Sony to let antivirus companies in on DRM code

Facing flak from the media and consumers over allegations that the copy-protection software on some new CDs is installing hidden, nearly unremovable files on PCs, Sony BMG is providing information to vendors of antivirus software allowing them access to the data. First4Internet, which developed the software, said that, by releasing the patch, the company hopes to "allay any unnecessary concerns." The patch doesn't delete the software; rather, it reveals the hidden files, making them less likely to be exploited by virus writers looking to piggyback on them. Sony said that consumers who want to delete the files should contact customer support for assistance — which is basically what they said back in June when the whole copy-protection issue first started rearing its ugly head.

Update: Sony has released the patch for everyone.

[Thanks to everyone who sent this in]

[Ben @ Dec 19th 2005 1:37AM]

BTW, a customer support call typically costs $10 or so to field. If everyone does that then those CD's are not going to be worth selling.

[kyle @ Dec 19th 2005 1:37AM]

i thought the point of drm was to reduce piracy, not encourage it. All sony is doing here is ensurning that i never buy another one of their CDs.

i really feel sorry for the artists that are affected by this. i sent an email to The Trews, a good canadian band signed to sony/BMG, complaining about the DRM on their new CD. i got a nice email back the other week apologizing, and explaining that sony had put the DRM on their cd at the last minute without telling them, and that they didn't want it on their cds. they even linked me to a page explaining how to bypass the drm

[Carlos @ Dec 19th 2005 1:37AM]

Hell yes! I've been following this all week. I'm so glad those greedy bastards know that a few dedicated citizens can change the world!

I mean seriously...who do think they are?

[Rick @ Dec 19th 2005 1:37AM]

#2 What's the link?

[yoda @ Dec 19th 2005 1:37AM]

and this still makes what they are doing right? Besides, when is the entertainment industry going to learn that no matter what "protection" scheme they come up with, it will be broken in a short amount of time.

[Seth @ Dec 19th 2005 1:37AM]

Rick: To "bypass" the drm, you install their software, then use Windows Media to burn an audio CD using their pre-made WMA files, then you can do whatever you want with that audio CD (ie get it into iTunes). However, the quality is reduced and you STILL have to install the software to access their special WMA files.

[AFD @ Dec 19th 2005 1:37AM]

Not a satisfactory solution for consumers, and just more DRM'd media that I will not be purchasing.

[Dolomite @ Dec 19th 2005 1:37AM]

hey #2, still got a copy of that email?

[Myron @ Dec 19th 2005 1:37AM]

"unnecessary concerns"? Screw them and screw Sony. (can we use the f bomb here?)

[cecil @ Dec 19th 2005 1:37AM]

You sure as fuck can drop the motherfucking f-bomb when talking about these cocksuckers.

Buy a CD? What is this the 90's? My last two computers haven't even seen an actual non-writable off-the-shelf Audio CD ever.

[Russ @ Dec 19th 2005 1:37AM]

allowing an app to 'hide' files is a feature of Windows - that should be reserved only for the 'system'. i wouldn't be surprised if an upcoming windows update patch suddenly 'reveals all'!

and hopefully puts 'First4Internet' out of business!

[wilber gates @ Dec 19th 2005 1:37AM]

i had sent emails to the van zant management only to get a reply for the first one saying they are working on it and things dont get resolved over night. the next one which is pretty much what this story is saying . now lets see if sony will charge for this service call or if its an automated email thing. and i dont think i can EVER trust sony again which is why the stock got sold this morn. i cant support a corporation that is this shitty no matter what the value the stock was at or is at in 2 years. some things are far more important than money.


h

[Waltz @ Dec 19th 2005 1:37AM]

Sony, Sony, Sony, when are they gonna learn? Kyle is right Sony is insuring that I never buy another CD. Though if they still haven't learned since BETA, Memory Stick, MiniDisc and upcoming Blu-Ray then why stop now? They're constant "trying to get u to only buy Sony" bullshit does nothing but piss people off. But we still buy it, EH?

[Dan @ Dec 19th 2005 1:37AM]

#11 if you've read the article by Mark Russinovich (http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html) you'll see that the way it 'hides' the files is not a feature of windows. They don't just flag it as a windows hidden file (all that does is keep the files from showing up in windows explorer for users that have the 'hide system files' option enabled). What this software does is embed intself into to operating system and keeps any app, or any user no matter what their security settings are, from seeing the files. And it goes further to place a hook into your cd rom drives to disable the cd-audio data from being read from any other application.

And it does all this without your knowing, and without an uninstall option.

[alex @ Dec 19th 2005 1:37AM]

Not only Sony but Universal too (via Techdirt).


http://www.xcp-aurora.com/press_article.aspx?art=aug_05_art3

[epp_b @ Dec 19th 2005 1:37AM]

["Sony BMG is providing information to vendors of antivirus software allowing them access to the data."]
Oh yeah, letting in the AV companies so that they can "access the data"...that's a lie, and pretty transparent one, too.

They're doing it so that AV programs will not detect this Sony/F4I garbage as a trojan (which, really, it is).

