User User name Password  
   
Wednesday 15.10.2008 / 10:25 PM
Search:        In English   Suomeksi   På svenska
afterdawn.com > news > trojan takes advantage of sony bmg drm
Show topics
News
News

Trojan takes advantage of Sony BMG DRM

10 November 2005 11:29 by James "Dela" Delahunty | 36 comments

Trojan takes advantage of Sony BMG DRM The uproar about the Digital Rights Management (DRM) technology in use on some CDs distributed by Sony BMG is set to heat up again following the confirmation that a trojan has now appeared that takes advantage of the DRM's file hiding capabilities. It was picked up by Sophos in an email that poses as an email from a British magazine. Here is what the body of the text is...

"Hello, Your photograph was forwarded to us as part of an article we are publishing for our December edition of Total Business Monthly. Can you check over the format and get back to us with your approval or any changes? If the picture is not to your liking then please send a preferred one. We have attached the photo with the article here."

On opening the attachment, a file with the name $sys$drv.exe is copied to the victims Windows system directory, if the XCP copy protection has been installed on the system. "This means, that for systems infected by the Sony DRM rootkit technology, the dropped file is entirely invisible to the user. It will not be found in any process and file listing. Only rootkit scanners, such as the free utility RootkitRevealer, can unmask the culprit," warns Ivan Macalintal, a senior threat analyst at security firm Trend Micro.

Finnish anti-virus company F-Secure Corp. said that the trojan is a "bot program" which is designed to force the victims machine to connected to an IRC server. The attacker then has complete control over the system with the ability to create, edit and delete files and directories, install new software etc. Commonly, these bots are used in huge numbers to carry out attacks. They are also commonly used to serve pirated material on IRC "warez" channels.

Sources:
The Register
Washington Post


Permalink to this article

Get AfterDawn's news to your favourite feed reader! Share this story with your friends!
 

 
Related articles:

  • Judge Grants Final Approval for Sony BMG CD Settlement (24 May 2006)
  • Sony BMG to re-evaluate CD protection (12 December 2005)
  • Another lawsuit filed against Sony (3 December 2005)
  • XCP CDs still on store shelves (30 November 2005)
  • Sony BMG was warned about XCP (29 November 2005)
  • Sony BMG sued by Texas (21 November 2005)
  • iPod-compatible copy protected CDs from EMI (20 November 2005)
  • Microsoft AntiSpyware to target XCP (15 November 2005)
  • Sony quits making XCP protected CDs (14 November 2005)
  • Sony BMG hit by lawsuits over XCP (10 November 2005)
  •  

    « Previous news article
    NBC and CBS will offer TV shows for 99c
    Next news article »
    Sony BMG hit by lawsuits over XCP
     Post your comment
    Discuss this article!  There are more user comments available, read them here
    Mr-Movies (Member) 11 November 2005 10:17 Send private message to this user   
    Just because you can find it doesn't mean you can remove it easily.

    I had two zero length files dropped on my desktop when downloading a couple of files. They were Trojans that were attributed ASH. Since I enable viewing of hidden and system files it showed up faintly on my Desktop. I couldn't change the attributes or delete them even when booting into PURE DOS or booting using Sysinternals. In DOS I couldn't even see or find the files Sysinternal would find them but was not able to delete or change their attributes. I didn't try a raw disk editor I'm sure that would have worked instead I choose to reformat and install Windows all over.
    davolente (Newbie) 11 November 2005 11:20 Send private message to this user   
    Re: retec (Newbie) 11 November 2005 9:04
    Slightly off-topic, but I had the same trouble with audio. Copied privately-recorded reel-to-reel tapes (good old analogue - obviously!) on to mini-disc. Did some rudimentary editing (as you can with Mini-Disc) and digitally copied it on to CD using a stand-alone CD recorder. Fine, until I tried to do a third-generation digital copy from that CD on my stand-alone kit and the SCMS (Serial Copy Management System) kicked in and arrogantly told me I couldn`t do it. Damn cheek! "That`s what you think", I thought and promptly did it on the PC. At what stage was the SCMS flag inserted, I wonder? And why should it have done so at all, if the original material was analogue?
    Mr-Movies (Member) 11 November 2005 11:33 Send private message to this user   
    It is possible you have your rights management set which would then do that on your PC. I turn off all protection schemes MS likes to invoke and is set by defualt.
    davolente (Newbie) 11 November 2005 12:16 Send private message to this user   
    Re: Mr-Movies (Junior Member) 11 November 2005 16:33
    I think you mis-read my post. This all happened on stand-alone hi-fi equipment - not on the PC. I actually got my final third generation copy fine by doing it on the PC. No problem. My gripe is that the SCMS cut in on the hi-fi gear when the original material was my own, personal, private analogue recordings. (Of a birthday party as it happens!) Why the hell should the equipment deny me making as many copies as I wish of my own stuff? If I didn`t have a PC, I wouldn`t have been able to do it.
    Mr-Movies (Member) 11 November 2005 12:46 Send private message to this user   
    Sorry davolente,

