Sony Sues Rootkit Maker
Posted by
kdawson
on Thu Jul 12, 2007 08:35 AM
from the still-trying-to-recover dept.
from the still-trying-to-recover dept.
flyboy974 writes "Sony BMG Music Entertainment is suing the company that developed anti-piracy software for its CDs, claiming the technology was defective and cost the record company millions of dollars to settle consumer complaints and government investigations. The software in question is the MediaMax CD protection system, widely derided as a rootkit. Sony BMG is seeking to recover some $12 million in damages from the Phoenix-based technology company, according to court papers filed July 3."
Related Stories
[+]
Music Industry Backlash Against Sony Rootkit 400 comments
Foobar of Borg writes "The Associated Press describes how backlash from Sony's Rootkit CDs is causing problems for the music industry. The problem is two-fold: (1) the inherent technological problem of trying to prevent anyone from copying anything and (2) letting lawyers make technical decisions when (from the article) 'Lawyers don't have any better understanding of technology than a cow does algebra.'" More from the article: "'I think they've set back audio CD protection by years,' said Richard M. Smith, an Internet privacy and security consultant. 'Nobody will want to pull a Sony now.' Phil Leigh, analyst for Inside Digital Media, said the debacle shows just how reluctant the labels are to change their business model to reflect the distribution powers -- good and bad -- of the Internet. He believes that rather than adopting technological methods to try to stop unauthorized copying of music, record companies need to do more to remove the incentive for piracy."
[+]
IT: Sony RootKit Still A Problem? 268 comments
XMilkProject writes "Current research indicates that some "350,000 networks--many belonging to the military and government--contain computers affected by [Sony's rootkit]." This is down from over half a million last month. "The security researcher worked from a list of 9 million domain-name servers.. asking each to look up whether an address used by the XCP software--in this case, xcpimages.sonybmg.com--was in the systems' caches." Will Sony face future repercussions for this potentially long-term damage?"
[+]
Sony Rootkit Settlement Gets Judge's Approval 187 comments
Lewis Clarke wrote to mention a ZDNet story about Monday's final approval of the rootkit settlement in the case brought against Sony BMG Music. From the article: "The agreement covers anyone who bought, received or used CDs containing what was revealed to be flawed digital rights management (DRM) software after Aug. 1, 2003. Those customers can file a claim and receive certain benefits, such as a nonprotected replacement CD, free downloads of music from that CD and additional cash payments ... At least 15 different lawsuits were filed by class action lawyers against the record label, and the New York cases were eventually consolidated into one proceeding. The parties reached a preliminary settlement with Sony BMG in December, leaving it up to a judge in a U.S. District Court in New York to make it official. "
[+]
Sony Settles With FTC Over Rootkits 133 comments
The FTC has struck a deal with Sony punishing Sony for the rootkits it included on millions of CDs in 2005. The deal is exactly like the Texas and California settlements — $150 a rootkit. The settlement isn't final yet. There will be a 30-day public consultation. American citizens who read Slashdot might want to put in their two cents. Comments will be accepted through March 1 at: FTC, Office of the Secretary, Room H-135, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580 (snail mail only). Here is the FTC page announcing the settlement.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Sony BMG does nothing to hurt their reputation (Score:4, Interesting)
With all these name changes, I wonder when Macrovision is going to change theirs?
Re:Sony BMG does nothing to hurt their reputation (Score:5, Funny)
Re:Sony BMG does nothing to hurt their reputation (Score:5, Funny)
Also, we've always been at war with Eastasia.
Re:Sony BMG does nothing to hurt their reputation (Score:4, Insightful)
Re:Sony BMG does nothing to hurt their reputation (Score:5, Insightful)
Sony made the purchase from Amergence -- they are claiming, among other things, that Amergence delivered a product that did not operate as described.
If Amergence wants to sue Fortium along the same reasoning, they are welcome to -- though I think they'd have a hard time of it.
Who originally wrote the rootkit is of no relevance. What matters is whether Amergence falsely represented the product they sold to Sony.
Re:Sony BMG does nothing to hurt their reputation (Score:4, Funny)
Re:Sony BMG does nothing to hurt their reputation (Score:5, Insightful)
It's probably understandable that technologists would assume that the original author of the software would be the correct target of the lawsuit. This is not so. Sony is not suing over the failure of the code (the code worked relatively correctly), but over the fact that the software was sold to them as a means of controlling their market, and it not only failed to do so, but cause serious injury to their business as a result. That's the fault of the people who represented this software to Sony as a viable solution with acceptable risk.
