OT: The rootkit fiasco just got more bizarre

riredale wrote on 11/16/2005, 10:42 AM

I was laughing so hard when I read this I had tears in my eyes.

You remember way back to last week, when it was discovered that SonyBMG had placed on many of its CDs a software program that installed a rootkit in a users PC? After a couple of days of yelling and screaming, Sony grudgingly announced that , okay, they would provide a method of "fixing" the rootkit--not by removing it, mind you, but just that they would remove the "cloaking" feature so that third-party viruses couldn't hide there.

Now it turns out that the method they chose to fix the rootkit opens a hole a mile wide on the user's PC. Someone wishing to remove the cloaking feature first fills out a form on the SonyBMG website, then Sony downloads an ActiveX control that they install on their computer. The ActiveX control then talks to Sony and together they remove the cloaking attribute.

The problem just discovered is that the ActiveX code ITSELF IS A HUGE LIABILITY! It seems that whoever wrote the ActiveX control forgot to limit its use to just SonyBMG. In other words, a hacker can write a web page that automatically calls that ActiveX control, which then automatically authorizes the web page to download ANY software it wants! The person behind the web page can completely take over your PC!!!

Unbelievable. The people behind this fiasco at SonyBMG really need an award or something--it just doesn't get any better than this.

More info here.

Comments

baysidebas wrote on 11/16/2005, 11:00 AM

Did you perhaps miss this post?

http://www.sonymediasoftware.com/forums/ShowMessage.asp?MessageID=422275&Replies=4

But news like this bear repeating.

riredale wrote on 11/16/2005, 2:04 PM

Yup. Missed that one. Sorry..

baysidebas wrote on 11/17/2005, 7:05 AM

Interesting post on Chaos Manor:

Subject: SONY Rootkit and unintended consequences

I work for a state government agency, and just received word from our IT dept that some our servers and workstations have been infected with Sony's rootkit DRM by employees listening to their legally purchased cd's while working. This was discovered because the DRM was trying to send information to Sony's site about systems and usage statistics. Essentially, Sony's DRM has hacked a government agency's IT infrastructure.

I may be mistaken, but I seem to think that there are some laws on the books that might make compromising a government agency's systems a *criminal* rather than a civil offense?

I suspect this has happened at other government (state or federal) agencies, as well. Could this also be considered IT espionage since Sony BMG as well as the company that wrote the software are foreign (i.e. not U.S.) companies?

Wouldn't that be interesting....?

(name withheld for obvious reasons)

Konrad wrote on 11/20/2005, 7:45 PM

Unauthorized use of a network is hacking and a criminal offense. As this software never got an "I agree" on install it is in my non lawyer opinion an offense. As I know our state AG I'll be sending him a letter asking him to look into it. As I had to deal with the fallout of my 12 year old daughter infecting her laptop, I'll think long and hard before giving Sony money again. This could not have happened at a worse time for Sony as they are running in red ink.