[Ken's Last Ever Radio Extravaganza @ Dec 19th 2005 1:37AM]

Note that this removes but one of the many problems with the Sony/First4Internet scheme.

Here another article discussing Russinovich's findings:
http://blog.wfmu.org/freeform/2005/11/sony_cds_caught.html

[andrew @ Dec 19th 2005 1:37AM]

ok heres the story...theres no copyright protection ever put on a cd that cannot be bypassed by holding down the shift key while inserting the cd until your program recognizes the cd. this disables autoplay (temporarily) and doesnt allow the file to install itself. now if you let the file install, then you will have a heck of a time getting this crapware off of your computer, you can be sure of that.

[Jeff @ Dec 19th 2005 1:37AM]

I really don't see that what these guys have done is any different than what any other random trojan/virus writer does. What they did was purposely create a security exploit on your PC, which would allow them or anyone else to install other software without your knowledge (by simply naming the files in a certain way that hides them). And of course, they never told you they were doing such a thing (the EULA says they're "installing software", not opening up our PC to anyone else who would like to do so), and their own EULA says the software is user-uninstallable, which is at best disingenuous, and at worst a bald-faced lie.

Why are these guys not under arrest for knowingly creating and distributing a trojan horse?

[chris joseph @ Dec 19th 2005 1:37AM]

Sony needs to be pressured into not only revealing the CD titles which carry this "malware" payload, but into labellling these and all future releases with warning stickers.

[Levi @ Dec 19th 2005 1:37AM]

I hate DRM in any form, but at this point if I was looking to legally acquire music, I'd never go buy a CD. Even if all the major online music download services use some kind of DRM for their wares, they at least are relatively up-front about it. Any artist that signs with a major label known to use DRM on CD's will never see another penny from me. Period.

It's like retail DVD's and PUO's (prohibited user operations). I bought the damn thing, so I don't expect to be forced to watch previews and commericals before the movie starts. Just play the damn movie.

If you go out and BUY a DVD or CD, you should be able to do with it what you want so long as you aren't using it to make a profit. If you want to make copies of your DVD's to keep the kids from screwing them up, you should be able to, legally. You want a copy of a CD for your CD changer in your car and home entertainment system? You should be able to make them.

What's next? DRM on vinyl?

[dave @ Dec 19th 2005 1:37AM]

Wait a second...i've heard this before. Let's see...software secretly installed on a user's computer without knowledge and consent....software performs functions undesirable to the user....software is nearly impossible to get rid of....where was that? Something about the legal ramifications of Spyware?

In fact, I don�t think this will last once the word gets out�numerous pieces of legislation, including the SPY act, and the Securely Protect Yourself Against Cyber Trespass Act (H.R. 29) explicitly outlaw these practices. While I know HR 29 passed in the house, I�m not sure what the status of any of these laws are, so I�m betting their not on the books�..yet.

Besides, look what wonders these old subversive spyware programs did for the major end-apps (say Limewire, for example) they were bundled with...I'm sure this will do wonders for Sony CDs too once the word gets out that their CDs contain software that behaves similarly. Seriously, I agree with kyle, all this will do is result in lower Sony CD sales, and consequently, more piracy to get music. When will they learn�..

[David @ Dec 19th 2005 1:37AM]

So now I'm supposed to buy anti-virus software to combat my legal CD purchase? Uh, where do I sign up for the class-action?

[Tim @ Dec 19th 2005 1:37AM]

im not gonna buy another sony product ever again. along with there selfish tactics of making there own memory formats and there own music formats this takes it too far.

[Kevin Baxtin @ Dec 19th 2005 1:37AM]

Another reason not to buy music and just download it. Perhaps Sony should look at Divinity Assets (http://www.divinityassets.com) for DCP (Digital Content Protection) and go after the real pirates on the top instead of using loser companies that go after paying consumers.

[Russ @ Dec 19th 2005 1:37AM]

Dan #14, yep read the article. Not talking about 'hidden files' as in system attributes. Just talking about allowing applications developers to write an app which can "embed intself into to operating system".

[TIMMAH! @ Dec 19th 2005 1:37AM]

What's install is called a 'rootkit'. It's basically altering the OS so that the evidence that it's install is totally hidden. You won't see the files in the file system, you won't see running processes in the task manager. It's totally insidious and opens the door to virus and trojan writers for exploiting your system (they use the existing mechanisms installed by Sony to hide their files and the execution of their software.)

[R @ Dec 19th 2005 1:37AM]

I emailed Sony on this yesterdayTo tell them they've lost a customer. I'm sure many others did the same. I believe I will only buy music online, where the DRM implications are clearly defined from now on. What a bunch of corporate idiots.

[Seth A @ Dec 19th 2005 1:37AM]

#18 I wonder why nobody else knows this? I've been telling my friends who want to import their DRM protected CDs into iTunes forever. Some bands even spread this knowledge on their forums and such because they are against the DRM but can't really stop the label from putting it on their albums.

[Seth A @ Dec 19th 2005 1:37AM]

TIMMAH! well I guess we need to find some trojan or virus writer to exploit it. If that happened Sony would be exposed as well as what DRM really is doing to the end-user's computer.