Re:Sony BMG does nothing to hurt their reputation (Score:5, Insightful)
Which is not to say that Sony BMG's case has any merit. But then I, and everyone else here, do not know what the contractual arrangement between the two companies was and how the rootkit was presented to Sony.
Re:Sony BMG does nothing to hurt their reputation (Score:5, Funny)
Re:I'm confused (Score:5, Funny)
Sony releases DRM protected discs = -5,000 pts.
DRM Discs contain rootkit = -10,000 pts.
Sony denies any wrongdoing = -60,000 pts.
Sony realizes mistake = +100 pts.
Sony releases patch = +1,000 pts.
Public realizes cure worse than the disease = -5,000 pts.
Sony recalls discs = +10,000 pts.
Sony releases BluRay and PS3 = 0 pts.
Sony sues DRM Manufacturer = + 1pts.
So, in total, Sony is 68,899 points in the hole. I think its safe to say they're still pariahs here.
Re:I'm confused (Score:5, Insightful)
The Sony I used to love is dead. Management changes have turned it from a pioneering company into a slogging lumbering hulk that only wants more money, not customers' loyalty.
-nB
Re:I'm confused (Score:5, Informative)
- You do not have to buy music from the iTunes store in order to listen to it on your iPod. If you rip the music into iTunes from your CD, it will be in the AAC/MP4 standard sans DRM.
- iTunes does not require an iPod or the iTunes store in order to be a useful application. It is just a media jukebox that can rip and burn CDs. However, it can also purchase music from the iTunes store and copy files onto an iPod.
When are people going to stop deriding iTunes and the iPod on these grounds?$12,000,000 is peanuts. (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:$12,000,000 is peanuts. (Score:5, Insightful)
I don't think Sony should be the ones suing them, they contracted the software, and it was delivered to their specifications. Sony can't blame the people who wrote the software for doing what was asked.
If Sony didn't know what the software was doing then it's their own stupid fault.
If the software was illegal, then it's surely a matter for criminal court, and surely Sony shouldn't be awarded damages for being stupid enough to have this software written in the first place
Re:$12,000,000 is peanuts. (Score:5, Insightful)
I think they probably missed one important specification:
It was supposed to do it without anybody knowing about it.
Re:$12,000,000 is peanuts. (Score:5, Insightful)
Sony settled with various governments to avoid a lengthy legal process. If one of their suppliers was responsible for the illegal code, and falsely represented to Sony that the code was completely legal, then Sony sure as hell has both standing and reason to sue to be recompensed for those damages.
Yes, Sony was responsible for releasing the rootkit on their CDs. However, it is quite possible that Amergence should be held responsible for misleading Sony if that is in fact what happened.
Re:$12,000,000 is peanuts. (Score:4, Interesting)
They should have said that a year ago. And bent over backward to fix the problem. Instead, you may recall, one of their public statements was to shrug it off and say "Most people don't even know what a rootkit is." As if somehow that was the salient point.
I can't understand how anybody who does understand what they did would ever do business with them again, just as a matter of principle.
Would you contract to Sony for DRM after this?? (Score:3, Interesting)
Re:$12,000,000 is peanuts. (Score:4, Insightful)
What do you think went down? Sony asked for a noninvasive piece of monitoring software that could be easily detected and removed or blocked from being installed, and then they were delivered a fucking rootkit instead and they went "Dur, look fine to us" and ran with it? Fuck no. They tested it, inspected it, decided it was exactly what they wanted, and then ran with it. And they deserve every penny lost because of their actions.
Re: (Score:3, Interesting)
Responsibility (Score:5, Insightful)
Re:Responsibility (Score:5, Insightful)
Now they are trying to hold someone responsible for distributing to them.
Re:Responsibility (Score:4, Insightful)
Counterpoint:Sony is still ultimately responsible for what goes on their disks.
Counter-counterpoint:If Sony sends a software engineering firm a description for a project and the firm gives them a finished project, expecting Sony to have software engineers of its own to go over and affirm it is built to spec is a bit hard to swallow. They might have well just built it themselves in the first place. I'm sure you could think of a million examples, like a mobo manufacturer that orders capacitors that are faulty. .
Alright, before I go I'll say one more thing: How does this compare to Firestone v. Ford blowouts. Discuss.
