Sony fesses up to another rootkit snafu

While everybody was busy with that BioShock "rootkit" false alarm -- and subsequently busy playing BioShock -- the folks at F-Secure were uncovering a new, legitimate rootkit problem in the software packaged with Sony's MicroVault USM-F fingerprint reader drives. It took Sony a little while to respond, but now the company says it has launched an investigation into the software, which was developed by a third-party, and will offer a fix by mid-September. The drives models had already been discontinued, though you can still pick them up at a few stores, and the rootkit is not as serious as the Sony BMX XCP DRM, but the software is still dangerous enough to allow malware authors to hide folders, so we're glad Sony's going to run clean up here.

Read - Sony confirms security problem
Read - Sony's USB Rootkit vs Sony's Music Rootkit

[bl0nde @ Sep 3rd 2007 9:41AM]

Aiaiaiai, here we go again...

[scott @ Sep 3rd 2007 10:37AM]

at least sony knows how to fix their problems. *cough*microsoft*cough*RROD*cough*

[aj @ Sep 3rd 2007 3:55PM]

@scott

Yes, Microsoft does know how to fix their problems by giving a free 3 year warranty... unlike some companies cough**sony** and their cough**ps2**.

[Charlie Calhoun @ Sep 3rd 2007 6:36PM]

@aj

agreed.

[Nick @ Sep 4th 2007 9:56AM]

@ scott

best way for SONY to fix their problem? stoppin pullin this BS.

[Dirty Sloth @ Sep 3rd 2007 9:46AM]

OH LOOK! another article about sony! lets see if we can throw "root kit" in there!
"well...its actually not a rootki"...Who cares throw it anyway! worked a treat in misleading people with Bioshock!

Cmon Engadget, stop dancing around the point... if you wanna say something, say it with HEART!... "Oh look, SONY Fucked up again!"

;)

[Paul @ Sep 3rd 2007 9:56AM]

Cock

[John @ Sep 3rd 2007 12:25PM]

This is the 3rd time rootkits were brought up with Sony - and only once was the article wrong, and that was because some little prick lied about it. And in that case, I think you, also being a little prick, can relate.

[Temple @ Sep 3rd 2007 9:57AM]

These F-Secure microdrives hides your finger-print password away from your operating system; hence is a rootkit (unlike the fake Bioshock rootkit). These drives were designed for people that want their thumbdrives protected by biometric security. However, it was designed as an extra layer of security, not DRM like those old rootkit.

Intentions were good, application was bad.

[Tired_ @ Sep 3rd 2007 10:30AM]

F-Secure makes security software. Sony makes infested flash drives.

Intentions were good....

[Church @ Sep 3rd 2007 10:22AM]

"F-Secure" is the security outfit that found the rootkit.
"Sony" is the maker and "microvault" is the product.

----------------------------------------------------------
Dirty Sloth:

Sony admitted that this is a rootkit, and you are still painting a rosy picture? I didn't know fundamentalism also happens in commercial companies, i.e. blindly acceptance against all contrary evidence.
----------------------------------------------------------

"so we're glad Sony's going to run clean up here."

Now, why is it that big companies like Sony can get away with this by saying "Sorry gov', didn't meant to put it there, won't happen again.", and even people like Engadget writers will applaud them for doing the "right" thing.

And yet at the same time, Sony is also part of the RIAA and MPAA which are waging wars against copyright violators, and asking for "compensation" which are totally disproportional to the misdeed? not to mention knowingly accusing and extorting innocent people along the way?

How many times can they keep on doing things like releasing rootkit before people are finally fed up? if companies like Sony understood what was the "right" thing to do, they should not be putting rootkits in any of their products, no matter whether it was written by a third party. Ultimately the responsibility is theirs, they can't get away with it easily by just blaming it on some unknown rogue company.

They cry about "pirates" and "hackers", and seeking heavy penalty for these crimes and yet they are given free passes to install rootkits on people's computers?

Engadget, please wise up. If confession alone is sufficient remedy for illegal acts, we wouldn't need the police or the court.

[Temple @ Sep 3rd 2007 10:34AM]

holy hell, people need to calm the f*** down. You have two different people in a 5 post comment(so far) that tell Engadget they wrote their story the wrong way (both coming from opposite sides).

[mosque @ Sep 3rd 2007 10:37AM]

OMG! People have different opinions! That's so MEAN!

Let's all be nice to each other!

Hi, my name is dorkus, what's your name? can we be friends?

[Tavis Veighey @ Sep 3rd 2007 11:53AM]

A difference of opionion? How could that happen!!!! I thought that EVERYTHING was like in Barney!!! Where you had a pediphile watching over us as we play, and we always agree on everything!!!!

If you have a problem with people having a difference of opionion, then it is time for you to move into the woods and become a hermit. That way you will always agree with the only person you have to talk to.... Yourself!

[miglo @ Sep 3rd 2007 2:44PM]

Sony news with "rootkit" and "invasive"....gee what a f*cking big surprise.

Sony, the company that wants to pwned yer ass.

[Dirty Sloth @ Sep 3rd 2007 10:41AM]

sorry if my last comment was a bit hard lined... just tired of people getting mislead via incorrect info / words getting thrown around on media sites.
(bioshock DRM perfect example)

and Church pls show me where you have sony confirming this being a rootkit? I believe "Sony confirms security problem" is what they are saying...

