Wednesday, November 16, 2005

Sony Rootkits part deux

Not only are their software ineptly programmed, but some of it isn't even programmed by them. Recent discoveries shows parts from the Lame MP3 Encoder in their code, a open source software that is licensed under the LGPL (Gnu Public License). This means that for Sony to be able to use their code, they must explicitly state the use of it, and they must also distribute their source code along with the product (the DRM software on their copy protected cds).

As you may know, Sony haven't complied to any of this and they may now be in even deeper shit about this whole DRM affair. This is the string from the library version.c of Lame that was found on Sonys rootkit CDs;
"http://www.mp3dev.org/", "0.90", "LAME3.95", "3.95", "3.95 ".

Sony have already stopped the shipping of the controversial CDs, but they stated that they wouldn't pull any of their CDs that was already shipped, now they changed themself and are pulling every CD from the shelves. Their rootkits have already spread across the globe, infecting over half a million of networks.

The Washington Post has posted the news about serious security flaws in Sonys rootkits, allowing any web page that the user subsequently visits, to download, install and run any code it likes. Microsoft has also officialy stated that the rootkit CDs are a security risk and added a detect and removal signature to their Windows AntiSpyware.

Spyware Sony seems to breach copyright
Sony to pull controversial CDs
Welcome to planet Sony
Anti-malware engineers at Microsoft, Sony DRM

No comments: