Working around the Sony rootkit

Ed Felten has put together a SonyBMG DRM Customer Survival Kit. It includes command-line instructions to determine if you have the Aries.sys driver installed on your computer, along with instructions on how to disable the service.

Professor Felten also notes that Sony will actually tell you how to work around its copy protection if you ask:

How to get songs from these discs into iTunes, an iPod, or anywhere else you can legally put them: SonyBMG will send instructions on how to do this to anyone who asks. Note that their instructions direct you to agree to their End User License Agreement; be sure to read the agreement and think about whether you want to accept it.

Or you could just read the instructions at his site.

Unfortunately, the workaround involves making inferior (128K) WMA copies of the tracks, burning them to a CD, then reripping them in any format you like. There’s no way to get a decent copy, much less a perfect digital copy.

Removing the Sony rootkit

Sophos is the first security software vendor to make available a removal tool for the Sony rootkit. Get it here:

Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms. They terminate any virus processes and reset any registry keys that the virus changed. Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.

This version of the tool detects and disables the Sony DRM cloaking copy protection technology (which Sophos refers to as Troj/RKProc-Fam). It also detects and disables other Trojans, including Troj/Stinx variants, which are stealthed by Troj/RKProc-Fam.

I just ran it. Pretty much painless (and as expected I didn’t find a trace of it here).

Sony versus the world

F-Secure says “I told you so”:

We have just analyzed the first malware (Breplibot.b) that is trying to hide on machines that have Sony DRM software installed.

I’ve seen reports that Pest Patrol and some Norton products are now detecting the Sony rootkit.

And in the comments to a previous post in which I asked for Microsoft’s help (Dear Microsoft: Please clean up the Sony mess), my old friend Giesbert Damaschke points out an encouraging new article:

Microsoft ‘Concerned’ by Sony DRM

The Redmond, Wash., software maker said that the security of its customers’ information is a “top priority” and that the company is concerned by software like that deployed by Sony to block illegal CD copying.

However, unlike other security software vendors, Microsoft hasn’t decided whether to take more aggressive action against the product, such as detecting and removing it from systems, the spokesperson said.

Hmmm. Maybe someone could write a little tweak that causes your computer to make a loud retching sound whenever a rootkit-infected CD is inserted?

Update: Brian Krebs of the Washington Post passes along this five-year-old quote from Sony’s CEO, which discloses how the company really feels about its customers:

Sony CEO Howard Stringer, who kept the audience laughing throughout the night with a battery of quips, said, “Right now it would be possible for us, and I’ve often thought it would cheer me up to do it, you could dispatch a virus to anybody whose files contain us or Columbia records, and make them listen to four hours of Yanni … but in the end we’re going to have to get serious about encryption and digital-rights management and watermarking.”

Something tells me the tape of that conference will be played at a future trial.

And somewhere in Sony HQ, a PR person is banging her head against a desk realizing that the spin is just not working.

List of Sony/BMG titles with rootkits

Dwight Silverman shrugs off the plague and publishes a list of Sony/BMG titles with rootkits.

I only recognize two of them. And I don’t think the list is complete. Unless I’m mistaken, the latest CD from Leo Kottke and Mike Gordon installs this crap.

The irony to me is that Trey Anastasio and Mike Gordon are both on this short list. Ironic, because these two are members of the disbanded Phish, which built up a community of tapers who traded noncommercial copies of concerts with the band’s imprimatur.

So far, no really big artists on this list. No Dylan, no Springsteen…

(PS: Go back to bed, Dwight!)

Boycott Sony

Tim Jarrett says: “We are at war, and Sony fired first. Boycott Sony.”

To that end, he’s set up The Sony Boycott Blog. Tim picks up on my four (now five) things Sony should do right away and adds this perceptive observation:

I think that’s a start. But to do that, Sony has to understand why what it did was wrong. And to do that, it has to stop the spin and the press releases and start talking—and listening—to customers, and understand why they want to put music that they purchased on their iPods, and why Sony shouldn’t view that as a threat but instead as an opportunity.

Both of us are too optimistic, I fear.

