According to the Washington Post hackers are now targeting Sony over the Companies anti piracy software which is destroying PC’s.
The Washington Post is reporting that hackers are now attempting to access the Sony rookit technology found on BMG Sony CD’s. The software is suppose to eliminate piracy instead it is corrupting PC’s. The Washington Post claim that a hacker contacted them to advice that his current project revolves around Sony BMG’s anti-piracy program, which uses rootkit technology to hide its components from users and to defy removal from their PCs.
The Washington Post has refused to name this individual because technically his activities could be construed to run afoul of the anti-circumvention statutes included in the Digital Millennium Copyright Act in the USA which violations of which have led to some pretty bizarre legal battles around the world.
The Post claims that they doubt Sony would be bold enough to invoke that law — which makes it a crime to circumvent technological measures used to protect copyright works — in this instance, but this situation illustrates how it can have a chilling effect on security research.
Anyway, this kid was so ticked off over Sony’s tactics that he and a friend spent the better part of the last few days deconstructing the program and trying to find remotely exploitable security flaws in it. The guy said he hadn’t yet found any, but judging from some of the other news coming out today, it sure looks like he’s not the only one taking a closer look at the Sony software.
As I reported last week, Sony issued a “patch” to unhide the files cloaked by its anti-piracy program (and to exert some damage control on a public-relations nightmare). But according to new research by the guy who discovered what the Sony program was up to — Sysinternals’ Mark Russinovich — Sony’s patch can lead to a crashed system and data loss.
The folks at Computer Associates also looked into the patch, and found that “it has a broken uninstall that removes the rootkit in a way that can cause Windows to crash.” CA also confirmed Russinovich’s latest research, which found that the music player software that ships with the protected CDs “sends the names of the CDs a user is listened to, along with the user’s IP address and listening habits back to Sony without permission from the user.”
At any rate, this type of swift reaction to corporate malfeasance (perceived or actual) is common in the security research community, and we saw it in action earlier this year when Internet Security Systems and Internet router maker Cisco Systems sued former ISS researcher Mike Lynn to prevent him from disclosing the details of a serious security hole in Cisco’s products, which are responsible for routing a large portion of the world’s Internet traffic.
To see the story go to http://blogs.washingtonpost.com/securityfix/2005/11/hackers_raid_so_1.html
