Sony Rootkit Allegedly Contains LGPL Software (Copyright infringe by Sony

[Sgent]

From Slashdot:

According to this Dutch article the Sony DRM software (or rootkit, if you may prefer) contains code from the LAME MP3 encoder project, which is licensed under the LGPL. However, the source code has not also been distrbuted, hence breaching the license. Here is an english translation of the page." So apparently Sony violates your privacy to create a backdoor onto your machine using code that violates an Open Source license.

Article in Dutch
Link to slashdot article

This could be huge -- Sony, by breaking copyright laws that it helped pass, could face statuatory damages of 250,000 per CD.

Note to Mods: I really think this is breaking news, but couldn't find a good article to link. Feel free to move to GD if you think its needed.

[electropop]

1. Boycott Sony.

Their music is all tripe anyway. Look for quality independents.

[DRoseDARs]

2. Oh, it would be delicious if this were an industry-wide scandal with...

...all the major record labels having participated.

[MADem]

3. This IS big! I found a few related links

http://www.pcworld.com/news/article/0,aid,123543,00.asp

Microsoft has joined a growing group of security software vendors who are treating Sony BMG Music Entertainment's controversial Extended Copy Protection (XCP) copy protection software as a threat. Microsoft has announced it will begin treating the software as spyware and offering users tools to remove it, just as a Princeton University computer science researcher raised questions about a second Sony copy protection product.
MORE AT LINK


http://cnet.com.au/software/security/0,39029558,4005824...

On Thursday, a wave of malicious software appeared in the wild that piggybacked on copy-protection technology installed on hard drives by Sony BMG Music Entertainment CDs.

Computer security companies had been predicting such exploit code in the wild for weeks, since an independent developer had exposed the presence of a "rootkit" tool on the Sony CDs. The rootkit technology hid the copy protection from view, but also left open a hole that could hide other software.

Virus writers quickly took advantage of that hole, modifying an old Trojan horse to take advantage of the powerful inadvertent shielding provided by the Sony software.

On Friday, Sony responded to the furor and announced that it will suspend production of CDs that contain this particular copy-protection technology and take a second look at its digital rights management strategy. ...MORE AT LINK

[rayofreason]

4. Sony has other problems as well...

...Check this out

http://www.eff.org/deeplinks/archives/004145.php

More good reasons to avoid Sony.

[Poll_Blind]

5. This really is huge news! These are SERIOUS crimes now.

And....This is great! Sony, eat shit (and subpoenas)!

PB

[drb]

17. Send all those Sony bastards to Guantanamo now!!! Yeah!!!

[Renew Deal]

6. This is actually pretty big.

They're going to get sued for a lot of money. Royalties for every disk found to contain it.

[jayfish]

10. Giggle....

Your joking right? No self-respecting judge is going to allow any adverse action to be taken against Sony. It would be too great a burden for the company. Be careful downloading the MP3 of 20-year old song you just heard though. Your libel to get bankrupted.

Jay

[Occulus]

7. Corporations should not be able to hold copyrights. Period.

They are not persons; their 'personhood' under the law is false, was never argued before the SCOTUS, never appeared in any SCOTUS decision (only the headnotes of a decision) and strongly resembles in that decision a Divine Declaration of the King.

The issue needs to be revisited so corporations can be either completely stripped of their "rights" under the Constitution- since by definition they are not persons and thus may posess no rights- or they purchase with those rights the responsibilities you and I live under, including jail time and a corporate death penalty (suspending a corporate charter for x years or closing the company completely if it pulls an Enron or does similar misdeeds).

As things stand, corporations have things both ways and it is causing incalculable damage to our society and our world. From illegal logging to environmental pollution to corporate media control to copyright abuse, progressive issues across the entire spectrum of ideas could be successfully fought if corporations had controls on their personhood or (more logically) no personhood at all.

[Dora]

23. Say it loud and often: End Corporate Personhood!

Thanks, kgfnally.

[daa]

8. Sony is a hacker don't buy anything from them nt

[Kellanved]

9. That is pretty much debunked

The player contains LAME constants, but so far no actual code has been found.



http://www.the-interweb.com/serendipity/index.php?/arch...

http://www.democraticunderground.com/discuss/duboard.ph...
http://www.democraticunderground.com/discuss/duboard.ph...

[Strabo]

12. your debunk...

...is debunked in the comments on that very page. Thanks for playing. Please try again.

[Kellanved]

13. there are variations in the quality of the comments

The go.exe thing is soundly debunked.

There are other possible (L)GPL breaches still under investigation - we'll see.


On Edit:
http://www.the-interweb.com/serendipity/index.php?/arch...

[guruoo]

19. More on the rootkit aspect here...

http://www.sysinternals.com/blog/2005/11/more-on-sony-d...