My hope is that this is the act of overreaching that will finally push the public and lawmakers to rein in the out-of-control media industry. Suing 14-year-olds is bad, but in those cases an observer could say, “Well, the kids were illegally downloading music files…” Here, the people who are actually buying the product and following the rules that the music industry insists on are the ones being punished. That’s insane.

Sony’s hired guns: incompetent, dishonest, or both?

This morning, Mark Russinovich offers the latest installment in the Sony “rootkit” saga. I’ll cut straight to the bottom line:

Instead of admitting fault for installing a rootkit and installing it without proper disclosure, both Sony and First 4 Internet claim innocence. By not coming clean they are making clear to any potential customers that they are a not only technically incompetent, but also dishonest.

First 4 Internet is the company that actually wrote the code that gets installed on your computer unwittingly if you play a “protected” Sony CD and click OK on the innocuous-sounding license box. A First 4 Internet spokesperson responded to Mark’s last post with comments that betray how dangerously clueless the company is.

In this post, Mark rips F4I’s self-serving responses to shreds. Mark proves, conclusively, that the Sony software can cause a Blue Screen of Death crash. (Check out the screen shot for yourself.) He also establishes that the company is either deliberately lying or technically incompetent. (Maybe both.) Do you want a clueless, dishonest programmer writing secret code that hooks directly into your computer’s kernel-level functions?

It’s almost time for Congressional hearings.

Background:

Sony wants to hijack your PC

Sony’s even sleazier than I thought

Sony tries to stop the bleeding

Sony’s phony patch

Is Sony violating the law?

Sony: screwing up Windows PCs since 2002

Dear Microsoft: Please clean up the Sony mess

Windows Defender and a dissertation on search algorithms

Dwight Silverman has a pair of interesting observations on the news that Microsoft Antispyware is about to become Windows Defender:

I mentioned above that there’s already an application dubbed Windows Defender. I found that by doing a Google search, which turned up many links to the existing package as the top results.

But if you do the same search at MSN Search, the top results are front-loaded with references to the Windows Defender renaming announcement by Jason Garms. In fact, the first reference to the existing Windows Defender product doesn’t show up until the seventh page of results at MSN.

Maybe Microsoft forced the results for its own entry higher on its search engine. Or maybe Google’s just slow to index blog postings. Or a little bit of both . . .

That first observation is interesting, indeed. Microsoft has an army of lawyers, and one would have to assume that no product naming decision gets publicly announced until there’s been a thorough trademark search. (At least the windowsdefender.com domain is owned by a guy in Seattle who is a contractor for Microsoft.) If someone made a public announcement like this without acquiring the trademark rights from the existing product, they were incredibly sloppy.

What about the search results? Is Microsoft really favoring itself?

When I looked at the MSN Search results, I found that a download link for the existing Windows Defender product was fourth on the list. (Hey, I’m even on that first page!) So it’s not like every reference to the existing product has been scrubbed.

I think there’s a (somewhat) more innocent explanation for the different search results for MSN Search versus Google. In my admittedly limited testing, I’ve seen clear evidence that the MSN algorithm emphasizes freshness much more than Google does. By contrast, Google’s algorithm emphasizes the number and quality of links to a given page (PageRank) and thus is inherently biased toward pages that are older and have had more time to acquire lots of links from high-traffic sites. So at least in this case it stands to reason that pages talking about the latest news on this phrase would rank higher at MSN Search than at Google.

For an example that isn’t Microsoft-related (and thus doesn’t have the possibility that Microsoft is unfairly favoring its own sites), try searching for Sony copy protection, a topic that has been much in the news lately.

Here’s the MSN Search results. Note that everything on the first page is about the current rootkit controversy.

Now try Googling the same words. Although there are lots of results about rootkits, I noted that the third item on the first page was a USA Today article from 2002. The sixth item is an undated article from KAOS2000 Magazine that talks about using marker pens to defeat Sony copy protection schemes used on a “new Celine Dion album” released in 2002. And the ninth link on the page is to a discussion at cdfreaks.com, also from 2002.

Those are interesting approaches. Knowing how those two search engines work can help me decide which one to use, but I don’t think either one is biased.