Re:Responsibility (Score:5, Insightful)
Re: (Score:3, Insightful)
It seems like they are bringing to the public light again. Most people I know have forgotten about this debacle (or never knew about it to begin with). If I was Sony, I'd try to bury the rootkit fiasco as much as possible, not have a large public lawsuit
Re:Responsibility (Score:4, Insightful)
That's not really the way it works, in any company.
Too many deals are done for a large company to scrutinize every single product they buy. That's the whole point of using outside vendors; if they're going to put in the time to fully examine all the code, they may as well just develop the DRM themselves. Instead, the contracts are worded in such a way that it puts the onus on the provider of the product. That way, it's in the best interests of the provider of the product to ensure that what they're providing meets specifications and adheres to the letter of the contract. Otherwise, they know they're at risk of a lawsuit like this.
I doubt the contract here was any exception, which means Sony most definitely has the upper hand. And they really have to file a lawsuit in order to preserve their leverage against all of their other technology providers. This is how they ensure they get what they're contracting for.
I bet they knew but didn't understand (Score:5, Interesting)
Re:I bet they knew but didn't understand (Score:5, Informative)
http://www.betanews.com/article/Sony_President_Ro
Suuuuuure, Tony. That kind of flip attitude about it will not be exactly convincing.
Re: (Score:3, Informative)
The enemy of our enemy... (Score:5, Insightful)
This is actually a very good thing, because no-one involved will be immune to the consequences.
Dan East
Why stop there? (Score:3, Insightful)
Sony lawyers are shocked and surprised. (Score:5, Funny)
Taking responsibility (Score:3, Insightful)
But isn't this a bit like a bank robber who shoots a cop suing Smith and Wesson? E.g., it sounds like Sony knew (or should have known) exactly what it was putting on their CDs.
There's an idea! (Score:5, Insightful)
Re:There's an idea! (Score:4, Insightful)
If you hired a security company to burglar proof your home and were not present for the installation of land mines then you might have a case.
Worms. vs Birds (Score:3, Interesting)
Modest Mouse
Worms. vs Birds
Self pity me, it's so pitiful
You can see that birds and worms don't get along
Self-righteous me, it's so wrong and
You can see that we don't have to get along
Self pity me, it's so pitifull
You can see that birds and worms do not agree
And we will crawl
(Will crawl)
Defective by Design (Score:5, Informative)
But didn't they read the Click-through EULA? (Score:5, Insightful)
Let me be the first to say... (Score:5, Interesting)
Disclaimer: I'm not saying I hate them because they released a $600+ console ( + because it's even more expensive once you buy a game and a second controller) but what I'm saying is that it's a really boneheaded idea, and I don't know how they ever thought it would have mass appeal, no matter how good the graphics are.
I hope Sony read the EULA... (Score:5, Funny)
"Section 938.334 Sub W.
By agreeing to use this product to proctect your music CD's from piracy you also agree to hold us immune from any lawsuits, incurred directly or indirectly, due to your customers not liking this product."
oops... Guess they should read those EULA's VERY CAREFULLY...
At least that is what these companies would say to us...
":{ Grr...
IT'S DEFECTIVE (Score:3, Insightful)
Wait, did anyone here think Sony complained that it was a rootkit, and that this was the defect? Get real.
Have you guys actually been boycotting Sony? (Score:3, Interesting)
Shortly after it happened, I promised myself I would buy nothing with a Sony brand for at least a year. To my knowledge, I complied with that (though they do have tentacles in more things than you think, so who knows). I figured I need to end the boycott after a year, or else there wouldn't be any incentive for them to change anyway. I still haven't bought anything major from Sony -- the very name SONY screams to me "infected millions of PCs with rootkits, and tries to take away my Freedom!" But enough time has passed that I would probably consider buying a Sony product if it really were the right one for me.
How about you?
Works for me (Score:3, Informative)
Sounds like a good plan to me, take careful aim at that foot, Sony!
If there is any justice they will get a coupon (Score:4, Interesting)
If there is any justice then Sony will just get a coupon for more rootkits from the company and not any actual money.
Re:Like a celebrity deathmatch... (Score:4, Insightful)
Re:If Kim Jong Il Were President (Score:4, Insightful)
[/joke]
Re: (Score:3, Interesting)
In all seriousness though, if you pay someone to write you some software and it fucks up, whose fault is it? Theirs for not testing it, or yours for not testing it again
Re: (Score:3, Insightful)
A better analogy would be: i
Re: (Score:3, Interesting)