Sony's DRM protected CDs install Windows rootkits
{{date|November  1, 2005}}

Mark Russinovich, of SysInternals.com, has discovered a so-called "{{w|rootkit}}" which is installed by [[Sony]]'s new {{w|digital rights management}}-protected music compact disks (CDs).  A rootkit is a common name for malicious software that is used by computer criminals to hide their presence on a compromised computer.  Rootkits frequently contain hidden files and are designed to be difficult for the user to detect and remove.

Russinovich classifies Sony's rootkit as {{w|malware}} because it is alleged to introduce several serious security holes, one of which can be exploited to hide files and prevent the user from removing them.  In particular, all executable files which begin with '$sys$' are hidden when the software is installed.  He points out that these security holes could be exploited by hackers, or other malware producers besides Sony.

Russinovich explains that naively removing the files will result in a crippling of the operating system on the user's computer.  He provides an explanation of the difficult step required to remove Sony's malware.

Playing the same CDs on computers not running the Windows operating system, or on a non-computer based CD player remains safe.  As removing Sony's malware would violate the [[Digital Millennium Copyright Act]]'s anti-circumvention provisions, {{w|ripping}} the CDs on computers running a non-Windows operating system may be the best legal and technically safe option for those who wish to listen to them under Windows.

The software is automatically installed when a Sony CD is played on a computer, and is not mentioned in their {{w|EULA}}.  The rootkit has been commercially developed by [http://www.first4internet.co.uk/ First 4 Internet] and licensed to Sony.

Other rights management techniques used by music publishers recently include breaking the {{w|Red Book (audio CD standard)|Red Book}} compact disc standard format. This technique causes many CD players to not be able to play the new CDs, but also protects against casual ripping.  {{w|Fiona Apple}}'s recent album release in the United States uses such technology.

== Sources ==
*{{source|url=http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html
|title=Sony, Rootkits and Digital Rights Management Gone Too Far
|author= Mark Russinovich 
|pub=Mark's Sysinternals Blog
|date=October 31, 2005}}
*{{source|url=http://www.theregister.co.uk/2005/11/01/sony_rootkit_drm/
|title=Removing Sony's CD 'rootkit' kills Windows
|author=Andrew Orlowski
|pub=The Register
|date=November 1, 2005}}
*{{source|url=http://it.slashdot.org/article.pl?sid=05/10/31/2016223&tid=172&tid=158
|title=Sony DRM Installs a Rootkit?
|author=
|pub=Slashdot
|date=October 31, 2005}}
*{{source|url=http://yro.slashdot.org/article.pl?sid=05/11/02/1421250
|title=More on Sony's "DRM Rootkit"
|author=
|pub=Slashdot
|date=November 2, 2005}}
*{{source|url=http://www.theinq.net/?article=27349
|title=Sony rootkits your system
|author=
|pub=The Inquirer
|date=November 1, 2005}}
*{{source|url=http://blogs.washingtonpost.com/securityfix/2005/11/sony_raids_hack.html
|title=Sony Raids Hacker Playbook
|author=Brian Krebs
|pub=Washington Post
|date=November 1, 2005}}
*{{source|url=http://blogs.zdnet.com/BTL/?p=2092
|title=Sony Music CDs surreptitiously install DRM Trojan horses on PCs
|author=
|pub=ZDNet
|date=November 1, 2005}}
*{{source|url=http://computerworld.co.nz/news.nsf/rss/6F634E7F150B3D30CC2570AD0009362A
|title=Sony ships sneaky DRM software
|author=Robert McMillan
|pub=Computerworld
|date=November 3, 2005}}
*{{source|url=http://news.bbc.co.uk/1/hi/technology/4400148.stm
|title=Sony slated over anti-piracy CD
|author=Mark Ward
|pub=BBC News
|date=November 3, 2005}}
<!--
*{{source|url=
|title=
|author=
|pub=
|date=Mmmmm DD, YYYY}}
-->

==External links==
*[http://www.amazon.com/exec/obidos/tg/detail/-/B00092ZM02/102-2930959-5372918 Amazon link to "Get Right with the Man"] (CD which was found to contain rootkit)
*[http://www.ukcdr.org/issues/cd/ Copy protected ("corrupt audio") disc information]
*[http://www.fatchuck.com/z3.html Fat Chuck's list of bad CDs] - list of copy-protected discs which fail the red book standard and cannot be considered compact discs
*[[w:Copy control|More information on "corrupt audio" discs]]
* [http://downloads.technutopia.com/antivirus/SonyDRMxcpRootkitRevealer.exe SonyDRMxcpRootkitRevealer.exe] Sony DRM XCP Rootkit revealer - more information at http://www.technutopia.com/forum/showthread.php?t=1321
* [http://www.worship.co.za/BlackAndWhiteInc/xcp.htm XCP Rootkit Removal instructions] that do not require any software downloads.

{{publish}}

{{archive}}
[[Category:Computing]]
[[Category:Sony]]
[[Category:Digital Millennium Copyright Act]]
Mark Russinovich, of SysInternals.com, has discovered a so-called "digital rights management-protected music compact disks (CDs).  A rootkit is a common name for malicious software that is used by computer criminals to hide their presence on a compromised computer.  Rootkits frequently contain hidden files and are designed to be difficult for the user to detect and remove.

Russinovich classifies Sony's rootkit as  because it is alleged to introduce several serious security holes, one of which can be exploited to hide files and prevent the user from removing them.  In particular, all executable files which begin with '$sys$' are hidden when the software is installed.  He points out that these security holes could be exploited by hackers, or other malware producers besides Sony.

Russinovich explains that naively removing the files will result in a crippling of the operating system on the user's computer.  He provides an explanation of the difficult step required to remove Sony's malware.

Playing the same CDs on computers not running the Windows operating system, or on a non-computer based CD player remains safe.  As removing Sony's malware would violate the Digital Millennium Copyright Act's anti-circumvention provisions,  the CDs on computers running a non-Windows operating system may be the best legal and technically safe option for those who wish to listen to them under Windows.

The software is automatically installed when a Sony CD is played on a computer, and is not mentioned in their .  The rootkit has been commercially developed by  First 4 Internet and licensed to Sony.

Other rights management techniques used by music publishers recently include breaking the Red Book compact disc standard format. This technique causes many CD players to not be able to play the new CDs, but also protects against casual ripping.  's recent album release in the United States uses such technology.
Computing Sony Digital Millennium Copyright Act