Report: Sony copy-protected CDs may hide Windows rootkit vulnerability

“A security analyst alleged Monday that playing a Sony copy-protected CD on his PC actually installed a rootkit into his computer from a third-party rights-management package,” Mark Hachman reports for ExtremeDRM. “According to Mark Russinovich’s security blog on Sysinternals.com, the Van Zant CD Get Right With The Man contains a rootkit that was installed when the CD’s on-disc player software was installed. That software, which Russinovich traced to U.K. vendor First 4 Internet, modified the Windows registry and was configured to hide system files encoded with a ‘$sys$’ prefix.”

Hachman reports, “The CD used a version of First 4’s rights management software, called “XCP” to protect the CD from unauthorized copying. Sony configured the software to allow two legal backups of the entire CD. Over 2 million CDs encoded with the First 4 Internet files have been shipped by Sony, according to MSNBC. Users had begun complaining about the First 4 Internet software in June, when the software allegedly prevented songs from being copied onto an Apple iPod.”

Full article here.

[UPDATE: 3:50pm ET: Fixed article summary.]

Advertisement: The New iPod with Video.  The ultimate music + video experience on the go.  From $299.  Free shipping.

Related articles:
How to beat Apple iPod-incompatible Sony BMG and EMI copy-protected CDs – October 04, 2005
Sony BMG and EMI try to force Apple to ‘open’ iPod with iPod-incompatible CDs – June 20, 2005
New Song BMG copy-protected CDs lock out Apple iPod owners – June 01, 2005

22 Comments

  1. It’s not rocket science, hold down the shift key when inserting a Sony CD onto a Windows PC. This will bypass the AutoPlay. You can also manually disable AutoPlay.

    Once you’ve taken this simple step you can treat said Sony CD like any other audio CD and rip everything into iTunes.

    This all assumes that the above mentioned piece of spyware hasn’t been installed on your Windows PC from a previous insertion of a Sony disk.

  2. Why does it say this
    “Last week consumers filed a nationwide class-action lawsuit against Apple Computer, Inc., claiming the world’s largest producer of portable music players..”
    under your headline on your main page? It’s got nothing to do with the article.

  3. When will some Windows PC owner going to sue Sony and Microsoft for installing software on his or her PC without his or her permission? Would you allow someone to install a part on your car without your prior approval? Why put up with this on your computer?

    MW: next. Next thing you know, they’ll install software to activate attached mikes and cameras and spy on you in your own home. (Sorry, getting a little paranoid there.)

  4. Does anyone have experience with these Sony so-called CDs on a Mac?

    Do they play on the Mac (presumably in iTunes, if you used another player, which one?) Can they be loaded into iTunes? If so, what version of iTunes did you use?

    If you have any experience here, please share it!

    This is something of interest to the Mac community!

  5. Tommy Boy, that’s not the big issue here (holding the shift key), the issue is that it’s installing a rootkit. For those of us who are unfamiliar with this, which is basically anyone that’s been using Macs, rootkits are basically the same thing that spyware, malware, adware, virus’, etc have been using to turn a Window’s machine into zombie machines. This guy realized that they installed this thing and then it was hoggin his CPU. He details his steps of trying to remove this thing and it was basically a nightmare. When it installed, it actually would boot up in “Safe Mode” as well. Plus the guy realized how crappy it was written. He also wondered if this thing was “calling home” to let Sony know what was installed on his computer.

    It’s a pretty scary thing to have a legitimate company install something on your computer, that basically amounts to a virus, without you giving permission for that company to do so.

    Also, there was no alert message saying anything, like click “I agree” or anything like that. It just installs it.

  6. i’m on a mac, and buy exclusively via itunes, but if i where a pc user could i sue over this? this seems really slimy. is there some kind of users agreement i have to agree to by clicking an accept button before playing this? bottom line, this is crap.

  7. There is gong to be some lawyer that sees this as a great class action lawsuit. The lawyer will make millions and the PC uses will get a $1 coupon off of their next Sony CD – plus an app that will clean up the mess that Sony caused. Pity.

  8. Does anyone have experience with these Sony so-called CDs on a Mac?

    Do they play on the Mac (presumably in iTunes, if you used another player, which one?) Can they be loaded into iTunes? If so, what version of iTunes did you use?

    If you have any experience here, please share it!

    This is something of interest to the Mac community!

    I have several of them – they are hit and miss on my iMac. The Oasis one would not work – it played once and then never again. The tech support lady on Apple’s iMac support chat sent me an article that explained how the cd side is too thin on dual discs and therefore was the equivalent of a heavily played five year old cd. The John Mayer cds all work perfectly every time and imported right into iTunes (orig used iTunes 4 but they still work on iTunes 6) on the iMac – they still work after much use in my living room dvd player. The Oasis one I had to put in a windows machine and burn a cd using windows media player and then import that into my iMac via iTunes.

  9. I heard a rumour that some companies were working on copy protection (i think to be in future BluRay?HD discs) that are designed to fry your bios or firmware or something, and you’ll have to get your computer reset by the computer manufacturer.

    If this does happen I will be sticking with p2p. Cheaper to pay a fine than buy a new computer. I’m counting on you Americans to sue the ass of any company that destroys youy equipment, all over a piss ant 20 dollar CD.

  10. ibm Laptopy Laptopy a prawa Bielizna Damska Odzież dla bobasa Odzież dziecięca, Recorder digital sony Kamery Cyfrowe kamera, super notebooki Notebooki oki moki , telewizory lcd i plasma Telewizory Lcd , jeszcze jeden super producent ibm Camcoo the best siemens , wspaniałe tv plasma Telewizory Plazmowe , największa oferta lcd Pralki , odtwarzacze dvd samsung dvd , zestawy kina domowego kino domowe , zabudowa kuchenna amica whirlpool kuchnie , wow jura the best ekspresy do kawy polecane bosch zmywarki , lge electro super promocje lg , i like sony music sony spoki doki ,wózki dziecięce, acer laptopy acer , samsung lodówki samsung , siemens group Nikon , panasonic albo panasonik panasonic , toshiba notebooki sklep toshiba , amica piekarniki amica , chłodziarki Lodówki, firma oly the best firms hp, super firma whirlpool najlepsza jakość , lodówka jest ok ale pralka to jest coś ale Pralki . MaxiMedia group . Canon Aparaty cyfrowe . Kancelaria prawa itd Kancelaria Prawna , aparaty cyfrowe canon i cyfrowe Aparaty cyfrowe sklep aparaty. Camcoo telewizory Telewizory, Nikon the best nikon aparaty cyfrowe oki kodak kodak FUJITSU SIEMENS laptopy fujitsu siemens, zarąbiste zabawki zabawki ogrodowe, super foteliki do siedzenia i foteliki samochodowe, pralki bosch whirlpool zmywarki kino domowe

Reader Feedback (You DO NOT need to log in to comment. If not logged in, just provide any name you choose and an email address after typing your comment below)

This site uses Akismet to reduce spam. Learn how your comment data is processed.