Sony DRM uninstaller 'worse than rootkit'
Print storyDouble jeopardy
Posted in Software & Security, 17th November 2005 16:38 GMT
Free whitepaper – Essential archive requirements for eDiscovery
Hacker websites are using Sony's DRM uninstaller in an attempt to take over Windows PCs. Under pressure, Sony recently released a tool to remove the rootkit technology installed when users play Sony BMG CDs on Windows PCs. This happened after it was shown Sony's DRM code (First4Internet XCP program) created a handy means for hackers to hide malware from anti-virus scanning programs.
Several malware variants have been created that try to hide with the help of the Sony DRM cloaking technology. Coding errors in the malware mean none have been particularly successful. In fact, work by security researchers suggest that a vulnerable ActiveX control in Sony's DRM uninstaller is a greater security risk than the original Sony rootkit.
The warning, by Ed Felten of Freedom to Tinker, is borne out by the discovery by Websense of exploit websites that attempts to use the trick. Sony has stopped distributing its flawed DRM uninstaller. But that still leaves any user who has downloaded and run the Sony uninstaller program susceptible to attack, providing they can be tricked into visiting hacker sites. So users need to remove the vulnerable ActiveX component as explained here.
To remove the DRM software entirely is a far trickier proposition that security researchers have only partially answered. An expert might (with effort) be able to remove the software but for an average user the situation is quite hopeless, and getting more complicated by the day. ®
Free whitepaper – Five essential considerations for Exchange 2007 implementations
The future of SaaS and IT infrastructure management
The mandate for application security
Extended Validation SSL Certificates
Avoiding 7 common mistakes of IT security compliance
Sign up, sign up for The Register IT security newsletter
Former top Sun exec mourns end of a franchise
Win an HTC Touch Diamond2!
Disties braced for autumn reseller collapses