Sony warned early of rootkit dangers

Powered by SC Magazine

Bloggers’ latest question for the brass at Sony-BMG Entertainment has become, “Why didn’t the music giant act sooner?”

After Business Week magazine revealed that F-Secure had alerted Sony to the problem on Oct. 4 – weeks before the spyware-like device became a full-fledged media circus – Sony took no action on the application installed on its CD-Roms until mid-November when it pulled discs containing the program from stores.

F-Secure told the magazine that it had learned of the rootkit from John Guarino, a Manhattan computer technician.

Mark Russinovich, the Windows system expert who revealed the existence of the Sony rootkit in late October, said he still felt the company wasn't ating in the best interests of its customers in a recent posting.

"Two weeks ago, I declared victory in what the media is now referring to as the 'Sony rootkit debacle,' but I'm now wondering if I jumped the gun," he said on his blog. "It turns out that the CDs containing the XCP rootkit technology are still widely available, there's still no sign of an uninstaller and comments made recently by the president of the Recording Industry Association of America make it clear that the music industry is still missing the point."

Russinovich's disclosure preceded the appearance of trojans that took advantage of the First4Internet cloaking technology on Sony CDs. Bloggers also revealed that the uninstaller Sony had offered opened up other vulnerabilities on a PC.

An investigation by New York State Attorney General and Democratic gubernatorial candidate Elliot Spitzer revealed last week that CDs containing the spyware-like technology were still widely available in stores.

The state of Texas and the Electronic Frontier Foundation also filed suits against Sony on behalf of consumers, < href=''>as did the firm Finkelstein, Thompson & Loughran on behalf of District of Columbia residents.

Ed Felten, a Princeton University computer science professor, asked on his "Freedom to Tinker" blog on Wednesday, "What did Sony-BMG know and when did it know it?"

"We have to consider the possibility that Sony and First4Internet understood the significance of the rootkit, but simply felt that copy protection trumped users' security," he said. "First4Internet held that view – otherwise it's hard to explain their design decision to deploy rootkit functionality – and Sony may well have held it too."

Copyright © SC Magazine, US edition

Top Stories
Content, cost & constant innovation: How Foxtel plans to take on Netflix
Nell Payne inhabits the “brave new world of blue strings and networking”. Just don't ask her to put a TV screen on your microwave.
Sending in the drones
Margins are getting tighter in the industrial services industry, so Transfield Services' Stephen Phillips looks offshore - and to the skies - for the solutions he needs to keep pace.
Westpac fires starting pistol on core banking upgrade
St George readies itself for move to Celeriti.
Sign up to receive iTnews email bulletins
Latest Comments
Should Optus make a bid for iiNet?

   |   View results