Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Sony Rootkit may Lead to Regulation

Posted by CowboyNeal on Fri Feb 17, 2006 04:11 AM
from the enough-is-enough dept.
Sony Security
An anonymous reader writes "Computerworld has a story about DHS officials meeting with Sony to read them the riot act, following the rootkit fiasco. From the story: 'A U.S. Department of Homeland Security (DHS) official warned today that if software distributors continue to sell products with dangerous rootkit software, as Sony BMG Music Entertainment recently did, legislation or regulation could follow.'"
+ -
story

Related Stories

[+] Technology: Sony Fakes Blu-Ray Demo? 305 comments
twasserman writes "Lance Ulanoff of PC Magazine reported on Sony's recent event showing the new VAIO AR desktop with a Blu-Ray drive, observing that Sony faked the high-def demo by using a plain old DVD+R of House of Flying Daggers. Even before the rootkit fiasco, Sony has seemed increasingly desperate, but the general consensus seems to be that Sony is looking pretty sad and pathetic." Update 03:07 GMT by SM: Many users are calling shenanigans on this one since there were two laptops side by side, one with the Blu-Ray demo and another for comparison. Independent confirmation or negation has yet to surface, so take with the requisite grain of salt required when reading any news.
[+] Sony Rootkit Settlement Gets Judge's Approval 187 comments
Lewis Clarke wrote to mention a ZDNet story about Monday's final approval of the rootkit settlement in the case brought against Sony BMG Music. From the article: "The agreement covers anyone who bought, received or used CDs containing what was revealed to be flawed digital rights management (DRM) software after Aug. 1, 2003. Those customers can file a claim and receive certain benefits, such as a nonprotected replacement CD, free downloads of music from that CD and additional cash payments ... At least 15 different lawsuits were filed by class action lawyers against the record label, and the New York cases were eventually consolidated into one proceeding. The parties reached a preliminary settlement with Sony BMG in December, leaving it up to a judge in a U.S. District Court in New York to make it official. "
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Sony Rootkit may Lead to Regulation 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • WTF? (Score:5, Interesting)

    by smash (1351) <jethro.roseNO@SPAMgmail.com> on Friday February 17 2006, @04:16AM (#14740718) Homepage Journal
    So if a 15 year old crashes his school's webserver by getting a bunch of friends in IRC to click on it too many times he can be prosecuted, but if a global megacorporation does something far more insidious (effectively, SELLING you TROJANED media), then "we need regulation"?

    Why are people not in jail for this yet?

    (yes, that was a rhetorical question).

    smash.

    • Re:WTF? (Score:5, Interesting)

      by lennart78 (515598) on Friday February 17 2006, @04:23AM (#14740741)
      According to www.opensecrets.org Sony has, over the years, ponied up millions of dollars in contributions to political parties. I haven't seen that 15 year old script-running-juvenile matching that.

      • Re:WTF? (Score:5, Insightful)

        by smash (1351) <jethro.roseNO@SPAMgmail.com> on Friday February 17 2006, @04:31AM (#14740764) Homepage Journal
        I don't need opensecrets.org to tell me that. :)

        I was merely trying to point out how "fucked up" the system is - we live in a world that allowed the two events described above to have the outcomes they did...

        smash.

        • Re:WTF? (Score:5, Insightful)

          by crawling_chaos (23007) on Friday February 17 2006, @09:33AM (#14741857) Homepage
          Because its shareholders are largely voters. The Supreme Court has ruled money to be speech, and the Right of the People to assemble to petition the government for redress of grievances is in the Constitution. Like it or not, a corporation is an assembly of some of the People, just like a union, or political party.

          I agree it stinks, but I'm not exactly sure how we stop it short of a constitutional amendment, and if that amendment is too broadly worded, the cure could be worse than the disease.

    • Re:WTF? (Score:5, Insightful)

      by luvirini (753157) on Friday February 17 2006, @04:34AM (#14740776)
      But the 15 year old is a terrorist for attacking national infrastructure. The company is just trying to protect it's godgiven right for profits.

