Boycott Sony

[Montesquieu]

Sony definetely sucks. Every record company sucks the hell. And that safedisc thing in Civ3 really sucks, because the experient cracker will always know how to bypass the copy protection while we, the ordinary customers, will always have to loose our time with these annoying copy-protection gadgets they decide to put in the CD. What about catching the crackers? Instead of forcing the customer to lose its valuable time, why not helping the police to catch the real bandits and leave us alone? We just bought that product *legally* and want to use it according to our customer rights. We are not the bad guys trying to mess up with everything!

[Q Classic]

OMG, I'm lovin' this~

===

1. Over 500k computers are compromised: [ link 1 ] [ link 2 ]

2. The removal software uses ActiveX controls which open up the user to more vulnerabilities: [ link 1 ] [ link 2 ]
(Lest you think the DRM is merely a Windows-only problem, apparently there are Mac kernel extensions. Spreading the love! [ link ] )

3. The XCP software likely violates the LGPL, using code without credit: [ link ]
(Funny how they think it's okay to break computers to protect their copyright, but think nothing of treading over others' copyrights.)

4. Sony-BMG execs arrogance shows with comments about how nobody knows what a rootkit is, and besides, it's not that dangerous at all~ [ link 1 ] [ link 2 ]

Sony products, at least for me, of all stripes, are stricken from the list. CDs are stricken as well.

[Kuciwalker]

Cruel and unusual punishment

[Kataphraktoi]

Originally posted by Mercator
Or just hold down Shift when you're inserting a CD.

i had a cd like this,and only the shift key would stop it.every button and whatnot on the pc relating to autorun was disable and it could still go.i tested it quite a while(oh yeah and reinstalled windows when done)

last cd i will ever buy,also

[SlowwHand]

Sony Yanks Copy-Protected CDs
PC World - Wed Nov 16,11:00 AM ET

After two weeks of relentless criticism over its XCP copy protection software, Sony BMG Music Entertainment is pulling CDs that contain the software from store shelves. The company is also planning to offer customers a way to exchange CDs that contain the flawed copy-protection software. "We share the concerns of consumers regarding discs with the XCP software, and we are instituting a program that will allow customers to exchange any CD with XCP software for the same CD without copy protection," Sony said in a statement posted on Tuesday.

Sony BMG Statement on Copy-Protected CDs at Sony BMG
Are You Infected by Sony-BMG's Rootkit? at EFF
Sony Copy-Protected CD Problems Q&A AP Discuss

They stepped in it this time.

[Asher]

It gets better: http://yro.slashdot.org/article.pl?s...id=188&tid=158

Sony's rootkit contains stolen code, VLC's demux/mp4/drms.c - the de-DRMS code which circumvents Apple's DRM written by 'DVD Jon'.

[SpencerH]

even more

Sony's Fix for CDs Has Security Problems of Its Own

By Brian Krebs
Special to The Washington Post
Thursday, November 17, 2005; Page D01

Consumers who used computers to listen to Sony BMG music CDs containing flawed software were still exposed to potentially crippling security breaches yesterday, experts said, as the company continued to try to fix the problem.

Sony BMG Music Entertainment released a software patch earlier in the week, but experts warned that the fix created as many security problems as the original program, and as of yesterday the company had not come up with a new approach.

Sony BMG has recalled nearly 5 million CDs equipped with the flawed anti-piracy software shipped to retailers over the past eight months -- including titles by singers Neil Diamond, Celine Dion and Ricky Martin. Roughly two weeks ago, security experts showed that the software automatically installed a program that hid all of its files from users and damaged or crashed computers of customers who tried to remove it.

When played on a home computer running Microsoft Windows, the CDs require users to install a special media player and click "agree" on 3,000-word license agreement. But the agreement makes scant mention of what the software, which is designed to prevent people from making unauthorized copies of the music, will do once installed.

For example, experts showed that the anti-piracy software "phones home" to Sony BMG and to the company that created the software, First 4 Internet Ltd., with details of user's music-listening habits. It also interferes with more than 250 programs that could allow copying of the CD contents to a portable media player or backup disc.

Detailed examination of the license agreement reveals no mention of such activity.