[Kroc Camen @ Dec 19th 2005 1:37AM]

Doesn't work on Mac.

*dodges rotten fruit*

[shmoe @ Dec 19th 2005 1:37AM]

And people want Sony's Bluray siht to beat HD-DVD. This, along with their crackdown on PSP hacks is the biggest reason to support HD-DVD.

[Gman @ Dec 19th 2005 1:37AM]

boys...do not just go mad and blaming sony for every single reason u can think of.
We do need potection on DVDs and CDs.
otherwise no one gonna buy any dvd and cds.
we need protections. i hate the way sony did it, but we cannot deny that we need them.
and all this rookit is doing is preventing u from copying cds to protect their rights.

[GinAtlanta @ Dec 19th 2005 1:37AM]

Sony has done me a favor!
Hats Off to those who discovered this secret malware Sony is using. Fortunately I rely on good brand names to make decisons on buying products. Unfortunately I have spent thousands in the past on Sony products, but they will get ZERO DOLLARS NEXT YEAR!

[kiki @ Dec 19th 2005 1:37AM]

A quick solution: don't purchase music from any of the Sony BMG music labels.

Arista Records
BMG Classics
BMG Heritage
BMG International Companies
Columbia Records
Epic Records
J Records
Jive Records
LaFace Records
Legacy Recordings
Provident Music Group
RCA Records
RCA Victor Group
RLG - Nashville
Sony Classical
Sony Music International
Sony Music Nashville
Sony Wonder
Sony Urban Music
So So Def Records
Verity Records

[XenoCorpse @ Dec 19th 2005 1:37AM]

Huh? What? I'm sorry, I missed the part where this affects me. You see, as a happy Mac user I enjoy having airtight UNIX security features which make it impossible for anything like this to work. They'd have to get me to enter my admin password to install their trojan DRM, and I'm not stupid enough to do that- Of course, since the autoexec is a PC-only program, it doesn't matter anyway.

Complain all you want, but as long as Windows has such gaping security holes, you'll have to deal with this sort of exploitation. You can laugh at us Mac users for paying a little more and not having as many games, but when it comes to things like this you have to admit that Apple really has their shit together.

Of course, as I haven't purchased a CD in many years, and prefer to do all my music business in digital purchases, I'm not affected by DRM anyway. iTunes DRM can be stripped, and other legal sources for music that I enjoy from other countries don't use DRM at all.

I can always burn a CD from my digital files, and as I'm not such a nitpicky audiophile, I don't mind that they're 128kbps MP4 files. They sound great to me. . . I lived through cassette tapes, so digital files sound a lot better than what I used to deal with!

Either way, what they're doing is pretty rotten- The last thing Windows users needed was another piece of software sitting on their hard drive causing "Windows rot" to their system without their knowledge.

I'm telling you, guys... The Mac is worth using when shit like this is ut there. Consider switching. It's better to be immune than to get medicine AFTER you've gotten sick.

[Jeff Lewis @ Dec 19th 2005 1:37AM]

XenoCorpse - no disrespect, but you're clueless. Rootkits STARTED on Unix (Windows doesn't have a 'root' account - that's a Unix term).

The reason this particular kit doesn't work on Macs is simple: Sony is 'protecting' itself from the majority of its customers - who just happen to own the operating system used by 95% of the computers on the planet. The 4% or so who used Macs and the 1% or so who use Linux or Unix aren't really worth the effort.

For the record - MacOS actually started the practice of patch tables - it was a way for Apple to patch the ROM after shipping. It became a way to extend the OS with after-market products and a lot of very useful addons were written to use it.

Windows followed the same concept. However, in Vista (and currently with 64 bit Windows, which also is immune to this DRM patch hack) the patch table trick will no longer work.

I wish Mac people would take a few minutes to actually learn and think rather than just spouting the usual 'my system is good; your system is bad' crap.

[Jackson @ Dec 19th 2005 1:37AM]

Jeff - you are right, but xenocorpse has a point. This software installs even in safe mode. If a bug in the code prevented you booting you would have to completely reinstall Windows. If a virus writer adopts the same naming convention (�sys�) then any anti virus software will not be able to see the file. Rootkits may have started on unix, but this piece of software has the same effect, is windows only, is not uninstallable, requires no password or agreement to install, and if you delete the files concerned the computer will not work. It alters the registry as well. This is horrible and part of the blame should be laid at Windows' door. You are comparing years ago macs with current windows - current macs ship without root enabled. Xenocorpse went over the top with his mac love, you went a bit far the other way.

[Mantis @ Dec 19th 2005 1:37AM]

"Sony DRM is worse than you might think"

This is a really good article from the Inquirer. Please take a moment to read about Sony's response to the DRM issue.

http://www.theinquirer.net/?article=27426

[Russbag @ Dec 19th 2005 1:37AM]

So I just ratted around the internet on this and I can't find answers to three things:
1) Where is the class action lawsuit?
2) Can you prevent this from being installed on a windows system?
3) Where are the removal instructions (aside from those developed by Russinovich)?