New Sony CD's install rootkit Options

[*mipadi*]

Well, this isn't kosher:

Mark Russinovich, of SysInternals.com, has discovered a so-called "rootkit" which is installed by Sony's new digital rights management-protected music compact disks (CDs). A rootkit is a common name for malicious software that is used by hackers or criminals to gain access to a computer system and be able to clandestinely run other malicious code. Rootkits frequently contain hidden and hard to remove files and are designed to be difficult for the user to remove.

Russinovich classifies Son'y malware as a rootkit because it introduce several serious security holes, one of which is intended to be exploited to hide files and prevent the user from removing them. In particular, all executable files which begin with '$sys$' are hidden when the software is installed. He points out that these security holes could be exploited by hackers, or other malware producers besides Sony.

Russinovich explains that naively removing the files will result in a crippling of the operating system on the user's computer. He provides an explination of the difficult step required to remove Sony's malware.

Playing the same CDs under Linux or on a non-computer based CD player remains safe. As removing Sony's malware may violate the DMCA, ripping the CDs under Linux may be the best legal option for those who wish to listen to them under Windows.

The software is automatically installed when a Sony CD is played on a computer, and is not mentioned in their EULA. The rootkit appears to have been commercially developed by First 4 Internet and lisenced to Sony.

Read

[*mipadi*]

I guess a lawsuit has encouraged Sony to stop producing such CD's, but Sony still argues it has a right to protect its music. There are several quotes from these articles that bother me a bit:

"Sony said it had a right to stop people illegally copying music, but added that the halt was precautionary." [1]

I think Sony has some right to protect their music, but their rights end where mine begin; not only do I have certain fair use rights (which I won't even get into at this point, since those have all but disappeared a long time ago), but Sony doesn't have the right to break my machine in order to have their music protected. (I mention this only theoretically, of course; since I don't run Windows on my laptop or various desktops, Sony's CD's don't technically do anything to my computers--even play.)

"Mathew Gilliat-Smith, the CEO of First 4 Internet, the company that created the software, claims it is 'benign content.' Meanwhile, in an NPR interview, a spokesman for Sony said, 'users don't know what a rootkit is, and therefore, don't care.'"[2]

Firstly, the software clearly isn't "benign," as it can allow other viruses to piggy back on top of it; secondly, I find it arrogant and ignorant that Sony says it doesn't matter because people don't know what a rootkit is. Whether they know what it is or not is trivial--it can still do damage. (In fact, not knowing what it is probably leaves one open for more damage.) Most people also don't know what ebola is, but it will kill them just the same.

Actions like this make me think it's about time we, as consumers, stop purchasing DRM-protected music. If someone like Sony is going to trample on consumers' rights, I see nothing wrong with hitting back by pirating their music.