UPDATE BEWARE!!! Trojans on some Sony BMG music CDs

In this forum you can discuss anything from sports, news, or what ever is on your mind.

Moderator: SMLCHNG

Sam
Inactive User
Posts: 3993
Joined: February 5, 2002 7:00 pm
Number of Concerts: 0
Location: Somewhere between a Rock and a Hard Place

Post by Sam »

ragtopW wrote:I thought I saw a news blurb on the Plane from ATL that Sony
has stopped this.
Sony did agree to stop FOR NOW/ TEMPORARILY after two Class Action suits were filed, 1 in California and 1 in Italy.

Do as you choose, for now I am choosing to boycott Sony BMG. What they did was crimminal and they Know/knew it. They deserve to be punished. If anyone has any of their affected products and played them on their computer. Beware:
There is at least one Trojan out there exploiting the Sony BMG malware.


Note the patch/fix Sony BMG, originally released DOES NOT fix anything. It merely tells you how to find the rootkit/malware/spyware.
I have not heard if they changed that as of yet.

The following is from Kim Komando's newsletter. Note the problems people have had with SOny BMG's hidden surprise. Also take note of what Thomas Hesse President of Sony BMG digital division saying that people should not care about rootkits being installed on their computers because they do not understand them.
*************************************************************
Q. I read the story in your News of the Day newsletter about the Sony
copy-protection software. I own several Sony CDs and listen to them on
my computer. I'm not sure I understand what a rootkit is, but it sounds
bad. How worried should I be about this? - George in Pittsburgh,
listening on WPGB 104.7

A. This is big, big news. I will be discussing it on my weekly radio
show the weekend.

A lot has happened in the past week, so let me start by bringing
everyone up to speed. Last week, a security expert discovered that
copy-protection software on some Sony CDs installed a rootkit on
Windows computers. A rootkit is a particularly pernicious form of
malware capable of cloaking itself and its actions.

Rootkits burrow deep into Windows. They hide by intercepting calls
between the operating system and programs. They remove their file names
from the calls. Rootkits can also tell Windows to hide files and
programs. So they're difficult to detect.

Users who tried to remove the rootkit manually encountered a nasty
surprise. It rendered their CD drives inoperable. Users had to reformat
and reinstall Windows to fix the problem.

To add insult to injury, Thomas Hesse, president of Sony BMG's global
digital business division, was quoted on National Public Radio as
saying that people shouldn't care because they don't understand
rootkits.


Sony subsequently issued a patch it claims will uninstall the rootkit.
Unfortunately, many people have encountered problems with the patch. It
has caused lost data and computers to crash. Further, others have
complained that it is difficult to get the patch. The company also said
it would temporarily stop making disks with the rootkit.


Consumers in California have filed a lawsuit against Sony Music. They
are seeking to stop Sony from selling CDs that include the software.
They're also seeking compensation for damage caused to their computers
by the software.

On Thursday, a Trojan that takes advantage of the Sony rootkit started
appearing. A variation of the Breplibot Trojan installs the file
$sys$drv.exe. The Sony rootkit hides files whose system filename begins
with $sys$. Sony says it has distributed information to ant-virus
companies that will allow their products to attack malicious programs
using Sony's cloaking technology.

Nonetheless, I remain worried. If the rootkit is installed on a
computer, hackers may be able to use it to do anything. They know how
to exploit it.

Sony uses two different copy-protection programs on its CDs. Only one
installs the rootkit, and it is included on about 20 titles. The
Electronic Frontier Foundation has a list of the CDs on its site:
http://www.eff.org/deeplinks/archives/004144.php

But I wouldn't take chances. Until we know more, I wouldn't play
Sony-produced CDs on my computer. The risk is just too great.

If your computer is infected, you can download a tool to disable the
rootkit. It is available from Sony and from First 4 Internet, the
company that developed the software. Their sites are, respectively:
http://cp.sonybmg.com/xcp/
http://updates.xcp-aurora.com/

Don't forget to listen to the show for updates of this story! And
please tell some of your friends and family members about our
newsletters and show. We've got a handy form on the Web site set up
just for that.
http://www.komando.com/newsletter.asp#friends
Roll with the punches, play all of your hunches...come what may...
Image POW-MIA, YOU ARE NOT FORGOTTEN!!!
SUPPORT OPERATION JUST CAUSE!!!
http://www.ojc.org/
Sam
Inactive User
Posts: 3993
Joined: February 5, 2002 7:00 pm
Number of Concerts: 0
Location: Somewhere between a Rock and a Hard Place

Post by Sam »

>>>>>>>>>>>>>>>>MORE GOOD NEWS<<<<<<<<<<<<<<<<<<<
I hope Microsoft patch is bug free the first time out, and doesn't make a bad problem worse.
There are links embedded in the article and also related links and comments on the site.
*************************************************************
http://news.com.com/2100-1002_3-5949041 ... g=r2jmusic

Microsoft will wipe Sony's 'rootkit'

By Joris Evers
Staff Writer, CNET News.com

Published: November 13, 2005, 12:15 AM PST

Microsoft will update its security tools to detect and remove part of the copy protection tools installed on PCs when some music CDs are played.

