Uproot Sony-BMG's Invasion of Your Privacy and Your Computer

[eridani]

For years now, copy-restriction software has been a looming threat to those who purchase music and want to make fair uses, such as space-shifting it from one device or computer to another. Fortunately, early versions of the software were so cumbersome and easy to work around that consumers whole-heartedly rejected or bypassed them. Recently, however, at least one record label has stepped up the war for control of digital content by drawing from the playbook of spyware companies and virus-writers.

Using a program called a rootkit, inserting a Sony BMG music CD will now infect your computer with a nefarious program, burying it deeply and obscurely within your operating system. The program will monitor your computer activity in the name of preventing the so-called "epidemic of piracy" that results from people making extra copies of their music CDs or favorite songs. Worse yet, there is no "uninstall" feature on this program. It's like the roach motel -- once Sony BMG's surveillance program checks in, you can't make it check out without completely wiping your entire system clean. Such practices have been widely condemned in the computer world, even by Microsoft's own research division.

Outrage from computer users and music fans has sparked Sony BMG into offering a program on its website that will show you if you have been infected with the rootkit. However, while you can see the program running, you still can't uninstall it, and some security experts believe installing the "update" may even infect your computer with more unwanted files.

While it is debatable whether copy-restriction software can even prevent serious illegal copying to begin with, there should be no question that invading our computers and infecting our systems should be off-limits. Unfortunately, the law is unclear on the exact rights users have to keep programs like Sony's rootkit off your computer when you purchase their CDs or click on a random "I Agree" button that might appear during an installation process. Until the law clarifies that We the Consumer actually hold the rights and keys to our computers, spyware companies, virus-makers, and now even entertainment conglomerates will be the ones dictating what we can and cannot do in the privacy of our own homes with the equipment and content we have lawfully purchased. Left unchecked, they will continue using our own computers against us to enforce their will and whims over our personal freedoms and behavior.

Entertainment companies often complain that computer users refuse to respect their intellectual property rights. Yet tools like Sony's rootkit refuse to respect our own personal property and privacy rights. Such hypocrisy should not stand.

Note: According to Princeton University CS Prof. Ed Felten, if you're using a recent version of Windows, you can protect yourself against this type of software, and some other security risks, by disabling autorun.

More on the Sony rootkit:

http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html

More on the Sony response:

http://sfgate.com/cgi-bin/article.cgi?file=/news/archive/2005/11/02/financial/f160614S41.DTL

More on Ed Felten's suggestions:
http://www.freedom-to-tinker.com/?p=920

[MazeRat7]

1. Note: This only impacts Windows users...Unix and Mac OS are immune.

[Sgent]

2. Note.. this affects more than music fans

any windows system that has ever inserted a newer sony disc will be affected -- and made suseptible to viruses and keyloggers.

By installing this rootkit, sony has opened your computer up to a host of additional attacks which are undectible by virus and spyware scanners. These could take over your computer, log your keystrokes, send spam, and do a host of other things.

[kcass1954]

5. It's one thing to pick up spyware. You expect that, and it can usually be

removed with a minimum of effort. It's quite another for Sony to hide it from you and then make it darned-near impossible to get it off. That makes Sony no better than any other malware writer out there.

They're worried about piracy?!? They'd better be worried about all of us who acquire our music LEGALLY, who right now are considering NEVER purchasing from them again.

[Kagemusha]

3. I am told Sony copped up to it and released a removal program.

And apparently, as they should have, because this was a most reckless act.

[Sgent]

4. nope

at least not according to slashdot (which is on top of this type of thing).

They announced a detection program, and if you write customer service they will tell you how to remove it.

You can't remove it without a separate bootdisk and some jiggering with their filesystem.

I'm guessing sony is backtracking now becuase one of their IT guys (not informed of this before hand) let them know that they face enormous liability if some script kiddie release a trojan targeted to take advantage of their rootkit.

[Kagemusha]

9. They most certainly would face liability.

I mean, unauthorized use of someone else's property? Why that's... it sounds like... piracy.

Heh. Heh.

[FreedomAngel82]

6. So what if you have a cd from Sony

and you're going to put it onto your Ipod??? I have an Ipod that I put all my music on now. :\ Will this mess up my computer?

[Sgent]

7. Possibly

nothing is certain, but if you have windows, it will install the rootkit. That rootkit makes you potentially vulnerable (note nothing has been released yet) to being hacked in a way that's undetectible via normal means.

[FreedomAngel82]

8. Ugh!

I don't have a cd player anymore since my other one got stolen and I prefer my IPod anyways. *sigh* :mad:

[baron j]

10. First, I have to say I absolutely agree that this is an invasion of

privacy.

That being said, always follow the oft repeated advice I learned from my 8th grade computer teacher Mr. Bevin back in 1985 "Save your files!". Make sure you get a DVD burner that burns dual-layer discs, or a back-up drive, and save a copy of your drive(s). If you do this, you can format your drive and start from scratch again. Also, please turn off cd or dvd auto-run! If you do turn it off, foreign discs can't install anything against your will; you are then free to browse and strip music or whatever data from the disc.

[NuttyFluffers]

11. ... and it's still useless against serious pirates

people who bootleg a lot of stuff have extra machines and hardware. just never connect it to the internet, do all your copying from that spare machine, wipe it regularly (like every other month), done. wholly useless program against real piracy -- but a wonderful opportunity for Sony to be raped from lawsuits.

how profoundly stupid of them to open this pandora's box.

[NuttyFluffers]

12. ***dupe***

if the mods could delete...?