    • Re:WTF? (Score:5, Insightful)

      by jozi (908206) <valsharessa1 AT hotmail DOT com> on Friday February 17 2006, @06:45AM (#14741066)

      Corporation: An organization created in order to generate individual profit without individual responsibility.

      That is why no on is in jail, it goes against the very idea of corporations. :o)

    • Security Flaws are Not the Issue (Score:4, Insightful)

      by iamlucky13 (795185) on Friday February 17 2006, @01:05PM (#14743742)
      It really bugs me that DHS and generally everyone else are looking at this issue as if the security vulnerabilities in the Sony rootkit are the main issue. And perhaps it is to them, but not to me. The real issue is that Sony is installing software on computers without the owner's permission, and it's software that intentionally hobbles hardware/software you paid for. That's like being upset, not because a thief stole your TV, but because he left the back door unlocked when he left.

          • Re:You haven't figured it out yet? (Score:5, Insightful)

            by Sique (173459) on Friday February 17 2006, @06:07AM (#14740987) Homepage
            No. The principle of capitalism ist: Privatize profits, communalize costs. Sony BMG was just trying to profit privately from non copyable media while externalizing the costs to thousands of PC owners.

              • Re:You haven't figured it out yet? (Score:5, Insightful)

                by Anonymous Coward on Friday February 17 2006, @06:42AM (#14741058)
                No, that just makes it good business, according to the reprehensible predatory practices that are currently deemed as acceptable business behavior. Corporate execs and shareholders alike love nothing better than to externalize expenses, and they really don't give a damn who has to bear that burden, as long as it's not them.

                • Re:You haven't figured it out yet? (Score:5, Interesting)

                  by Fred_A (10934) <fred@NospAm.fredshome.org> on Friday February 17 2006, @08:12AM (#14741317) Homepage
                  You might also want to keep in mind that "true capitalism", as well as "true communism" are mind constructs that are completely impossible to setup in the real world because there is no way that most people are actually going to play nice. If they can screw you to increase their benefit, they will. Which is why an external regulatory agent is needed (even though that idea is apparently blasphemous to the US mindset).

  • The recent Sony experience (Score:5, Funny)

    by Anonymous Coward on Friday February 17 2006, @04:19AM (#14740731)
    "The recent Sony experience..." This phrase makes me wonder if Sony is going to be a catch phrase.

    "I just bought a DVD with rootkit software on it."
    "You've been Sony-ed", or,
    "That's the Sony experience!"

  • So.. (Score:5, Funny)

    by Anonymous Coward on Friday February 17 2006, @04:21AM (#14740738)
    Sony's root kit disabled the Department of Homeland Security's root kit. I can see why they might be miffed.

      • Re:So.. (Score:5, Funny)

        by jibjibjib (889679) on Friday February 17 2006, @05:00AM (#14740851) Journal
        What if I want to make my own rootkit? Will I have to register it with the DHS, and get them to audit it for security holes and check it for compatibility with their own rootkit?

        And what about Linux rootkits? Will Linux rootkits be supported by the DHS? Or will they just be banned altogether? Surely the DHS can't be stuffed writing a Linux rootkit as well as a Windows rootkit.

        Even scarier... what if Linux rootkits weren't regulated at all? Cyberterrorists could go on a rampage of linux rooting, and the government wouldn't be able to stop them, or more importantly, tax them.

        Hmm... that's an idea, the DHS could implement a rootkit tax, to fund their own rootkit development, and better protect our fellow God-fearing American citizens from the cyberterrorists of the future.

        The War on Terror is ending. The War on Rootkits is only just beginning...

  • Threatening Legislation (Score:4, Insightful)

    by James McGuigan (852772) on Friday February 17 2006, @04:25AM (#14740746) Homepage
    So they have not been punished for their crime,

    They are not even being told they will get punished if they do it again,

    It seems to say, if you do it again, only then will make it illegal so you can't do it a third time.

