2005 Sony CD copy protection controversy

[p2p-sharing-rules]

The 2005 Sony CD copy protection controversy was a public controversy relating to copy protection software known as Extended Copy Protection (XCP), created by First 4 Internet and used by the media company Sony BMG Music Entertainment on audio CDs. The software monitored the computer's activity to ensure that only a maximum number of copies of the CD can be made. The controversy ensued because the software installed without the user's consent, hid from the operating system via a rootkit, and did not offer a means for removal. The XCP copy protection software was on about 50 CDs distributed by Sony-BMG.

Timeline
On October 31, 2005, Mark Russinovich posted to his blog an extremely detailed and technical analysis of the behaviour of the software contained on Sony music CDs. The article asserts vocally that the software is illegitimate and that digital rights management had "gone too far". He further sheds light on shortcomings in the software design that manifest themselves as security holes and could be exploited by malicious software such as worms or viruses. Several comments to the entry recommended a lawsuit against Sony.

In a November 7, 2005 article, vnunet.com summarised Mark's finding in a less technically detailed way, and urged consumers to avoid buying Sony music CDs for the time being. The following day, boston.com classified the software as spyware and alleged that it communicates personal information from consumers' computers to Sony. The methods used by the software to avoid detection were likened to those used by data thieves.

After the first virus which made use of Sony's stealth technology to make their malicious files invisible to both the user and anti-virus programs surfaced on November 10, 2005, Yahoo! News announced on November 11, 2005 that Sony has suspended further distribution of the controversial technology.

According to BBC News on November 14, 2005, Microsoft has decided to label Sony's software as "spyware" and provide tools for its removal. In both this and the previous Yahoo! News announcement, Mark Russinovich is quoted as saying, "This is a step they should have taken immediately."

On November 15, 2005, vnunet.com finally announced that Sony is backing out its copy-protection software, recalling unsold CDs from all stores, and offering consumers to exchange their CDs with versions lacking the software. Sony is quoted as maintaining that "there were no security risks associated with the anti-piracy technology", despite the earlier virus and malware reports.

The US states California and New York are now pursuing legal action against Sony and a larger class action lawsuit over this matter is being developed.

Sony released a software utility to remove Extended Copy Protection from affected Microsoft Windows computers, but this removal utility was soon attacked as only exacerbating the privacy and security concerns. In addition to removing the rootkit, this program was reported to install additional software that cannot be uninstalled. In order to download the uninstaller, it is neccessary to provide an e-mail address, and to install an ActiveX control containing backdoor methods (marked as "safe for scripting", and thus prone to exploits). Opponents of Sony's actions, especially Slashdot.org, later accused Sony of violating the privacy of its customers to create a backdoor onto their machine using code that violates an Open Source license. They claimed that this DRM program, designed to give Sony control over the customer's machine in the name of copyright protection, is itself infringing copyright by including code from the LAME MP3 library. It appears that, since LAME is under the lGPL, this situation could be rectified by SONY offering a copy of the LAME source code; additionally it appears that the LAME code was added only to permit detection of attempts to rip the CD using LAME (not to actually implement LAME or call functions from it). On November 16, 2005 Sony-BMG bowed to pressure from consumers and recalled all CDs with XCP. Sony said customers will be able to exchange any discs with XCP. They also said they had instructed retailers to remove any unsold music discs containing the software from their shelves.
source wikipedia
More info on Extended Copy Protection (ECP) software from wikipedia.
Also check out Marks Sysinternals Blog exposing Sony's DRM RootKit.

I also found this online too.

World of Warcraft hackers using Sony BMG rootkit

Want to cheat in your online game and not get caught? Just buy a Sony BMG copy protected CD.

World of Warcraft hackers have confirmed that the hiding capabilities of Sony BMG's content protection software can make tools made for cheating in the online world impossible to detect. The software--deemed a "rootkit" by many security experts--is shipped with tens of thousands of the record company's music titles.

Blizzard Entertainment, the maker of World of Warcraft, has created a controversial program that detects cheaters by scanning the processes that are running at the time the game is played. Called the Warden, the anti-cheating program cannot detect any files that are hidden with Sony BMG's content protection, which only requires that the hacker add the prefix "$sys$" to file names.
Source online.securityfocus

[p2p-sharing-rules]

Here's some good news.I hope other countries start sueing Sony BMG asses.

Texas sues Sony BMG for 'spyware' on CDs
Nov 21 2:32 PM US/Eastern

The state of Texas sued Sony BMG, alleging that the company
"surreptitiously" installed spyware on personal computers through music
CDs with a copy protection program.

"Sony has engaged in a technological version of cloak and dagger deceit
against consumers by hiding secret files on their computers," said Texas
Attorney General Greg Abbott in a statement after suing under the
state's anti-spyware law.

"Consumers who purchased a Sony CD thought they were buying music.
Instead, they received spyware that can damage a computer, subject it to
viruses and expose the consumer to possible identity crime."

Sony BMG, one of the world's biggest music companies, said last week it
was ending the use of the software provided by a third-party vendor and
allowing consumers who purchased CDs to exchange them for similar items
without the software.

The joint venture of Japan's Sony and German-based BMG recalled the CDs
after a firestorm of protests and the threat of legal action over its
use of the so-called XCP copy protection software.

Experts say that when one of the CDs is inserted into a PC, the
copy-protection software can modify computer settings and expose
computers to a variety of malicious software programs.
Source: breitbart.com

[battye]

I've been following this recently, it's disgusting that Sony puts that crap on their CD's.