"The Microvault software does not hide processes or registry keys."
It appears to install hidden files / directories -
"The cloaking is most likely used to protect fingerprint authentication from tampering. Sony is attempting to protect the user's own data."
"rootkit-like cloaking techniques"
"Sony's software installs a driver that creates a hidden folder using rootkit techniques."

^ All taken from F secure's site, the ones who picked it up in the first place...

I mean fair enough sony screwed up a bit and should be going around things in a different matter, but assuming any problem with sony + software = rootkit... is a bit reckless IMO..

anyways, just wanted to vent..!

[synagogue @ Sep 3rd 2007 10:53AM]

somewhat glad you are willing to treat this a bit civilly.

F-Secure: "Sony software hides folders from system." This is classic behaviour of a rootkit, no if and buts about it. Sure, the software makers probably "forgot" Sony was in some troubles in the past with other rootkits, but you'd think Sony is more careful about this kind of stuff?

Then, MacAfee: "Yep, it's pretty dodgy software, even though it's probably not nefariously intended. You'd think they learnt their lesson."

Finally, after some silence, Sony: "Oops, yes, there is some 'security problem' as reported. We are working on it."

-----------------

Do you think Sony would actually come out and say: "Hi everybody, sorry we've put another rootkit in your computers. It's actually for your own good, trust us!"

[MARSHAK @ Sep 3rd 2007 1:31PM]

I'm actually quite impressed that you responded like that. I'm kinda getting sick of kids flaming all over the place. Intelligent argument ftw.

[Magallanes @ Sep 3rd 2007 1:47PM]

I just want to add to :hiding some registry keys and/or services = ROOTKIT.

So, indeed Bioshock and this gadget came with rootkit.

Stop the euphemism.

[mfed3 @ Sep 3rd 2007 2:49PM]

Seriously, F*** SONY! Why the hell would you ever support a company like this. Who are these people DEFENDING them as if they had stock in the company. They are the same people that bash Microsoft for no reason and love every ridiculously overpriced and under performing sony product that exists.

I used to like Sony. I owned an expensive receiver / dvd player, and some headphones. They ALL broke on me and stopped working after a few years. Every article I hear about them is completely negative, and they come out with the most obsurd statements to try to make them seem like they aren't bad people. Rootkits are so illegal, I cant believe they are doing this again to people. Believe me when I tell you, I am never buying another sony product in my life.

[pigfister @ Sep 3rd 2007 4:01PM]

another drm FIASCO from sony and then they lay the blame on others for not properly testing the code that they are selling with THEIR products.

if the rootkits and SecuROM Sony DADC arn't bad enough they give you BD+ on all blu-ray discs that report usage data back to the studios, including your serial number and ip location and films watched.

funny how sony have so much drm on the go seems they are the company that created the copying generation with the legal battles concerning vcr's! now sony have more pro drm lobbyists that there are actual congress members

BODIES PUSHING DRM:

MPAA:

Sony Pictures, Buena Vista (The Walt Disney Company), Paramount Pictures (Viacom -- which bought DreamWorks in February 2006), 20th Century Fox , Universal Studios , and Warner Bros. (Time Warner)

AACS LA:

Sony, Disney, Intel, Microsoft, Matsushita (Panasonic), Warner Brothers, IBM and Toshiba.

RIAA:

Sony BMG Music Entertainment, EMI, Universal Music Group, Warner Music Group.

Blu-ray Disc Association:

Sony, Matsushita, Pioneer, Philips, Thomson, LG Electronics, Hitachi, Sharp and Samsung.

[Lazyman0 @ Sep 3rd 2007 4:11PM]

sweet ill give it a shot

[David Spark @ Sep 11th 2007 8:47PM]

Sony has no choice to fess up with these blunders.

If you want a USB fingerprint solution, try the n-Tegrity Pro secure USB thumb drive appliance. Steve Hunt, security analyst and author of Security Dreamer has a great review of the device.
http://www.securitydreamer.com/2007/09/first-look-n-te.html

I'm a friend of Steve's plus I'm working with him on the development of SecurityDreamer as a leading source for all physical and electronic security issues.
HREF="http://www.securitydreamer.com/

[DangerWillR @ Sep 26th 2007 6:50PM]

I don't believe this. We're not talking about a DVD or a videogame here.

This is a peripheral that:

A: Records fingerprint data, potentially from a number of users (along with other authentication information)

B: Controls access to systems, that presumably are important enough to protect with a fingerprint ID

C: Contains undisclosed (even to date) code that
hides itself in order to perform some secret function.

D: Being dependent on the specific hardware, has no legitimate DRM issue. If you have the USB Thumb-reader in your posession, you presumably have paid for it.

Duh, gee! What information is this "hook" disclosing, and to whom? Someone compiling a fingerprint database? Someone compiling a set of authentications to break-in to sensitive systems?
How does the fingerprint data collected by this system compare to other fingerprint ID's? Can military installations protected by other vendor's systems be compromised using the fingerprint signatures from this peripheral?

This has nothing to do with DRM. And if SONY doesn't disclose EXACTLY what code was present and what it was doing and what it could allow others to do, then every SONY product should be embargoed from import to this country, since it represents a severe terrorism risk.

(Not that anybody's still reading at this late date...)