Sony BMG XCP

~ the obituary ~

in 2005 i was a comp eng student in ankara. sysinternals utilities were the diagnostics most of my classmates knew by name. process explorer and autoruns and the rest of the small tools sat on every diagnostic flash drive in the lab. so when russinovich posted his 31 october 2005 writeup about a sony cd rootkit hiding files from windows, the english tech blogs picked it up and the post reached the engineering-school side of the conversation within a few days.

the technical story was clean. you put a sony bmg audio cd into a windows machine, the autorun layer ran an installer for what the eula vaguely described as copy protection. the installer dropped a kernel-level component built by a small british company called first 4 internet. the component hooked the windows api so that any file or process whose name began with the prefix $sys$ became invisible to the operating system. that is the definition of a rootkit. it was being shipped to consumers on commercial music cds.

russinovich's writeup laid it out with packet captures and disassembly screenshots. the cleanup process he tried only made the hidden files visible, the kernel hooks stayed. one week later other malware authors started using the $sys$ prefix to hide themselves on machines that had been infected by sony bmg cds. anything that prepended $sys$ to its filename now had a free invisibility layer courtesy of a major label.

~ the case file ~

~ how it broke ~

the response was fast. computer associates classified xcp as spyware on november 8. the first xcp-exploiting trojan appeared november 10. us-cert (the homeland security advisory office) issued a public warning november 16. november 15 sony bmg announced a recall of all xcp-protected discs and a consumer exchange program for clean replacements.

sony bmg released a removal utility. russinovich looked at the utility next, his second post showed that the uninstaller required you to provide an email address, install an activex control that contained backdoor methods of its own, and the result still did not fully remove the kernel hooks. it left the machine in a worse state than the original infection. the company was now two posts deep into a security incident it could not patch its way out of.

~ the legal tail ~

texas attorney general greg abbott sued sony bmg on november 21, the first state-level action and the first case filed under the texas spyware law passed earlier that year. abbott amended the complaint december 21 to add charges over the sister mediamax software that had shipped on the much larger run of around 20 million cds (52 titles for xcp specifically, much wider catalog for mediamax). class-action settlements moved through 2006 (cd exchange plus mp3 download codes for affected buyers). the federal trade commission settlement on january 30 2007 required sony bmg to reimburse up to 150 dollars per consumer for cleanup costs and barred future undisclosed installations.

sony bmg suspended cd copy protection entirely in early 2007. xcp as a product was over. first 4 internet rebranded to fortium technologies in 2006 and pivoted away from consumer drm. mark russinovich joined microsoft in 2006, eventually became azure cto. the sysinternals blog post stayed up as one of the most-referenced security writeups of the decade.

~ what got buried with it ~

xcp is now the single example english-language security curricula reach for when they need to explain why kernel-level drm on consumer media is a bad idea. it shows up in lectures on rootkit detection and in eula law writeups. the october 31 sysinternals post is one of the cleanest case studies of a security researcher embarrassing a fortune-500 corporation into a recall using nothing but a blog and packet captures. the cd format as a music container had about two more years of mainstream relevance after that. by 2007 the conversation had moved to itunes and amazon mp3 anyway, with no drm conversation left to have.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »