the last part right.
lol... i guess :P

Fass already posted it.

I've never put a sony CD in my comp, but, in the future, I'd like to know how to get rid of these without fucking around in my directory thingies.
don't put it in your computer. Get a CD player and just jack it into the soundcard on your computer. Find a decent audio recording program and let the CD run. Cut the tracks to length and you have an unDRM'd copy.

Thanks, Fass... :rolleyes:

*sigh* I take no responsibility for the following, but this is how he seems to have done it.

Armed with the knowledge of what driver implemented the cloaking I set off to see if I could disable the cloak and expose the hidden processes, files, directories, and Registry data. Although RKR indicated that the \Windows\System32\$sys$filesystem directory was hidden from the Windows API, it’s common for rootkits to hide directories from a directory listing, but not to prevent a hidden directory from being opened directly. I therefore checked to see if I could examine the files within the hidden directory by opening a command prompt and changing into the hidden directory. Sure enough, I was able to enter and access most of the hidden files:

So, go to Start -> Run and enter "cmd."

There, write "cd c:\Windows\System32\$sys$filesystem". Rename the aries.sys (or whatever it was called) file with "rename aries.sys whateverfilenameyouwantittohave". Reboot.

I deleted the driver files and their Registry keys, stopped the $sys$DRMServer service and deleted its image, and rebooted. As I was deleting the driver Registry keys under HKLM\System\CurrentControlSet\Services I noted that they were either configured as boot-start drivers or members of groups listed by name in the HKLM\System\CurrentControlSet\Control\SafeBoot subkeys, which means that they load even in Safe Mode, making system recovery extremely difficult if any of them have a bug that prevents the system from booting.

Rename the $sys$filesystem directory, make a note of what the files in it are called called, start the register editor (Start -> Run, enter "regedit") and do a search in it for each and every file, deleting their entries as you go. This is a dangerous procedure, though, and you should export a copy of your registry before you start by going to "File -> Export."

You can stop the $sys$DRMServer service by going to Control Panel -> Administrator tools -> Services. Find it in the list and stop it, then choose to disable it.

When I logged in again I discovered that the CD drive was missing from Explorer. Deleting the drivers had disabled the CD. Now I was really mad. Windows supports device “filtering”, which allows a driver to insert itself below or above another one so that it can see and modify the I/O requests targeted at the one it wants to filter. I know from my past work with device driver filter drivers that if you delete a filter driver’s image, Windows fails to start the target driver. I opened Device Manager, displayed the properties for my CD-ROM device, and saw one of the cloaked drivers, Crater.sys (another ironic name, since it had ‘cratered’ my CD), registered as a lower filter:

Unfortunately, although you can view the names of registered filter drivers in the “Upper filters” and “Lower filters” entries of a device’s Details tab in Device Manager, there’s no administrative interface for deleting filters. Filter registrations are stored in the Registry under HKLM\System\CurrentControlSet\Enum so I opened Regedit and searched for $sys$ in that key. I found the entry configuring the CD’s lower filter:

I deleted the entry, but got an access-denied error. Those keys have security permissions that only allow the Local System account to modify them, so I relaunched Regedit in the Local System account using PsExec: psexec –s –i –d regedit.exe. I retried the delete, succeeded, and searched for $sys$ again. Next I found an entry configuring another one of the drivers, Cor.sys (internally named Corvus), as an upper filter for the IDE channel device and also deleted it. I rebooted and my CD was back.

Do what he did. Done! If this fucked up your computer, change the names of all the files back to the original ones, import your old registry and restart the service you stopped. That'll bring you back to before you did anything, hopefully.

If all this worked and you're fine and dandy, you can delete the renamed folders and files and the exported registry.

Much better.

CaP for future use.

don't put it in your computer. Get a CD player and just jack it into the soundcard on your computer. Find a decent audio recording program and let the CD run. Cut the tracks to length and you have an unDRM'd copy.
Or dont run windows ... lol

Or dont run windows ... lol

Or run windows, but disable autoplay/autostart of the CDs. Or, better yet, don't buy DRMd CDs.

Oh Hell, lets just take a hammer to all the world's computers!

No more Spyware!

Or run windows, but disable autoplay/autostart of the CDs. Or, better yet, don't buy DRMd CDs.
I like the dont run windows option better lol

http://www.f-secure.com/weblog/archives/archive-112005.html

Some info on the specifics

don't put it in your computer. Get a CD player and just jack it into the soundcard on your computer. Find a decent audio recording program and let the CD run. Cut the tracks to length and you have an unDRM'd copy.
Or get any good MP3 player with Line-In and do the same thing. So Ripping takes longer. BFD. Serves the bastards right.

I like the dont run windows option better lol

As long as your tool fits your task. Windows can be made remarkably secure with a lot of common sense, and a hardware firewall! :)

But my Ubuntu partition gets its fair use, too.

As long as your tool fits your task. Windows can be made remarkably secure with a lot of common sense, and a hardware firewall! :)

But my Ubuntu partition gets its fair use, too.
Oh I understand I just attempt to not use Windows as much as possible
Personal choice
Not saying everyone has the ability to do the same ... or should

Just that it was the "tool" for me

Just that it was the "tool" for me

I'm too reliant on wireless networks and hibernate/sleep modes to make a full switch. I know those work great on Apple's computers, but Apple is too pricey for me, unfortunately. I hope the switch to Intel/x86 changes that.

I'm too reliant on wireless networks and hibernate/sleep modes to make a full switch. I know those work great on Apple's computers, but Apple is too pricey for me, unfortunately. I hope the switch to Intel/x86 changes that.
I ran Slackware 10.1 on my laptop
I absolutly love its wireless ... never a hickup (using a netgear 802.11b card)

I ran Slackware 10.1 on my laptop
I absolutly love its wireless ... never a hickup (using a netgear 802.11b card)

Ah, but wpa in linux is really flakey (wpa_supplicant), especially when you have to run your card with ndiswrapper. I've had it work well on some machines, but on others it's just a nightmare. And hiberation is always a gamble...

I've said it before, and I'll say it again.

CD is shit.

Ah, but wpa in linux is really flakey (wpa_supplicant), especially when you have to run your card with ndiswrapper. I've had it work well on some machines, but on others it's just a nightmare. And hiberation is always a gamble...
Depends on the variant ... in that Slackware is a bit behind

But there are updated versions out for more of the majors (looked into it but my other machines are desktops)

Depends on the variant ... in that Slackware is a bit behind

But there are updated versions out for more of the majors (looked into it but my other machines are desktops)
If/when I get another subnote I might try a non-M$ on it, but they are so proprietary I'm always leary. Last time I tried it (back in 2000) with RedHat I couldn't get the video to work and screwed the HDD so bad I had to use depot-level low-level formatting just to bring it back to bios recognizability.

My Office PCs are all M$ because of interoperability issues and not wanting to pay out the ass for new CAD seats.

Then again, SONY/BMG offers nothing I want buy, much less rip anyway.