    (Gee, I'll have to try that one next time I get busted by the cops - its only my first offence, officer, you shouldn't lock me up until I've done it at least 3 times)

  • Regulation? (Score:4, Insightful)

    by RedHatLinux (453603) on Friday February 17 2006, @04:26AM (#14740750) Homepage
    Ohh, you mean legalization and decriminalization of these behaviors, so that this does not become an issue again. Anything less than a total ban, backed up by some serious time in a federal pound you in the ass facility, means that someone has been bought out.

  • Mr. & Mrs. Smith DVD (Score:5, Informative)

    by rminsk (831757) on Friday February 17 2006, @04:32AM (#14740772)
    Lets hope the industry learns soon. There are recent products shipping with rootkits on them like the german release of Mr. and Mrs. Smith. http://www.f-secure.com/weblog/archives/archive-02 2006.html#00000810 [f-secure.com]
      • Nope, it's a trojan, and it requires you to give it your admin password to do anything realy nasty.

                • Re:Mr. & Mrs. Smith DVD (Score:4, Informative)

                  by Tony Hoyle (11698) <tmh@nodomain.org> on Friday February 17 2006, @09:26AM (#14741796) Homepage
                  Oh and it *is* a true virus. It replicates in exactly the same way as eg. an outlook virus.

                  Apple haven't got a fix out yet but I guess they will soon (WTF is system software doing loading libraries from the home directory anyway? There's a *reason* why /usr/lib is only writable by root..)

                  From the virus summary:

                  "Leap.A installs a bundle to '~/InputManagers/apphook' that hooks certain iChat functions. When any of the user's buddies change their status, the worm initiates a file transfer and sends a copy of ' 'latestpics.tgz'. The file transfer is not visible to the user as the worm hides the transfer status information."

                  "The worm enumerates all applications on the computer that were used during the last month. Leap.A replaces the main executable of those applications with itself and saves the original file to a resource fork with the same filename. When the application is opened the worm activates first, then it runs the original application from the resource fork."

  • My EFF Action letter worked! (Score:3, Funny)

    by Anyd (625939) on Friday February 17 2006, @04:40AM (#14740793)
    Hooray!
    I told my senator to tell the RIAA and Sony to go f##k themselves... I guess he listened.

  • threatening? (Score:3, Insightful)

    by LParks (927321) on Friday February 17 2006, @04:41AM (#14740800)
    Why merely threaten legislation if it continues to happen? Laws against "products with dangerous rootkit software" wouldn't seem to harm anyone. Enact the legislation now.

  • not malicious? (Score:4, Insightful)

    by a.d.trick (894813) on Friday February 17 2006, @04:42AM (#14740807) Homepage

    From TFA:

    While Sony's software was distributed without malicious intent

    I guess that depends on what you mean by malicious. As far as I'm concerned, anyone who distributes trojans is either malicious, or mentally insane — on the same level as the man who thinks he's a poached egg.

    • Re:not malicious? (Score:4, Insightful)

      by luvirini (753157) on Friday February 17 2006, @04:45AM (#14740813)
      The real thing was likely more crimial negligence than an attempt to break things. They should thus pay for all the associated costs as anyone breaks something owned by someone else and so on...

      • The side-effect of making computers unstable and hackable was not the intent of sony

        Yes, but there was also:

        Making it difficult / impossible to uninstall
        Using rootkit tech _at all_ (to hide the driver files, to stop you uninstalling)
        Making it install even when the user clicks no / cancel

        All those were clearly deliberate intent - and dubious legality in some places (particularly installing, irreversibly, when the user explicitly denies permiss

  • eh? (Score:4, Insightful)

    by szo (7842) on Friday February 17 2006, @04:45AM (#14740814)
    You mean this was legal?

    • Mod Parent Up. (Score:5, Interesting)

      by SeaFox (739806) on Friday February 17 2006, @04:55AM (#14740841)
      To have the government threaten to enact legislation is like having a parent wave their finger at a naughty child warning him not to break ANY MORE of the neighbor's windows.