The Redmond, Wash., software maker has determined that the "rootkit" piece of the XCP software on some Sony BMG Music Entertainment CDs can pose a security risk to Windows PCs, according to a posting Saturday to a Microsoft corporate Web log.

The Sony BMG software installs itself deeply inside a hard drive when a CD is played on a PC. The technology uses rootkit techniques to hide itself. Experts blasted the cloaking mechanism, saying it could be abused by virus writers. The first remote-control Trojan horses that take advantage of the veil provided by Sony BMG have surfaced.

To protect Windows users, Microsoft plans to update Windows AntiSpyware and the Malicious Software Removal Tool as well as the online scanner on Windows Live Safety Center to detect and remove the Sony BMG software, the software maker said in its blog.

Windows AntiSpyware is Microsoft's spyware-fighting software that is currently available as a test version and used by millions of people worldwide. Microsoft provides weekly updates for Windows AntiSpyware. The Windows Malicious Software Removal Tool is updated monthly and is part of Microsoft's monthly patch releases.

Previous Next Detection and removal of the rootkit component will also be in Windows Defender, the forthcoming update to Windows AntiSpyware that will also be part of Windows XP successor Windows Vista, Microsoft said.

In its move to detect and remove the Sony BMG rootkit, Microsoft follows other makers of security software. Symantec and Computer Associates are among those that offer at minimum detection capabilities in their products. Sony BMG itself has also provided a patch to fix the security problem and still allow CDs to be played on PCs.

On Friday, Sony said it had halted production of CDs with the controversial technology, which is designed to limit the number of copies that can be made of the CD and to prevent a computer user from making unprotected MP3s of the music. Sony does still produce CDs that use a different copy protection scheme.
Roll with the punches, play all of your hunches...come what may...
Image POW-MIA, YOU ARE NOT FORGOTTEN!!!
SUPPORT OPERATION JUST CAUSE!!!
http://www.ojc.org/
ragtopW
Last Man Standing
Posts: 39130
Joined: December 18, 2001 7:00 pm
Number of Concerts: 0

Post by ragtopW »

:oops: I wonder if that was the Update E-Machines just had me do???
Sam
Inactive User
Posts: 3993
Joined: February 5, 2002 7:00 pm
Number of Concerts: 0
Location: Somewhere between a Rock and a Hard Place

Post by Sam »

I dunno I got an update last week from MS but I don't think it had anything to do with this....
I got a rootkit detector in Beta from F-Secure called Black Light The only FREE one I had found last time I looked for them. If you want the link for it you can google it or I can get it for you. Remember it is in Beta ....

I have not purchased any Sony BMG cds so I am safe from their evilness and corruption.
Roll with the punches, play all of your hunches...come what may...
Image POW-MIA, YOU ARE NOT FORGOTTEN!!!
SUPPORT OPERATION JUST CAUSE!!!
http://www.ojc.org/
ragtopW
Last Man Standing
Posts: 39130
Joined: December 18, 2001 7:00 pm
Number of Concerts: 0

Post by ragtopW »

Sam wrote:I dunno I got an update last week from MS but I don't think it had anything to do with this....
I got a rootkit detector in Beta from F-Secure called Black Light The only FREE one I had found last time I looked for them. If you want the link for it you can google it or I can get it for you. Remember it is in Beta ....

I have not purchased any Sony BMG cds so I am safe from their evilness and corruption.
I am thinking Sony does not have Eric Stone,Stars on the water,Brent Burns or Sunny Jim on its list... :D
as those are my last purchases :D
Sam
Inactive User
Posts: 3993
Joined: February 5, 2002 7:00 pm
Number of Concerts: 0
Location: Somewhere between a Rock and a Hard Place

Post by Sam »

GOOD CALLS!!!!
Trouble is you can rootkit malware from anywhere and not know it.
Going outside for a bit.... bbl
Roll with the punches, play all of your hunches...come what may...
Image POW-MIA, YOU ARE NOT FORGOTTEN!!!
SUPPORT OPERATION JUST CAUSE!!!
http://www.ojc.org/
Post Reply