Help - Search - Members - Calendar
Full Version: Music CD's Install Trojan Horses on PC's
Herald-Mail Forums > Community Corner > Getting a little help from my friends > Music to live by
Yossarian
Interesting article here on playing music CD's on your PC. You could be installing bad stuff (Bad Stuff = technical term for "bad stuff") on your computer.

Reports are beginning to turn up around the Web that discuss how certain CDs from Sony Music come with a Trojan horse-based digital restrictions management (DRM) technology that surreptitiously installs itself as a rootkit on Windows PCs. When software surreptitiously installs a rootkit, it's usually doing so to cover its tracks — a technique commonly associated with malware such as viruses and Trojan horses. Rootkits generally latch themselves onto the foundation or "roots" of an operating system in a variety of ways that not only prevent their detection, but also their extraction. According to the Wikipedia's definition," a rootkit is often used to hide utilities used to abuse a compromised system."

More Here:

http://blogs.zdnet.com/BTL/?p=2092&tag=nl.e539
SMan
We discussed this briefly in a music thread a while back when the new Foo Fighters CD was released with this autorun copy protection crap. Not nearly as devious as this, but still crappy.

What more can the RIAA do to piss people off????
Yossarian
This isn't just about copy protection.

This crap has the potential of actually making your PC useless.
Snoopy
Wy would Sony put software on your computer to make it useless? Imagine the lawsuits, not to mention bad press.
samy0
And these J.A's can't figure out why everyone is downloading songs. yeah, I love paying $18 for a CD then have it kill my computer!
sheash
Wait a minute, here..... Did I understand you right?

Did you just tell me that if I buy a CD, they are putting something on the CD's that prevents me from making a copy of it for my car? Do they expect me to buy a 2nd CD for my car? If so, they'd better be dropping the prices to about $1.99 per CD!
Yossarian
That's exactly what the RIAA would want you to do, sheash. They want you to buy a copy for your home, for your car, for your work, for your mp3 player...
WVDragonlady
QUOTE (samy0 @ Nov 2 2005, 01:09 PM)
And these J.A's can't figure out why everyone is downloading songs. yeah, I love paying $18 for a CD then have it kill my computer!
*


Isn't that what CD players are for?
(serious question).
I listen to (i'm guessing) satilite radio on my computer but not cds
Snoopy
I see how it might prevent me from making a copy, which is a PIA and ticks me off, but how does it make my computer useless?? I do not keep up w/ this stuff.
Wrangler3
When they price CD's reasonable I will quit downloading music as I do. I only buy ones I have downloaded to ensure it is worth $20 to me. I really can't see the RIAA stopping people from copying music. As stated before they are only making more people want to rebel against them. They shut down one file sharing site there is another one just waiting to take its place. laugh.gif
Yossarian
QUOTE (Snoopy @ Nov 2 2005, 04:35 PM)
I see how it might prevent me from making a copy, which is a PIA and ticks me off, but how does it make my computer useless??  I do not keep up w/ this stuff.
*


that's why I posted the link, it can't be explained in a typical 10 second soundbyte.

basically, snoop, say you play one cd with copy protection "A" which installs "A" on your PC. Then you pick up the next CD and it installs copy protection "B" on your computer. Well A and B don't play well together -- now all of a sudden you system files are screwed and the only way out is a format C: and reinstall of everything.
sheash
QUOTE (Yossarian @ Nov 2 2005, 07:24 PM)
That's exactly what the RIAA would want you to do, sheash. They want you to buy a copy for your home, for your car, for your work, for your mp3 player...
*


Well, they can keep on wanting. I can't believe it, first they mess with KPIG, then they pull this crap...... If they succeed, then I'll be buying 2nd copies of my music at used CD stores; I'll be da**ed if I'm paying $15 or more each for multiple copies. And to think I just ordered 2 CD's off of Amazon.....
the5car
Irate music fans who posted to dozens of online blogs vowing to never again buy Sony CDs as long as the company keeps using a suddenly beleaguered anti-piracy software program may find that their outbursts have been partially rewarded today.

On the heels of the Internet uproar over security concerns with its copyright-protection measures, the company that developed the software for recording-industry giant Sony BMG Music Entertainment says it is providing computer users with a "patch file" that will mitigate some of the features that alarmed security researchers when they were discovered earlier this week -- especially the program's built-in ability to hide files on the user's system.