Scoble wrote a flurry of interesting posts on this some time ago. In this post, which I chose more or less at random, he says something I can wholeheartedly agree with: “Anyway, my point wasn’t to get into a rathole discussion on any one search term. It was to point out that at almost ANY search term you can find ways to improve the engine. But, I’ll keep hammering this one in until people get it and see that search is FAR from being done.”

Sony: screwing up Windows PCs since 2002

Most of the coverage I’ve seen so far of the Sony rootkit disaster mentions that this software has been used for about six months. That must refer to the latest batch of copy-protected CDs, which use the First 4 Internet XPC code. But Sony’s been wreaking havoc with Windows for much longer than that. In fact, I’ve found evidence of problems dating back at least three years.

I started with this Google search, which turned up 29,000 links at Amazon.com that contained the words content AND enhanced AND protected. That doesn’t translate to 29,000 CDs, because the search results turns up multiple links to each CD. But it’s a starting point.

And then I started clicking and reading reviews. Early on, I found a comment from an Amazon customer who bought the soundtrack to Brown Sugar. The CD was released in September 2002, and this comment was posted in May 2003:

I knew I wouldn’t be able to copy selected songs to my PDA for my own private use when I purchased this CD so I have no complaints about that aspect of the copy-protection. I didn’t expect to have a hard time playing it on a computer, however. The ‘player’ that’s supposed to launch when you insert the CD into your drive is adequate *when* it plays. It took awhile to get the player and CD to do their thing the first time but it did eventually play. I had to restart my computer in order to use my standard player for other CDs and no CD is worth that much trouble. When I tried a second time the CD just plain wasn’t recognized so I tried it on another computer and that CD drive completely disappeared from ‘My Computer’, the CD never loaded and now I’m wondering what kind of re-configuring I have to do there. And, guess what – it also proves occasionally problematic on my new CD player which supports mp3s. I’m not a computer newbie and it’s not a matter of my not understanding. This is way beyond a minor inconvenience.

Sound familiar?

A comment attached to Healthy In Paranoid Times (Sony, August 2005) described similar problems and pointed me back to this dire warning at Sony’s Web site:

Sony Global – Urgent Message Regarding Problems Caused by Microsoft Windows Security Update Program MS04-032 (KB840987):

It has been confirmed that some of Sony’s application software(*) for managing music files on the PC may not work as originally intended, if a user installs Microsoft Windows Security Update Program MS04-032 (KB840987) on his/her PC. Sony has been investigating the cause of this problem as well as working on countermeasures in collaboration with Microsoft Corporation. A countermeasure program (KB887811) to remedy this situation is now available at Microsoft’s website as shown below.

Sure enough, Microsoft issued Critical Update for Windows XP (KB887811) in October 2004, more than one year ago, to fix the problem identified here.

After you install the MS04-032 (KB840987) Security Update for Windows on a computer running either Windows XP or Windows XP with Service Pack 1 and then try to run an OpenMG compliant music software, the OpenMG compliant music software may not run as expected or respond. Install this update to help resolve this issue. After you install this item, you may have to restart your computer.

OpenMG? What the hell is that? The KB article for that Critical Update has a long list of “OpenMG-compliant music software that includes the OpenMG Secure Module.” And not surprisingly, almost all of it is from Sony.

In response to an earlier post of mine, a commenter wrote:

Ed, Sony’s response is ignorant –but that’s because they don’t understand what a rootkit is and how damaging they can be. In fact, when NPR introduced the concept on the radio this morning, I was hardly surpised to hear a very garbled and oversimplified description of rootkit technology.

If Sony’s to blame, it’s because they tried to play with the computer equivilant of a sharp stick and accidentally hurt themselves. Now they’re bleeding and they don’t know what to do.

They’ll learn. Most of us are still learning about this. Only people like Russinovich really have a handle on this situation. I’m not trying to whitewash what Sony BMG is doing, but you have to allow time for the managers in suits to wrap their minds around this topic.

I place the blame squarely on First4Internet. These idiots should have known better. Their programming effort can only be described as a hack of the first order. It was sloppy to the point of carelessness.

The bottom line is that if DRM technology is going to include rootkits, then we need reasonable assurances that such rootkits are narrowly targeted, stable, and well written.

Sorry, no. Sony’s DRM has been causing major consumer headaches for years, and they don’t seem to care. In fact, they have graduated from sharp sticks to Ginsu knives to chainsaws.

