Threat of the month: DRM Rootkits

By on

What is it? DRM stands for Digital Rights Management, describing any number of methods that content providers enlist to try to exercise control over what you can do with a digital document. Recently Sony BMG released a CD protected by a “rootkit,” a tool often used by hackers/malware authors to hide their tracks on a system.

How does it work?

When the user loads the audio CD into a computer and agrees to the software license, the rootkit installs itself deeply into the operating system, intercepting low-level system calls in order to block certain applications from running, as well as to hide the DRM software's processes from the end-user.

Should I be worried?

Other viruses/trojans can take advantage of the way the rootkit works in order to hide their own processes. The uninstall program provided by Sony is an ActiveX control which leaves a hole in the system that can be exploited by malicious websites through Internet Explorer.

How can I prevent it?

Many rootkit detection packages, such as F-Secure's Blacklight, have been updated to detect the presence of the DRM rootkit. Microsoft's malware removal tool has been updated to be able to remove the rootkit without the need for the vulnerable ActiveX control provided by Sony.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition

Most Read Articles

Log In

  |  Forgot your password?