RSSSony BMG Fixes New DRM Security Hole
By Nate Mook | Published December 7, 2005, 12:35 PM
In conjunction with the Electronic Frontier Foundation, Sony BMG said on Tuesday it had issued a patch to fix a security vulnerability within the SunnComm copy protection utilized on 27 CDs. The new problem is separate from the XCP DRM software by First4Internet that included a rootkit.
Specifically, SunnComm's MediaMax version 5 does not properly protect a directory it installs, opening the door for a privilege escalation attack. A restricted user account could replace the executables within the MediaMax directory with malicious code, which would then be executed by an administrator upon inserting a CD.
The vulnerability was discovered by security firm iSEC Partners after the EFF requested the software be examined for problems. The action was taken following the uncovering of a rootkit in Sony's other copy-protection software known as XCP. The rootkit was used to cloak the DRM and prevent its removal, in turn opening a number of security holes on a PC.
Attempting to make up for its prior missteps, Sony says it will notify customers of the SunnComm problem through an advertising banner within the MediaMax software, and via an online ad campaign. The update can be downloaded from the Sony BMG Web site and will be issued to security vendors.
"We're pleased that Sony BMG responded quickly and responsibly when we drew their attention to this security problem," said EFF staff attorney Kurt Opsahl. "Consumers should take immediate steps to protect their computers."
Sony BMG president Thomas Hesse, who infamously told NPR that most users "don't even know what a rootkit is, so why should they care about it?" was more humble this time around.
"We're grateful to EFF and iSEC for bringing this to our attention. We believe that the availability of the update coupled with our campaign to notify customers will appropriately address the CDs with MediaMax Version 5 in the market," he said in a statement.
As for the XCP DRM, Sony has claimed it pulled the affected CDs off store shelves entirely and the company is offering an exchange program for customers. Still, Sony is facing lawsuits from Texas and the EFF due to its actions, and New York Attorney General Eliot Spitzer warned Sony that some rootkit-laden CDs are still available for purchase.
i actually had to identify and remove mediamax for someone. Killed it, disabled autorun so it doesn't re-infect, everything worked fine then. To hell with Sony and their malware. Apparently from what i read, this stuff can install even if you do not agree to the EULA. In my book anything SONY is to be avoided at all costs now and forever.
Score: 0
|I for one will never buy another CD from Sony BMG. Any artist signed with them will just have to do without my money. I use to believe in buying legal music until they started destroying users PC’s with there illegal protection schemes.
Score: 0
|Another question... is it illegal via DMCA to write a program that would prevent audio CD's from being able to install DRM software without consent? It's malware, so is it subject to protection?
Score: 0
|EFF getting bent over again. EFF is starting to become the Jesse Jackson of the internet... jumping in on popular issues, shouting from a soapbox with no teeth, and giving in at the first point of negotiation, ready to clasp hands and declare a joint victory for all involved.
EFF may be losing all its court battles, but it's a great PR firm.
Score: 0
|Basically, this "DRM protection" software will still be installed and hard to remove. I'm not sure what it's function will actually be, but if it keeps you from copying the cd to the computer or making duplicates, I want nothing to do with it.
If i can do my own upgrades, i shouldn't have to purchase them twice, and i shouldn't be limited from legitimate use - such as making my own mp3/ogg/wma from cd, for example.
Score: 0
|Well, I am happy to see Sony is taking evasive action on this issue unlike before.
Score: 0
|lol, cleaver statement
Score: 0
|being an electronics geek, I've owned dozens of electrical devices from various manufacturers over the years.
I realized the other day a startling statistic.
EVERY Sony device I have ever purchased in my life has broken at one point or another. On the other hand, all non-Sony devices have been trouble free.
I have made a concious decision to be done with Sony. The whole DRM mess is just icing on the cake.
Score: 0
|Just like the X360 Issue, some people are unlucky enough to get lemon products from electronics manufacturers.
I myself love sony's products, I have never had a problem with anything I have purchased from them. (sound familliar? People bashing the on X360 cuz of it's overheating problem? and others stating that is perfect and they have yet to have a single issue)
I have a PSX that I have had since 1997, Still have it and works beautiful.