[guruoo]

30. Tool for detecting active rootkits on your system

RootKit Hook Analyzer

New: check for active kernel rootkits on your system

RootKit Hook Analyzer is a security tool which will check if there are any rootkits installed on your computer which hook the kernel system services. Kernel RootKit Hooks are installed modules which intercept the principal system services that all programs and the operating system rely on. If any of these system services are intercepted and modified it means that there is a possibility that the safety of your system is at risk and that spyware, viruses or malware are active.

http://www.resplendence.com/hookanalyzer

[bpilgrim]

31. os x version

checkmate
http://personalpages.tds.net/~brian_hill/checkmate.html

peace

[Occulus]

18. Perhaps not....

This, from the /. comments section:

The GO.EXE doesn't appear to contain LAME code even though it has been linked against it, however at least ECDPlayerControl.ocx on the CD (packed in XCP.DAT, installed along DRM) does contain code from LAME. It also uses Id3lib and mpglib, without attribution or any licenses shipped along. I spotted bladeenc dll there as well.

And then there's this comment, which I just find delicious:

What does the rootkit do when it detects LAME?
(Score:4, Interesting)
by dmoen (88623) on Tuesday November 15, @09:08AM (#14034182)
(http://slashdot.org /)
1. It seems that Sony has not actually included any executable code from LAME, only some data, which is likely used as a signature, to determine if you have LAME installed and are using it to rip MP3s. This is likely fair use, not wholesale copyright violation, as far as LAME and the LGPL are concerned.

So the interesting question is: what does the rootkit do when it detects LAME on your hard drive? Does it disable or corrupt LAME? Does it phone home? Does it automatically initiate an RIAA lawsuit?

*This* is what I think the next Sony class-action lawsuit should be about. I doubt there is enough grounds to get them on an LGPL copyright infringement suit.

2. Muzzy points out that the Sony uninstaller installs a "safe for scripting" Active-X control with remotely exploitable entry points for rebooting your machine and possibly for installing arbitrary code on your machine. More fuel for the tasty class action suits that are starting up.

3. Sony has done so many evil things with the rootkit fiasco (and we haven't discovered them all yet); the outrage is spreading, and it may lead to a major backlash against the whole industry practice of distributing corrupted CDs in the name of DRM. Here's hoping for a brighter tomorrow.

Doug Moen.

Yes, yes, one thousand times, yes. We all knew they were playing fast and loose with the very same law they authored, and we all knew it would turn right around and bite them in the ass.

A complete ban upon all copyright protections in music and software strictly upon the grounds that the consumer has a right to use a copy of the program or software for personal use cannot be argued against at this point. The only way to protect the "right" to no unauthorized copying is to put roadblocks in place that by default affect legitimate copiers far more than illegitimate ones, and we now know it is a given that those attempts will be abused by the copyright holder if it is possible for them to do so, even when we let them write the law governing unauthorized copying.

This has to end.

[captain disgruntled]

11. These may well be English translations of this page,

but I still can't understand a word of it.

Can somebody please explain this issue to a retarded non-tech-fiend??

[alkaline9]

15. long ago, programmers knew better...

...than to make their code available to corporations for uses just like this. Many applications (but more often simply code libraries) are considered "freeware". Freeware comes in many forms, but this particular form (LGPL license) requires certain things about copying or using the code that someone else developed in your (for sale) application.

Sony has used someone else's "free" software as part of their "rootkit" attack on their customers. It appears that by doing this, they have violated the LGPL (http://www.gnu.org/copyleft/lesser.html ) license agreement inherent with the free software. This opens them up to all kinds of lawsuits...

time to sit back and watch the fireworks!

[Occulus]

20. Here's what happened:

Sony had a little program placed on some of its music cds that installs silently on your computer's hard drive when the disc is played on a PC. This little slice of software apparently uses software code within its executable (the .exe file it runs on the PC in question) that Sony never bothered to get the license for.

It should be pointed out that it doesn't matter if you son or daughter downloads music without your knowledge; according to the RIAA, you are still liable. Similarly, it doesn't matter that it was the developer of the spyware on the Sony music cd who made it and not Sony; it's still Sony's product, so they're liable as well.

Apparently, according to the comments over at Slashdot, there were actually four pieces of seperate software the Sony spyware program internally checks against or (according to the poster Muzzy) actually uses in some way. For that to be possible, there would have to be code for those other pieces of software present, which would require that the license for each of them be properly followed.

From what I gather, Sony never bothered; they just used it- commercially- without consent and without license: the very same thing they have gone after 12-year-olds for in the past.

It's all very lovely, really.

