|
|
Posted by BbGuess on 11/11/05 18:54
Bots' for Sony CD software spotted online
By John Borland
Staff Writer, CNET News.com
Published: November 10, 2005, 12:40 PM PST
Tell us what you think about this storyTalkBack E-mail this story to a
friendE-mail View this story formatted for printingPrint See links from
elsewhere to this story (TrackBacks/Pingbacks)TrackBack
A first wave of malicious software written to piggyback on Sony BMG
Music Entertainment CD copy protection tools has been spotted online,
computer security companies said Thursday.
Sony's software, installed when playing one of the record label's
recent copy-protected CDs in a computer, hides itself on hard drives
using a powerful programming tool called a "rootkit." But the tool
leaves the door open behind it, allowing other software--including
viruses--to be deeply hidden behind the rootkit cloak.
The first version of a Trojan horse spotted early Thursday, which aims
to give an attacker complete remote control over an infected computer,
didn't work well. But over the course of the day, several others
emerged that apparently fixed early flaws.
News.context
What's new:
The first pieces of malicious software designed to hide in Sony BMG
Music Entertainment's copy protection tool for CDs have been spotted,
say security experts.
Bottom line:
The malicious software programs in this case are Trojan horse, or
"bot," variants, which are intended to give the attacker remote control
of any computer they infect as they hide in Sony's copy protection
tool. Security experts say that more such attacks are likely. For Sony,
concern over the issue has prompted at least one lawsuit and plenty of
criticism.
More stories on Sony's copy protection quandary
"This is no longer a theoretical vulnerability; it is a real
vulnerability," said Sam Curry, vice president of Computer Associates'
eTrust Security Management division. "This is no longer about digital
rights management or content protection, this is about people having
their PCs taken over."
Sony's use of the rootkit software has sparked a firestorm of criticism
online and off over the company's techniques, highlighting concerns
that remain over record labels' increasingly ambitious attempts to
control the ways consumers can use purchased music.
Last week, plaintiffs' attorney Alan Himmelfarb filed a class action
suit against Sony BMG in Los Angeles federal court, asserting that the
company had violated state and federal statues on unauthorized computer
tampering. The company's actions also constituted fraud, trespass and
false advertising, the suit contends.
Other attorneys say they are considering other suits. Several Italian
consumer groups also have said they are looking into the prospect of
taking legal action against Sony, although the relevant discs were
distributed by the record label's U.S. division and not intended for
overseas sale.
Sony's use of the rootkit stems from record companies' growing concerns
that unrestricted music copying is undermining their sales, and they
have been looking for a technological way to limit the number of copies
that people can make of each CD they buy.
Sony BMG has experimented with several different ways to do this. The
current controversy focuses on just one of those tools, created by a
British company called First 4 Internet.
The First 4 Internet software is included on a handful of CDs,
including recent releases from My Morning Jacket and Southern rockers
Van Zant. When the albums are put in a computer's CD drive, they ask a
listener to click through a consent form, and then install the rootkit
copy-protection software on the hard drive.
A rootkit is a tool that takes a high level of control over a computer,
potentially even preventing the original computer user from performing
certain tasks. In this case, the First 4 Internet hides itself from
view in the computer's guts.
One Trojan horse discovered by security companies Thursday is a variant
of a pre-existing software distributed by spam e-mail, among other
techniques.
One version of the e-mail claims to be from a business publication and
says it is using a photograph of the recipient for a soon-to-be
published article, according to security company BitDefender. Clicking
on the alleged photograph installs the malicious software, which then
connects automatically to the Internet Relay Chat chat network, opening
up a channel to control the infected computer.
In a new version of the program, the software hides itself using Sony's
rootkit tool and then tries to connect to a server on the chat network.
The first version of the Trojan was unable to function after hiding
itself, security company F-Secure said. However, several other variants
have been found that are able to successfully take over control of a
computer after hiding under the Sony software.
All virus companies are rating the danger as fairly low so far, since
the Trojans seem to be spreading slowly.
Most antivirus companies are releasing versions of their software that
identify or remove the Sony software. A patch on the Sony Web site will
uncloak the copy protection tools, but computer users must contact
Sony's customer service for instructions on removing it altogether.
Neither Himmelfarb nor a Sony BMG spokesman could immediately be
reached for comment. A Sony BMG representative contacted last week
noted that the software could be easily uninstalled by contacting the
company's customer support service for instructions.
Navigation:
[Reply to this message]
|