And the notion that any software developer should be allowed to cloak its technology using rootkits is wrong, wrong, wrong.

I have a feeling that Windows Vista will block this sort of crude hack. Has anyone tried using one of these Sony CDs on a current beta of Windows Vista yet?

Dear Microsoft: Please clean up the Sony mess

Update: Microsoft will indeed add the Sony rootkit software to the list of software detected by its Malicious Software Removal Tool. This capability will appear in the December 2005 update to the utility. Signatures for the XCP component will also be added to Windows AntiSpyware, Windows Defender, and the Windows Live Safety Center. Details here.

Mark Russinovich has analyzed Sony’s “patch” for its rootkit-based software and discovers that the patch is crap and Sony is still lying.

Microsoft’s John Howard just found out about the Sony rootkit debacle and says, “Be worried – very worried”:

Normally, I wouldn’t comment on news like this except on anything except my personal blog, but I’m am so outraged and stunned by what I’ve discovered having spent the past hour or so researching and reading about the techniques and implications of the “RootKit” approach and the legalities, the fact that a half-baked patch has been issued, and the follow up entry from yesterday on Marks blog about the way that the software “calls” home.

Yes, there is a huge amount of publicity out there about this, but what worries me most now is that even with that publicity, how many home users are really going to take action on it? There is a probable chain reaction:

Home users generally won’t read or hear about this, are highly unlikely to run a root kit revealer to discover the “rootkit”, blame XP for potentially crashing or certainly being slower due to the “rootkit” performance overhead.

By not knowing about it means the majority of infected users will not visit the appropriate site to patch/remove the DRM software (which it appears is not flawless either).

Many people will purchased CDs with this DRM “rootkit” software.

Given a significant percentage of purchasers will play those CDs on home machines, there will be many home machines installed with an unpatched rootkit

Joe Hacker now has it on a plate with an easy way to cloak their worms/viruses on “infected” machines through the sys$ file prefix.

My proposed solution?

Each month, Microsoft updates its Malicious Software Removal Tool and pushes it down to all Windows XP clients via Automatic Updates. The next release of this software should target the First 4 Internet software and automatically remove it. It should also inoculate the system so that the software cannot be reinstalled.

Yes, I know this is unlikely to happen because the software doesn’t technically qualify as “malicious.” But it could happen if Sony gave its permission to Microsoft.

So, add one more item to my list of things Sony should do immediately:

Fire First 4 Internet immediately and publicly.
Remaster the CDs with DRM-free versions.
Offer free replacement CDs to anyone who purchased one of the rootkit-infected CDs.
Provide toll-free tech support for anyone who experiences a problem with their Windows computer that they think is related to this software.
Assist Microsoft in updating the Malicious Software Removal Tool to remove the rootkit-based software from any infected systems and prevent it from being reinstalled.

Background:

Sony wants to hijack your PC

Sony’s even sleazier than I thought

Sony tries to stop the bleeding

Sony’s phony patch

Is Sony violating the law?

Sony’s phony patch

At Freedom to Tinker, Edward Felten says Sony is trying to weasel out of its obligations to come clean with customers:

Yesterday, [Sony and First 4 Internet] released a software update that they say “removes the cloaking technology component that has been recently discussed in a number of articles”. Reading that statement, and the press statements by company representitives, you might think that that’s all the update does. It’s not.

The update is more than 3.5 megabytes in size, and it appears to contain new versions of almost all the files included in the initial installation of the entire DRM system, as well as creating some new files. In short, they’re not just taking away the rootkit-like function — they’re almost certainly adding things to the system as well. And once again, they’re not disclosing what they’re doing.

No doubt they’ll ask us to just trust them. I wouldn’t. The companies still assert — falsely — that the original rootkit-like software “does not compromise security” and “[t]here should be no concern” about it. So I wouldn’t put much faith in any claim that the new update is harmless. And the companies claim to have developed “new ways of cloaking files on a hard drive”. So I wouldn’t derive much comfort from carefully worded assertions that they have removed “the … component .. that has been discussed”.

Whoever is making these decisions at Sony has no idea how badly they are damaging the company’s reputation.