Korean Job Discussion Forums

[SHANE02]

Hackers use Sony anti-copy software to hide in PCs

11.11.05 1.00pm


A computer security firm said today it had discovered the first virus that uses music publisher Sony BMG's controversial CD copy-protection software to hide on PCs and wreak havoc.

Under a subject line containing the words "Photo approval", a hacker has mass-mailed the so-called Stinx-E trojan virus to British email addresses, said British anti-virus firm Sophos.

When recipients click on an attachment, they install malware, which may tear down the firewall and gives hackers access to a PC. The malware hides by using Sony software that is also hidden -- the software would have been installed on a computer when consumers played Sony's copy-protected music CDs.

"This leaves Sony in a real tangle. It was already getting bad press about its copy-protection software, and this new hack exploit will make it even worse," said Sophos' Graham Cluley.

Sony BMG's spokesman John McKay in New York was not immediately available to comment.

The music publishing unit of the Japanese electronics conglomerate is distributing the copy-protection software on a range of recent music compact disks (CDs) from artists such as Celine Dion and Sarah McLachlan.

When the CD is played on a Windows personal computer, the software first installs itself and then limits the usage rights of a consumer. It only allows playback with Sony software.

The software sparked a class action lawsuit against Sony in California last week, claiming that Sony has not informed consumers that it installs software directly into the "root" of their computer systems with rootkit software, which cloaks all associated files and is dangerous to remove.

Sophos said it would have a tool to disable the software later on Thursday.

The Sony copy-protection software does not install itself on Macintosh computers or ordinary CD and DVD players.

- REUTERS

http://www.nzherald.co.nz/section/story.cfm?c_id=5&ObjectID=10354703

[hack]

Look at this thread about Santana's new album. It uses the Sony copy protect software and this review is typical of many reviews of the album. Sony has opened a whole new can of worms.

"Thanks for the Trojan Horse Santana !!!, November 7, 2005

Reviewer: ea-pty (MA, US) - See all my reviews
This CD installs w/o your permission a ROOTKIT. For those who don't know what the term means, a rootkit is a type of Trojan that keeps itself, other files, registry keys and network connections hidden from detection. It runs at the lowest level of the machine and typically intercepts common API calls. For example, it can intercept requests to a file manager such as Explorer and cause it to keep certain files hidden from display, even reporting false file counts and sizes to the user. A root kit is also defined as a set of tools used by an intruder after cracking a computer system (your PC is cracked by the trojan included on the CD w/o you even knowing about it once you play it). These tools can help the attacker maintain his or her access to the system and use it for malicious purposes. A rootkit may also include utilities, known as backdoors to help the attacker subsequently access the system more easily. For example, the rootkit may include an application that spawns a shell when the attacker connects to a particular network port on the system. Kernel root kits may provide functionality that allows processes started by a non-privileged user to execute functions normally reserved for the superuser. The only way to remove the trojan is to reinstall windows from scratch. That is really what I was looking for. Thanks Santana !!

http://www.amazon.com/exec/obidos/tg/detail/-/B00097DXZS/qid=1131690079/sr=2-1/ref=pd_bbs_b_2_1/103-2422388-0647821?v=glance&s=music

[BigBlackEquus]

http://www.msnbc.msn.com/id/9911371/

[BigBlackEquus]

Sony issues fix

http://www.msnbc.msn.com/id/9911371/

[BigBlackEquus]

Microsoft rootkit cleaning tool:

http://www.microsoft.com/security/malwareremove/default.mspx

[dbee]

The only effective rootkit cleaning tool is called a 'reinstall'

[Bulsajo]

I posted an easy and free workaround that I discovered for CDs with this sort of protection in the "Sony's Trojans" thread.

It won't help you if you already accepted Sony's EULA, but then you've got BBE's links if you went that far.

[BigBlackEquus]

It is said that running AnyDVD will also block it from happening on your machine.

[Gord]