Privacy and security experts charged that the technology built into many of Sony's music CDs since March is unnecessarily invasive and exposes users to threats from hackers and virus writers.

"Here you have one of the biggest name-brand corporations on the planet getting into what many people in other circumstances would consider hacking," said Richard Smith, a security and privacy consultant based in Boston. "That's just not acceptable."

Earlier this week, computer security researcher Mark Russinovich published an analysis showing that some new Sony CDs install software that not only limits the copying of music on the discs, but also employs programming techniques normally associated with computer viruses to hide from users and prevent them from removing the software.

Russinovich's findings -- posted on the Web site (http://www.sysinternals.com/) that he runs with another researcher -- indicated that the CDs in question use software techniques that behave similarly to "rootkits," software tools that hackers can use to maintain control over a computer system once they have broken in.

He found that traditional methods of uninstalling the program would not work, and that attempts at removing it corrupted the files needed to operate his computer's CD player, rendering it useless.

Sony spokesman John McKay said the technology has been deployed on just 20 titles so far, but that the company may include it on additional titles in the months ahead.

The music industry is aggressively defending its works from Internet and other forms of piracy, going so far as to sue individuals alleged to be trading large numbers of song titles online. The industry loses roughly $4.2 billion worldwide to piracy each year, according to the Recording Industry Association of America.

Russinovich discovered that the techniques employed by the Sony program to conceal its files from the user and to make them harder to remove could also be used by virus writers and hackers to hide malicious files on any computer running the anti-piracy program.

In response to criticisms that intruders could take such advantage, First4Internet Ltd. -- the British company that developed the software -- will make available on its Web site a software patch that should remove its ability to hide files, chief executive Mathew Gilliat-Smith said.

Russinovich called the offer of a patch "backpedaling and damage control in the face of a public-relations nightmare" and emphasized that users who try to remove the files manually after applying the fix will still ruin their CD-Rom drives.

Sony's move is the latest effort by the entertainment companies to rely on controversial "digital rights management" (DRM) technologies to reverse a steady drop in sales that the industry attributes in large part to piracy facilitated by online music and movie file-sharing networks like Kazaa and Limewire.

DRM technologies by their very nature need to be secretive, according to Peter Ullman, a partner with Woodcock Washburn, a Philadelphia law firm that specializes in intellectual property matters.

"If the software is put there to protect valuable content from being misused, then the software has to be able to protect itself from being subverted, so the companies that produce this security technology tend not to want to publicize how their technology works," Ullman said.

At issue is whether Sony has provided customers with adequate notice about what they can expect when installing the software, said Ari Schwartz, deputy director of the Washington-based Center for Democracy and Technology.

"Sony needs to be more transparent in how and what they're installing so that consumers can make informed decisions," Schwartz said.

Windows users cannot listen to tracks on the CD without agreeing to install the anti-piracy program, which merely advises that "it will install a small proprietary software program" that will remain there "until removed or deleted."

But according to Mikko Hypponen, director of research for Finnish antivirus company F-Secure Corp., users who want to remove the program may not do so directly, but must fill out a form on Sony's Web site, download additional software, wait for a phone call from a technical support specialist, and then download and install yet another program that removes the files.

Hypponen agreed that Sony's software could help hackers circumvent most antivirus products on the market today. He added that installing the Sony program on a machine running Windows Vista -- the beta version of the next iteration of Microsoft Windows -- "breaks the operating system spectacularly."

While the anti-piracy software allows consumers to make a limited number of additional copy-protected discs, it also imposes compatibility and portability constraints. Users of Apple Inc.'s iPod -- the dominant portable media player on the market -- have no way of transferring tracks from protected Sony CDs to their device, since Apple has not yet licensed its own DRM technology for use with copy-protected discs.

"We're still in this new digital era where the entertainment industry wants to protect ... their content, without due consideration of the consumer's right to use that content in a fair way," Russinovich said. "We need to have an open discussion as to where we should draw the line."

David Eisner, a blogger and software developer at the University of Maryland's Computer Aided Life Cycle Engineering Center, believes the record label's actions will ultimately backfire and drive otherwise legitimate customers to download pirated music from the online file-sharing networks.