[captain disgruntled]

27. Thanks! I think I DID understand that!

[oregonjen]

14. I was reading on Amazon.com that Neil Diamond's new cd

has that software and people are not buying his cd because of it. I found that info reading people's reviews of the cd. Is this true?

[jayfish]

16. I Wonder If Any Of These Geniuses Have Done...

an analysis of what it's costing them to keep pursuing these copy protection schemes vs. what they are supposedly losing to file-swapping?

Jay

[Sgent]

21. Nope...

cause according to the BMG/Sony Music CEO, customers don't know what it is so they won't care (paraphrased from an NPR interview last week).

[jmowreader]

24. I don't think non-sales are due to this software

It's more like "people are not buying his CD because it's a Neil Diamond CD."

It's Neil Diamond. Come on. This guy plays Community Concerts.

About 90 percent of the people who write online reviews of products are completely full of shit. None of the people bitching about Sony's spyware were gonna buy a Neil Diamond CD anyway..."isn't that what your mom listens to?"

[oregonjen]

25. Community concert? What's that?

In Sept. when Neil Diamond came to town, he played a pretty close to sold out Rose Garden. I know because I went to it. Yes, I am a mother and I took my mother to this concert. A near forty yr. old with her mid-sixties mother. How totally uncool of me.

So, basically you are implying that people who are Neil Diamond cd buyers are not tech savvy?

[jmowreader]

33. What Community Concerts are

Concerts are expensive to stage, and promoters don't like to go into a venue without a reasonable expectation of at least breaking even. This means that in a lot of areas, there will be no live music because there's a history of concerts playing at a loss.

Enter Community Concerts. Counties that have them pay the promoter a set fee, and all ticket revenue goes to the county. Community Concerts' offerings tend to "mirror the tastes of the community" which means they're pretty tame--Cumberland County's 2005-06 Community Concerts schedule includes "Abba The Show" and Neil Diamond has played here a couple of times.

I wasn't implying that people who are Neil Diamond CD buyers are not tech savvy. I am coming right out and saying that people who are Neil Diamond CD buyers are not fifteen to twenty years old, like most of the people who wouldn't buy a CD because they can't rip it to their iPod are.

[Kellanved]

28. Well

Good point regarding Neil Diamond, but I avoid "protected" "CDs" (they are not actually CDs).

Why? Easy: more expensive, less of the money goes to the artist, less durable, inferior audio quality, nasty surprises and I am not allowed to make copies for my own private use.

Why should I pay the same amount of money, or even more, for a clearly far inferior product?

No thanks.

[corporatemedia]

26. n/t

[BattyDem]

22. So let me get this straight ...

Sony broke copyright laws while trying to prevent consumers from breaking copyright laws???

[Occulus]

29. A better question would be, does this invalidate any claims Sony many make

in court against people who download music?

Three words: clean hands doctrine.

They cannot sweep the floor; their broom is dirty. I sincerely hope Sony's ongoing suits get dismissed on these grounds; to my mind, they just lost their right to bring suit-

NOT THAT THEY EVER ACTUALLY HAD THAT RIGHT IN THE FIRST PLACE, GIVEN THAT 'SONY' IS NOT A PERSON. 'Sony' should NOT be able to sue any private citizen- period. For ANY reason.

[guruoo]

32. Update: Sony recalls copy-protected music CDs

http://www.msnbc.msn.com/id/10069563 /

Sony recalls copy-protected music CDs
Company will also distribute program to remove virus-like software

Updated: 1:10 p.m. ET Nov. 16, 2005

BARCELONA - Music company Sony BMG, yielding to consumer concern, said on Wednesday it was recalling music CDs containing copy-protection software that acts like virus software and hides deep inside a computer.
<snip>

[ContraBass Black]

36. Bwa ha ha ha ha ha ha!

I hope it's too late for damage control.

[jmowreader]

34. A humorous anecdote about Sony

I was reading a pro audio forum and someone was talking about trying to obtain from Sony a $1000 part for a $50,000 Sony product. And Sony wasn't exactly expediting his request.

Some other guy wrote back, "our greatest scientists have discovered a cure for AIDS. They're going to put it in the Sony parts catalog and then no one will be able to get it."

[ContraBass Black]

35. I would love to see some litigation tear them limb-from-limb.

Out of spite for the rootkit and other tactics.

[smb]

37. Homeland Security Is Not Happy With Sony

Link

...A representative of the United States government last week warned entertainment publishers against using CD and DVD copy protection software that hides inside computers.

"It's very important to remember that it's your intellectual property; it's not your computer. And in the pursuit of protection of intellectual property, it's important not to defeat or undermine the security measures that people need to adopt in these days," said Stewart Baker, the assistant secretary the Department of Homeland Security, at a conference....