      Laws have already been broken and all we're seeing is warnings implying this may be made illegal in the future.

  • No malicious intent? (Score:5, Interesting)

    by erroneus (253617) on Friday February 17 2006, @04:50AM (#14740828) Homepage
    While Sony's software was distributed without malicious intent, the DHS is worried that a similar situation could occur again, this time with more serious consequences. "It's a potential vulnerability that's of strong concern to the department," Frenkel said.

    Would someone please define malicious? I think it WAS malicious.

    ------------
    The American Heritage dictionary:
    malicious (m-lsh's) pronunciation
    adj.

    Having the nature of or resulting from malice; deliberately harmful; spiteful.

    -------------
    Thompson-Gale Legal Encyclopedia:
    Malicious

    Involving malice; characterized by wicked or mischievous motives or intentions.

    An act done maliciously is one that is wrongful and performed willfully or intentionally, and without legal justification.

    --------------
    I'd say that given Sony's generally agressive posture with regards to personal/individual fair use and copyright infringement, I think they could easily be characterized using words like "angry" and "vengeful." And regardless of the emotional component, it was certainly wrongful, willfull, intentional and without legal justification.

  • Since when did the Executive branch make laws? (Score:4, Insightful)

    by Rogerborg (306625) on Friday February 17 2006, @04:55AM (#14740842) Homepage
    Last time I checked, the DHS doesn't work for the Legislature. Their job begins and ends with enforcing the existing laws.

  • wrong act.... (Score:3, Insightful)

    by luvirini (753157) on Friday February 17 2006, @05:00AM (#14740850)
    read them the riot act

    Should it not read RICO act?

      • Quibble, with both parent and GP, but The Riot Act [wikipedia.org] comes into force only after it has been read out, bit it aint so with the RICO or PATRIOT : Hence the phrase "Reading the Riot Act"

  • And yet, the cynic in me... (Score:4, Interesting)

    by Crash Culligan (227354) on Friday February 17 2006, @05:12AM (#14740875) Journal

    ...thinks that DHS would love for this to happen again.

    From TFA: Baker stopped short of mentioning Sony by name, but Frenkel did not. "The recent Sony experience shows us that we need to be thinking about how to ensure that consumers aren't surprised by what their software is programmed to do," he said.

    I could almost see them thinking, . o O (...and the best way to do it would be to stringently regulate consumers' computers, so that we can watch for intrusions of this sort in future and prepare for them. Oh, do it again Sony? Ohpleaseohpleaseohpleaseohsnausagesohplease!)

  • Could someone explain? (Score:5, Insightful)

    by Opportunist (166417) on Friday February 17 2006, @05:18AM (#14740883)
    A 17 year old writing a stupid trojan that does little but spread receives a 2 year sentence in jail and is only safe from compensation since companies didn't want to have the public know their systems are insecure.

    Read: Juvenile dick-waving without commercial interest -> 2 years prison.

    A large corporation spreading a rootkit with their product to their paying customer with the intent to cripple their customer's software performance (not being able to use it as intended, by manufacturer or user) that also has the capability of spying on their behaviour (allegedly they didn't use that function, but ... yeahsure) receives... a recommendation not to do anything like this again or else we might have to think about creating laws banning this behaviour (hey, those laws exist, enact them!).

    Read: Commercial malvolent infiltration of customer's computers -> Nada.

    The world sure is changing. When I was still in school, adding "commercial" to a crime sure upped your sentence by some magnitude. Nowadays it seems to be your "get out of jail" card if you commit a crime with financial interest.

    Al Capone simply died too early. He'd love these times.
      • Well, first, yes, a "teenage hacker" might include some harmful code. That's where the fun part ends. But he didn't. There was no direct damage involved (besides some spam for the spreading routine, which is dwarfed by the amount of spam from c15al1s and v1agra).

        Still, 2 years and some other rules that simply crippled his future, like banning him from the 'net for a while.

        Imagine a ban on Sony to produce music for 2 years, what good this could do!