"The people they're trying to stop from stealing their music are always going to find a way around these types of technologies," Eisner said. "Sony is just hurting people who obtain their products legally, and many of these same people are now going to think twice about doing so."
Snoopy
Thanks, guys. Now I get it. Bad Sony! Bad! mad.gif I hope they get what they deserve... cool.gif
Wrangler3
QUOTE
David Eisner, a blogger and software developer at the University of Maryland's Computer Aided Life Cycle Engineering Center, believes the record label's actions will ultimately backfire and drive otherwise legitimate customers to download pirated music from the online file-sharing networks.

"The people they're trying to stop from stealing their music are always going to find a way around these types of technologies," Eisner said. "Sony is just hurting people who obtain their products legally, and many of these same people are now going to think twice about doing so."


ding, ding, ding, ding we have a winner.
boe354
Just download "legal" music and you don't have to worry about it. Much cheaper as well but a high-speed internet connection is a necessity to do so, IMO! I haven't purchased a music CD in about 5 years. biggrin.gif

I don't believe Sony is the only one causing the issues with copy protection software, but they are taking a lot of heat at the moment for it. Sony is definitely not the company they once were in the past. sad.gif
YeomanWeller
The only problem with "legal" downloads is the bit rates. Most are very low, which is fine for listening on a portable device. But try playing them on a higher end stereo system and they sound terrible !! When you buy a cd you can rip it at any bit rate that you like.
SMan
QUOTE (YeomanWeller @ Nov 4 2005, 10:31 PM)
The only problem with "legal" downloads is the bit rates. Most are very low, which is fine for listening on a portable device. But try playing them on a higher end stereo system and they sound terrible !! When you buy a cd you can rip it at any bit rate that you like.
*



True. Downloading works for me though since all my listening through a portable or an occassional burned cd in the car. At .99 a song and 9.99 an album, it's cheaper than buying a cd, too.

Cheaper still if you download pirated stuff! biggrin.gif
boe354
QUOTE (YeomanWeller @ Nov 4 2005, 11:31 PM)
The only problem with "legal" downloads is the bit rates. Most are very low, which is fine for listening on a portable device. But try playing them on a higher end stereo system and they sound terrible !! When you buy a cd you can rip it at any bit rate that you like.
*



Somewhat true but there are legit websites that sell high bit-rate tunes, 256-320 kbit/s. Not I ever visit them, tongue.gif I can't find the site at the moment, but will post if I can find it. I prefer 256 kbit/s ripped tunes.

Correct me if I'm wrong but isn't CD quality considered 128 kbit/s if you were listening directly from a store or web purchased CD. But you do lose a little quality if you are converting to MP3, etc. I can't tell a difference in listening to a CD version compared to a ripped 128 kbit/s version MP3. But I can tell a difference between an MP3 256 or 320 kbit/s ripped version compared to listening directly from a CD. blink.gif Lossless is my all time favorite format to rip a tune, but the files tend to be larger depending on the encoder that is used.
boe354
QUOTE (SMan @ Nov 5 2005, 11:31 AM)
Cheaper still if you download pirated stuff! biggrin.gif
*


shhhh!, don't tell everyone! lol tongue.gif
Udmas
QUOTE
A controversial copy-protection program that automatically installs when some Sony BMG audio CDs are played on personal computers is now being targeted by malicious software that exploits the antipiracy technology's ability to hide files.

The Trojan horse programs _ three have so far been identified by anti- virus companies _ are named so as to trigger the cloaking feature of Sony's XCP2 antipiracy technology, security experts said Thursday.

"This could be the advanced guard," said Graham Cluley, senior technology consultant at the security firm Sophos. "We wouldn't be surprised at all if we saw more malware that exploits what Sony has introduced."

The copy protection program is included on about 20 popular music titles, including releases by Van Zant and The Bad Plus, and disclosure of its existence has raised the ire of many in the computing community, who consider it to constitute spyware.

Sony BMG Music Entertainment and the company that developed the software, First 4 Internet, have claimed that the technology poses no security threat. Still, Sony posted a patch last week that uncloaks files hidden by the software.

On Thursday, Sony released a statement "deeply regretting any disruption that this may have caused." It also said it was working with Symantec and other firms to ensure any content-protection technology "continues to be safe."

