Analysis: Sony's DRM song and dance

By Stewart Mitchell

Posted on 22 Dec 2005 at 14:39

So surely once the negative publicity broke, Sony had to react swiftly to rectify the problems? Up to a point, but even when an uninstall patch was rushed out, the embarrassment didn't end. Software released to counter the problems posed by XCP and another copy-protection program, SunnComm, have opened up even more security holes through ActiveX vulnerabilities.

'For affected users, this represents a far greater security risk than even the original Sony rootkit,' said Ed Felton, professor of computer science at Princeton University. 'The consequences of the flaw are severe.

It allows any web page you visit to download, install and run any code it likes on your computer. Any web page can seize control of your computer; then it can do anything it likes. That's about as serious as a security flaw can get.'

But perhaps the most worrying aspect of this outrage is the painfully slow response from the security firms, which we rely on to lock down our PCs and networks. Some of the CDs on Sony BMG's list of 52 discs containing the software were released way back in March.

'For at least seven months, Sony BMG music CD buyers have been unsuspectingly installing rootkits on their PCs,' said Jupiter Research analyst Joe Wilcox. 'Why then did no security software vendor detect a problem and alert customers? If Sony's software exhibits so many characteristics of a malicious rootkit, why wasn't it detected over the course of so many months?'

One thing is clear. From now on, we need to scrutinise all intrusive software, even from respected vendors, not just that written by traditional bedroom hackers.