November 04, 2005
Sorry about those secret files; what we meant to install were these secret files
Writing in Freedom to Tinker, Princeton professor Ed Felten takes Sony BMG and First4Internet to task for their "fix" to the Digital Rights Management rootkit they used to protect some new music CDs (see "Sony reconsiders policy on hiring 'reformed' hackers" and "Sony DRM: You can look but you can't touch"). Seems the patch may have made an already bad situation worse. "[Sony] released a software update that they say 'removes the cloaking technology component that has been recently discussed in a number of articles,' " Felton writes. "Reading that statement, and the press statements by company representatives, you might think that that's all the update does. It's not. The update is more than 3.5 megabytes in size, and it appears to contain new versions of almost all the files included in the initial installation of the entire DRM system, as well as creating some new files. In short, they're not just taking away the rootkit-like function -- they're almost certainly adding things to the system as well. And once again, they're not disclosing what they're doing. No doubt they'll ask us to just trust them. I wouldn't. The companies still assert -- falsely -- that the original rootkit-like software 'does not compromise security' and '[t]here should be no concern' about it. So I wouldn't put much faith in any claim that the new update is harmless."

Washington Post Article
Brian Krebs on Computer Security
Posted at 06:35 PM ET, 11/ 8/2005
Calif. Lawsuit Targets Sony
A class-action lawsuit has been filed on behalf of California consumers who
may have been harmed by anti-piracy software installed by some Sony music
CDs. A second, nationwide class-action lawsuit is expected to be filed
against Sony in a New York court on Wednesday seeking relief for all U.S.
consumers who have purchased any of the 20 music CDs in question.

Experts say the Sony CDs use virus-like techniques to install digital rights
management software on computers. Windows users cannot listen to the
protected CDs on their computers without first installing the software,
which hides itself on the users' system and cannot be uninstalled by
conventional removal methods.

The California lawsuit, filed Nov. 1 in Superior Court for the County of Los
Angeles by Vernon, Calif., attorney Alan Himmelfarb, asks the court to
prevent Sony from selling additional CDs protected by the anti-piracy
software, and seeks monetary damages for California consumers who purchased
them.

The suit alleges that Sony's software violates at least three California
statutes, including the "Consumer Legal Remedies Act," which governs unfair
and/or deceptive trade acts; and the "Consumer Protection against Computer
Spyware Act," which prohibits -- among other things -- software that takes
control over the user's computer or misrepresents the user's ability or
right to uninstall the program. The suit also alleges that Sony's actions
violate the California Unfair Competition law, which allows public
prosecutors and private citizens to file lawsuits to protect businesses and
consumers from unfair business practices.

Himmelfarb was on a plane at the time of this writing and could not be
reached for comment.  But a court-stamped copy of the lawsuit he filed is
online here (PDF).

Scott Kamber, an attorney in New York, said he plans on Wednesday to file
class-action suits targeting Sony under both New York consumer protection
statutes and a federal criminal statute that allows civil actions.

"This situation is particularly egregious and surprising from a company that
should be familiar with concerns people have with programs crashing their
Windows computers," Kamber said. "What Sony is saying with this software is
that 'Our intellectual property is more deserving of protection than your
intellectual property,' and Sony can't be allowed to get away with that."

Sony spokesman John McKay declined to comment on the suits.

I wouldn't be surprised if other lawyers and law firms around the country
are also preparing to file similar suits.

As I wrote in a story last week, "Sony's move is the latest effort by the
entertainment companies to rely on controversial 'digital rights management'
(DRM) technologies to reverse a steady drop in sales that the industry
attributes in large part to piracy facilitated by online music and movie
file-sharing networks like Kazaa and Limewire."

Experts who studied the Sony program said it has a built-in file-cloaking
feature that could also be used by attackers to hide viruses and other files
on a user's computer, and that conventional means of removing the
anti-piracy software renders the user's CD-Rom drive inoperable.

In response to public criticism over the invasiveness of the software, Sony
last week made available on its Web site a "patch" that would prevent its
software files from hiding on the user's system. But according to further
research by a variety of security experts, that patch can lead to a crashed
system and data loss.

-ATRAC, Memory Stick, MiniDisc, UMD, and every other proprietary format that Sony tried to foist on the public, thinking that the Sony name would get them the sales, and that they could then force others to license Sony proprietary formats for big bucks. We all know how that went over --exactly like IBM's PS/2 with Microchannel line of computers.

- (quoted from Wikipedia)"In July 2000, a marketing executive working for Sony Corporation created a fictitious film critic, David Manning, who gave consistently good reviews for releases from Sony subsidiary Columbia Pictures, which generally received poor reviews amongst real critics." I don't know about you, but when a company attempts this kind of deception, they don't deserve my trust. Sony has also propagated other "astroturfing"-type campaigns in its history for its various Playstation gaming platforms.