Neither Sony spokesman John McKay nor First 4 Internet CEO Mathew Gilliat-Smith returned messages seeking additional comment.

Windows expert Mark Russinovich discovered the hidden copy-protection technology on Oct. 31 and posted his findings on his Web log. He noted that the license agreement that pops up said a small program would be installed, but it did not specify it would be hidden.

Manual attempts to remove the software can disable the PC's CD drive. Sony offers an uninstallation program, but consumers must request it by filling out two forms on the Internet.

"What they did was not intentionally malicious," Cluley said. "If anything, it was slightly inept."

The copy-protection software, which Sony says is a necessary "speed bump" to limit how many times a CD is copied, only works on Windows- based PCs. Users of Macintosh and Linux computers are not restricted.

The viruses also only target Windows-based machines.

The infection opens up a backdoor, which could be used to steal personal information, launch attacks on other computers and send spam, antivirus companies said.

Sony also is facing legal headaches. On Nov. 1, Alexander Guevara filed suit in Los Angeles County Superior Court seeking class action staus. He claims Sony's actions constituted fraud, false advertising, trespass and violated state and federal laws barring malware and computer tampering.

His attorney, Alan Himmelfarb, did not immediately return calls seeking comment.

"Entertainment companies often complain that fans refuse to respect their intellectual property rights. Yet tools like this refuse to respect our own personal property rights," said Jason Schultz, a staff attorney for the Electronic Freedom Foundation. "Sony's tactics here are hypocritical, in addition to being a security threat."


Might not get much out of the lawsuit $ wise, but hopefully it will embarrass Sony.
Yossarian
Well, to add to Sony's embarassment, here come's the first exploit:

Hackers use Sony BMG to hide on PCs

Thu Nov 10, 3:35 PM ET

A computer security firm said on Thursday it had discovered the first virus that uses music publisher Sony BMG's (6758.T) controversial CD copy-protection software to hide on PCs and wreak havoc.

Under a subject line containing the words "Photo approval," a hacker has mass-mailed the so-called Stinx-E trojan virus to British email addresses, said British anti-virus firm Sophos.

When recipients click on an attachment, they install malware, which may tear down a computer's firewall and give hackers access to a PC. The malware hides by using Sony BMG software that is also hidden -- the software would have been installed on a computer when consumers played Sony's copy-protected music CDs.

"This leaves Sony in a real tangle. It was already getting bad press about its copy-protection software, and this new hack exploit will make it even worse," said Sophos's Graham Cluley.

Later on Thursday, security software firm Symantec Corp. (Nasdaq:SYMC - news) also discovered the first trojans to abuse the security flaw in Sony BMG's copy-protection software. A trojan is a program that appears desirable but actually contains something harmful.

Sony BMG's spokesman John McKay in New York was not immediately available to comment.

The music publishing venture of Japanese electronics conglomerate Sony Corp. (6758.T) and Germany's Bertelsmann AG (BERT.UL) is distributing the copy-protection software on a range of recent music compact disks (CDs) from artists such as Celine Dion and Sarah McLachlan.

When the CD is played on a Windows personal computer, the software first installs itself and then limits the usage rights of a consumer. It only allows playback with Sony software.

The software sparked a class action lawsuit against Sony in California last week, claiming that Sony has not informed consumers that it installs software directly into the "roots" of their computer systems with rootkit software, which cloaks all associated files and is dangerous to remove.

Sophos said it would have a tool to disable the copy protection software available later on Thursday.

Sony BMG made a patch available on its Web site on Tuesday that rids a PC from the "cloaking" element that is part of the copy-protection software, while claiming that "the component is not malicious and does not compromise security."

The patch does not disable the copy protection itself.

The Sony copy-protection software does not install itself on Macintosh computers or ordinary CD and DVD players.
SMan
Hooray, haXoRs!

Maybe they are good for something.
Udmas
QUOTE
Sony BMG, the joint venture record label, was on Friday forced into an embarrassing climbdown over its use of copy-protection technology on music CDs that exposed some PC users to hackers.

The company said it would “temporarily suspend” use of the controversial software and apologised to PC users for “possible inconvenience” it may have caused.


Rest of story is here

This might end it for now, but I bet they let things cool down a bit then try again.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2010 Invision Power Services, Inc.