I have a PS2 that I bought the day it was released onto the market, works beautiful
I have a 19" Sony TV that I've had since 2000, works beautiful
I have a 36" Sony VVega HDTV that I've had for a year n ahalf, works beautiful.
out of everyone I know, and I know alot of people! there is only one of my friends that have had a single problem with a Sony product, and that was his PS2 having issues playing DVD movies, and that's the only issue.
I'm sorry MCoupeMike that you've had nothing but problems with sony, but I guess you have just been unlucky with their products.
Score: 0
|ROFL this is a lemon? every cd that has the protection software on it is a problem...the fact that it installs without telling you is another issue in itself...Sony realized they HAD to do something since they screwed up the xcp fiasco so badly...otherwise this never would have been news and no one would have been the wiser...Sony PS2 and PSX had significant problems with cheap lasers...Try calling Sony about a Disk Read Error and depending on what agent you get will it get resolved... otherwise they charge you to fix THEIR problem... Xbox360 is fixing for FREE with FREE Overnight Shipping.
Tell me another company that would have responded as quickly in fixing this issue...
Score: 0
|Old sony products were superior in many ways, but more recently they have declined in quality considerably. Their old CD boomboxes, for example, were simply the best. Got one in 1994 that hasn't failed me even once and I still use it all the time. Got one in 2003 for the living room and it was DOA. Got a replacement, worked ok for a while, but it seemed to be lacking as far as sound quality compared to the cheap boombox in my room. Earlier this year the top "hatch" for putting CD's in wouldn't snap closed. I had to put my alarm clock on it for it to work. Three months later it broke for good, can't read any CD's at all. Last month it no longer has the clock. Checked power cable and all...no, it just died completely. Not after a storm mind you (also pluggen into a surgemaster or something, paid $80 for the protection as it protects my "Big Daddy" stereo too).
Sony CD drive repair history? Look at a recent Consumer Reports--says it all...even Pioneer beats 'em in repair history now!
Score: 0
|the "lemon" issue wasn't regarding their "CD's" it was regarding their "electronics"
read man...reading is good for you
Score: 0
|quote from maniakmx3
"I have a PSX that I have had since 1997, Still have it and works beautiful.
I have a PS2 that I bought the day it was released onto the market, works beautiful
I have a 19" Sony TV that I've had since 2000, works beautiful
I have a 36" Sony VVega HDTV that I've had for a year n ahalf, works beautiful."
dude u must not have used your electronics at all that's y you never had a problem.
I too got a ps2 when they first came out. now i haven't had any trouble with it other then the fact i cant read psx games on blue backed media. sony's fix for this is for me to buy a new psx. a buddy of mine he made the mistake of using his psx to play DVD media (something i will not do) anyway it toasted his reader sony's response to this was buy another one. so he did. after a wile it did the same thing he called Sony again. Sony gave him the same reply buy a new one.
now i don't know about you but my boycott stands if they are willing to brake laws to prevent you from doing something you are legally allowed to do.
believe it or not your allowed one back up copy of your CD. then they can go to the trash dumpster.
Score: 0
|"Just like the X360 Issue, some people are unlucky enough to get lemon products from electronics manufacturers"
"I too got a ps2 when they first came out. now i haven't had any trouble with it other then the fact i cant read psx games on blue backed media"
Problems happen...
Score: 0
|I understand problems happen. BUT when they refuse to fix the problem and tell me that i have to buy a new one to fix the problem. then i have a problem with Sony's support. xbox 360 is offering to fix there problem and pay for shipping. AND with fast shipping they know they made a mistake they are willing to fix it unlike Sony. big difference in a product that is buggy being fixed by the people that make the product at their expense. then a product that has problems that the user has to pay for.
Score: 0
|Tell me why I would want to purchase another CD again? Oh right, to have unwanted software installed on my computer.
Score: 0
|Wouldn't it be a tragedy if music CD's actually had enough music on them to make adding additional unwanted software impossible?
Score: 0
|I hear ya...
Score: 0
|