[ISN] Sony settles 'rootkit' class action lawsuit

[InfoSec News]

http://news.com.com/Sony+settles+rootkit+class+action+lawsuit/2100-1002_3-6012173.html

By Ingrid Marson 
Special to CNET News.com
December 29, 2005

Sony BMG has struck a deal with the plaintiffs in a class action
lawsuit over copy-restriction software it used in music CDs, according
to a settlement document filed at a New York court Wednesday.

The record label has agreed to compensate buyers of CDs that contained
the XCP and MediaMax DRM programs and to provide software utilities to
allow consumers to uninstall both types of software from their
computer.

The furor over Sony's DRM software began at the end of October when a
U.S. programmer discovered that XCP software on a Sony music CD had
installed copy-restriction software on his computer that was hidden
using a rootkit. Antivirus companies later discovered Trojan horses
that exploited this software to avoid detection and found that another
type of Sony DRM, MediaMax, also posed a security risk.

During November a number of individuals filed cases against Sony at
courts across America. These cases were granted class action status
Dec. 1.

Sony BMG met lawyers from the firm handling the class action suit in
early December and engaged in "virtual round-the-clock settlement
negotiations", according to the settlement filing, which has been
posted on the Sunbelt Software Web site.

In the settlement filing, Sony states that it will immediately recall
all XCP CDs and replace them with non-content-protected CDs. It has
also agreed to offer incentives to U.S. customers to "ensure that XCP
CDs are promptly removed from the market." Sony first released details
about its CD recall scheme in late November.

Customers who exchange their XCP CD can either download three albums
from a list of over 200 titles, or claim a cash payment of $7.50 and a
free download of one album. To claim this compensation, customers must
return their XCP CDs to Sony or provide the company with a receipt
showing they returned or exchanged the CD at a retailer after Nov. 14.

Sony is not recalling MediaMax CDs, but has agreed to compensate
buyers of these albums by allowing them to download one free album, as
well as offering them MP3 versions of the music on the MediaMax album.

The settlement filing is awaiting approval by the U.S. District Court
for the Southern District of New York.

Ingrid Marson of ZDNet UK reported from London.