        But I ramble. The core point is that there is NO way that you

  • Talk about a misleading submitted post (Score:3, Informative)

    by will_die (586523) on Friday February 17 2006, @05:21AM (#14740894) Homepage
    The main bulk of the article is about a recent speech where the director of law enforcement policy talked about how companies should be careful about how they implement copy protection and how it should not damage or surprise users in how it works.
    In there is a small paragraph mentioning that DHS and a talk with Sony that what they did "was not a useful thing", which becomes the main thing.
    The thing thing that should of been focused on was the message from DHS that companies should not defeat the security measures that people have in place on thier computers.
  • I was about the download the demo for Battle for Middle Earth 2 the other day, only to read that the goddamn DEMO comes with the StarForce [boingboing.net] malware.

    According to Wikipedia [wikipedia.org], Ubi Soft, Digital Jesters and Codemasters routinely use StarForce on new games. Forget about consoles, THIS is what might kill PC gaming permanently.

  • What is a rootkit? (Score:5, Informative)

    by tom6a (871216) on Friday February 17 2006, @05:31AM (#14740923)
    If you are looking for a good reference to understand a rootkit I recommend Matt Vea's article "Rootkits: The 'r00t' of Digital Evil." He wrote it back in Novemeber when the Sony fiasco was first revealed. Link: http://www.omninerd.com/2005/11/22/articles/43 [omninerd.com]

  • Important distinction (Score:5, Interesting)

    by AlphaSys (613947) on Friday February 17 2006, @05:35AM (#14740932)
    Another exaple of our tax-dollar-paid servants not applying themsleves to the task mentally:

    "A U.S. Department of Homeland Security (DHS) official warned today that if software distributors continue to sell products with dangerous rootkit software, as Sony BMG Music Entertainment recently did, legislation or regulation could follow."


    The important thing to keep in mind is that, while SONY may have a software division, the product sold wasn't even a software product at all, and no disclosure of a software product was discussed in any terms of sale, etc. The whole software angle was completely surrepetitious. It's not just "software distributors" that need policing here. When it boils down to it, this SONY division had no business "engineering" software into their product; they had little grasp of the ethics or the technical implications of what they were doing... or at least that's what they tell us now. For all we know, they were fully aware and just did it anyway thinking plausible deniability was all they would need when it came to light. If indeed they thought so, they would seem to have been prescient - nothing has happeded because of it. I for one am a bit surprised at that.

  • Sony should be prosecuted (Score:4, Funny)

    by layer3switch (783864) on Friday February 17 2006, @05:42AM (#14740941)
    for distributing Celine Dion CDs. I don't mind rootkit (haven't bought "CD" in 10 years), but for Pete's sake, someone feed that woman.

  • forget rootkits... (Score:5, Funny)

    by bennomatic (691188) on Friday February 17 2006, @05:44AM (#14740947) Homepage
    what I want is a w00tkit!

  • Megacorp meets with secret police (Score:5, Insightful)

    by The Mgt (221650) on Friday February 17 2006, @06:38AM (#14741050)
    I'm sure good things will come of this. :/

  • Sony BMG settles (Score:5, Informative)

    by Dachannien (617929) on Friday February 17 2006, @07:28AM (#14741171)
    On a side note, Sony BMG settled the class action lawsuit filed against them by the EFF. If you want replacement CDs released by Sony BMG that don't have XCP or MediaMax on them, head to http://www.eff.org/sony [eff.org] for more info.

    It's your chance to stick it to the man.

  • Will Someone Please Explain.... (Score:4, Insightful)

    by mpapet (761907) on Friday February 17 2006, @12:45PM (#14743569) Homepage
    Why is DHS the one that is playing enforcer here? How does policing corporations in private fit into their responsibilities of providing homeland security?

    With computer crimes there's some kind of investigation from local and federal law enforcement (FBI maybe?) and maybe a public hearing or two to give the appearance to voters that something is going to be done.

    Please point out the obvious here because I'm missing it.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.