[ISN] 'Bots' for Sony CD software spotted online

[InfoSec News]

http://news.com.com/Bots+for+Sony+CD+software+spotted+online/2100-1029_3-5944643.html

By John Borland 
Staff Writer, CNET News.com
November 10, 2005

A first wave of malicious software written to piggyback on Sony BMG
Music Entertainment CD copy protection tools has been spotted online,
computer security companies said Thursday.

Sony's software, installed when playing one of the record label's
recent copy-protected CDs in a computer, hides itself on hard drives
using a powerful programming tool called a "rootkit." But the tool
leaves the door open behind it, allowing other software--including
viruses--to be deeply hidden behind the rootkit cloak [1].

The first version of a Trojan horse spotted early Thursday, which aims
to give an attacker complete remote control over an infected computer,
didn't work well. But over the course of the day, several others
emerged that apparently fixed early flaws.

"This is no longer a theoretical vulnerability; it is a real
vulnerability," said Sam Curry, vice president of Computer Associates'
eTrust Security Management division. "This is no longer about digital
rights management or content protection, this is about people having
their PCs taken over."

Sony's use of the rootkit software has sparked a firestorm of
criticism online and off over the company's techniques, highlighting
concerns that remain over record labels' increasingly ambitious
attempts to control the ways consumers can use purchased music.

Last week, plaintiffs' attorney Alan Himmelfarb filed a class action
suit against Sony BMG in Los Angeles federal court, asserting that the
company had violated state and federal statues on unauthorized
computer tampering. The company's actions also constituted fraud,
trespass and false advertising, the suit contends.

Other attorneys say they are considering other suits. Several Italian
consumer groups also have said they are looking into the prospect of
taking legal action against Sony, although the relevant discs were
distributed by the record label's U.S. division and not intended for
overseas sale.

Sony's use of the rootkit stems from record companies' growing
concerns that unrestricted music copying is undermining their sales,
and they have been looking for a technological way to limit the number
of copies that people can make of each CD they buy.

Sony BMG has experimented with several different ways to do this. The
current controversy focuses on just one of those tools, created by a
British company called First 4 Internet.

The First 4 Internet software is included on a handful of CDs [2],
including recent releases from My Morning Jacket and Southern rockers
Van Zant. When the albums are put in a computer's CD drive, they ask a
listener to click through a consent form, and then install the rootkit
copy-protection software on the hard drive.

A rootkit is a tool that takes a high level of control over a
computer, potentially even preventing the original computer user from
performing certain tasks. In this case, the First 4 Internet hides
itself from view in the computer's guts.

One Trojan horse discovered by security companies Thursday is a
variant of a pre-existing software distributed by spam e-mail, among
other techniques.

One version of the e-mail claims to be from a business publication and
says it is using a photograph of the recipient for a soon-to-be
published article, according to security company BitDefender. Clicking
on the alleged photograph installs the malicious software, which then
connects automatically to the Internet Relay Chat chat network,
opening up a channel to control the infected computer.
 
In a new version of the program, the software hides itself using
Sony's rootkit tool and then tries to connect to a server on the chat
network. The first version of the Trojan was unable to function after
hiding itself, security company F-Secure said. However, several other
variants have been found that are able to successfully take over
control of a computer after hiding under the Sony software.

All virus companies are rating the danger as fairly low so far, since
the Trojans seem to be spreading slowly.

Most antivirus companies are releasing versions of their software that
identify or remove the Sony software. A patch on the Sony Web site [3]
will uncloak the copy protection tools, but computer users must
contact Sony's customer service for instructions [4] on removing it
altogether.

Neither Himmelfarb nor a Sony BMG spokesman could immediately be
reached for comment. A Sony BMG representative contacted last week
noted that the software could be easily uninstalled by contacting the
company's customer support service for instructions.

[1] http://news.com.com/Sony+CD+protection+sparks+security+concerns/2100-7355_3-5926657.html
[2] http://news.com.com/Are+these+the+Sony+rootkit+CDs/2100-1029_3-5944549.html
[3] http://cp.sonybmg.com/xcp/
[4] http://cp.sonybmg.com/xcp/english/uninstall.html