Further testing proved that hackers could use the program's file-hiding capabilities to silently embed computer viruses on PCs, prompting Sony BMG to issue a software update that removes that feature. Days later, unknown attackers sent millions of junk e-mails containing a virus crafted to exploit the flaws and seize control of vulnerable computers.

After the virus outbreaks, Sony BMG -- a joint venture of Sony Corp. and Bertelsmann AG -- said it would suspend production of new CDs featuring the copy-protection technology. But after nearly two weeks of relentless consumer backlash, Sony BMG said Tuesday that it would recall all CDs equipped with the anti-piracy software and that roughly 2 million customers who have already bought the discs would be able to exchange them.

Sony BMG spokesman John McKay declined to comment beyond the company's written statement, which apologized to customers for any inconvenience caused by the software and promised additional details about the CD exchange program in coming days.

Hours after Sony BMG announced its buyback, researchers at Princeton University found that even the patch the company released to remove the anti-piracy software contains security problems. The patch leaves behind coding that allows any Web page the user visits to download, install and run programs on the computer. Other research, released Tuesday by Atlanta-based Internet Security Systems, showed that the underlying program itself contained security holes that hackers could use to attack Windows computers running the software.

Sony BMG's latest moves have not erased its legal and public relations troubles. Last week, an attorney in California filed a lawsuit seeking damages for residents who bought the defective CDs, and on Monday, a lawyer in New York filed a nationwide class-action case against the company.

Mark Russinovich, chief software architect at Sysinternals, the security expert whose initial research into the anti-piracy program sparked the controversy, welcomed the class-action suits, saying withdrawal of the software wasn't enough.

"What I'm most concerned about is: If nothing serious happens to Sony that's visible to other companies, then we run the risk of this kind of thing becoming standard corporate behavior," Russinovich said.

The incident raises new questions about how far the music industry can go to defend its works from piracy. The industry loses roughly $4.2 billion worldwide to piracy each year, according to the Recording Industry Association of America. The software was the latest effort by entertainment companies to rely on controversial "digital rights management" (DRM) technologies to reverse a steady drop in sales that the industry attributes in large part to piracy facilitated by online music and movie file-sharing networks such as Kazaa and LimeWire.

Microsoft Corp. also waded into the fracas last week when it labeled Sony BMG's software a threat, saying it would let users remove the program through its anti-spyware program. Starting in December, Microsoft said, it will automate the removal of the software through its "malicious software removal tool," a program designed to help users clean up their computers after virus infections.

If this doesnt draw the ire of congress then nothing will!

[Urban Ranger]

Wired carries this Bruce Schneier article

But that's not the real story here.

It's a tale of extreme hubris. Sony rolled out this incredibly invasive copy-protection scheme without ever publicly discussing its details, confident that its profits were worth modifying its customers' computers. When its actions were first discovered, Sony offered a "fix" that didn't remove the rootkit, just the cloaking.

Sony claimed the rootkit didn't phone home when it did. On Nov. 4, Thomas Hesse, Sony BMG's president of global digital business, demonstrated the company's disdain for its customers when he said, "Most people don't even know what a rootkit is, so why should they care about it?" in an NPR interview. Even Sony's apology only admits that its rootkit "includes a feature that may make a user's computer susceptible to a virus written specifically to target the software."

However, imperious corporate behavior is not the real story either.

This drama is also about incompetence. Sony's latest rootkit-removal tool actually leaves a gaping vulnerability. And Sony's rootkit -- designed to stop copyright infringement -- itself may have infringed on copyright. As amazing as it might seem, the code seems to include an open-source MP3 encoder in violation of that library's license agreement. But even that is not the real story.

Nicely scrotching. But the questions raised at the end are chilling and more important. Everybody should read it at least once.

[Urban Ranger]

Texas joins in the fun

Yahoo!

HOUSTON (Reuters) - Texas Attorney General Greg Abbott filed a civil lawsuit on Monday against Sony BMG Music Entertainment (6758.T) for hiding "spyware" software on its compact discs in a bid to thwart music copying.

According to the lawsuit filed in Travis County, several of the company's music compact discs require customers to download Sony's media players if they want to listen to the CDs on a computer.

Software included with that media player "remains hidden and active" after installation, the Attorney General's office said, and makes users vulnerable to security risks and possible identity theft.

Sony's in deeper and deeper trouble. No wonder that CEO dude looks dazed.