(no subject)

[whitereflection]

Woohoo, way to freaking go, Sony, you rat bastards!

Email rec'd from Anj this am (header info edited out):

They've been talking about the Sony/BMG thing a lot on Autocat. The particular type of copy protection they put on their CDs messes with the rootkit on Windows computers, acting very much like spyware or a virus and doing some serious damage to the operating system if you try to remove their software. This does not just affect people attempting to copy the music, but anyone even listening to the CD on their computer. (In other words, their "anti-pirate" measures hurt normal, legitimate users too.)

I did a little searching online, and I found a site that listed the know effected titles.
http://www.eff.org/news/archives/2005_11.php
I've checked these titles in Genisys, and we do not own any of them. Unfortunately, as Sony will not release a full list, it is still possible that we may have one or more bad CDs in our collection.

And here are pictures of the "Content Protected" warnings as they appear on the CD packaging.
http://www.eff.org/IP/DRM/Sony-BMG/
I think we should watch new CDs for this label, and if we get any, we ought to very seriously consider whether or not it should be added to the collection. If we did add such a thing to the collection, knowing the problems it has, would we be liable for damage to a patron's computer?

...

> I don't know if anyone has been following this, but for those of you who
> have collections with CDs, be aware that there is a potentially fatal
> problem with the new anti-piracy software that comes with new Song/BMG
> titles. These CDs come bundled with their own player, which has to be
> installed in order for the CD to run. This program then limits the number
> of copies that can be made from the CD to three. However, in doing this it
> also installs a rootkit.
>
> Rootkits, according to Mark Russinovich, who writes a computer blog, are
> "cloaking technologies that hide files, Registry keys, and other system
> objects from diagnostic and security software, and they are usually
> employed by malware attempting to keep their implementation hidden." What
> this rootkit does is actually rewrite parts of the code on your OS. Trying
> to delete these files may cripple your system, and may leave it vulnerable
> to other viruses and worms that capitalize on security weaknesses in the
> new code. It may also lead to the "Blue Screen of Death" and potential
> loss of data.
>
> Note that nowhere in the licensing agreement we all click without reading
> does it say that using the CD will alter your OS or rewrite your
> computer's code. It is also very hard to get the uninstall program from
> Sony, and it doesn't seem to work very well if you do get it.
>
> The original problem was noted in Russovich's blog:
> http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html
>
> and its follow-up:
> http://www.sysinternals.com/blog/2005/11/more-on-sony-dangerous-
> decloaking.html
>
> It has also been covered by several news outlets and on it security websites:
> http://www.enterpriseitplanet.com/security/news/article.php/3561181
>
> http://blogs.washingtonpost.com/securityfix/2005/11/hackers_raid_so_1.html
> (this has good links to other ariticles as well)
>
> Because libraries buy and circulate CD copies to mulitple users, you may
> want to take a look at the CDs in your collection and avoid these. Apart
> from the spyware and privacy aspects, this is potentially a huge security
> problem, and may actually cause Windows PCs to fail. Caveat emptor.
>

Though Anj and I had to do just a tiny superior dance--this doesn't affect Mac or Linux users.

Comments

[whitereflection.livejournal.com]

Aha, someone on the LE forums just mentioned the same thing:
One of the more fun things people are doing with that rootkit is hiding cheats from the Warden program that WoW uses to defeat cheating.... -_-;
So not necessarily software, but this same program being something easily abused. Good forethought, Sony! Like maybe they should have had some geeks test it beforehand to see what side effects this stuff might have? ...nah, that would actually involve *thinking*.