    Your right I thought you had the same problem on the PC.

    So your SA recorder is inserting copy protection so that you can't make multiple copies, WONDERFUL you got to love that. I wonder if my LiteOn does that I've never tried doing that, Hummm you just have to love Sony. I wonder if you can get a modified firmware to fix your problem my guess is you can. It might be worth looking for a flash disc for that.

    Again my mistake on the misread sorry...
    davolente (Newbie) 11 November 2005 13:24 Send private message to this user   
    Mmmm. How did you guess the Mini-Disc recorder was a Sony, huh? Mind you, I have experimented with just my two stand-alone hi-fi CD recorders (Philips and Pioneer), connecting them to other play-back decks in the house and I still get the SCMS block on a third-generation digital copy, even though, once again, the original source was my old analogue tapes. I fail to see why that should be. I would assume that the SCMS flag would only come from a digital source, such as a commercial CD. The SCMS obviously assumes I`m up to no good, regardless!
    sirenia (Junior Member) 11 November 2005 14:08 Send private message to this user   
    retec could you tell me about this program you found on the internet, i have had the same problem i taped my sons allstar little league game and promised the parents copies on dvd i made one after hours only not to be able to copy it, i certainly dont want to do it from scratch for 12 other people. Thanks in advance.
    Mr-Movies (Member) 11 November 2005 14:09 Send private message to this user   
    I beleive it is your SA recorders that are putting the DRM on your copy and when you try to back them up again it is stopping you as if you are cheating, no matter if the original source was anolog or digital.

    If it was digital and had rights management then it might block you right away.

    I assumed you were talking about Sony because this is about Sony products you didn't say in your post of course.
    Mr-Movies (Member) 11 November 2005 14:25 Send private message to this user   
    sirenia, Try this it is free and should work well plus it is really simple to use.

    DVDFab Decrypter is a simple version of DVDFab Express . It copies entire DVD movie to hard disk, and removes all the protections (CSS, RC, RCE, Macrovision, UOPs and Sony ARccOS) while copying.

    DVDFab Decrypter v2.9.5.2
    [http://www.afterdawn.com/software/video_software/dvd_rippers/dvdfab_decrypter.cfm]
    wild77 (Inactive) 11 November 2005 15:41 Send private message to this user   
    F**K SONY and any other corporation that will sink to this level because of there greed!

    They will never get any of my MONEY!

    It is also rumored that SONY is working on technology for the PS3 that will only let you play your game on the first console it is used with.So when your box dies all your games will be useless!

    phantasee (Newbie) 11 November 2005 18:41 Send private message to this user   
    If you play a game on your PS3, it'll only work on that PS3? Sorry, but that's so bullshit it's not even funny. That's a rumour that shouldn't be spread.
    sirenia (Junior Member) 11 November 2005 19:14 Send private message to this user   
    Thanks I will give it a try it will be a blessing if it works, i dont want to have to make all these copies the hard way, and that is how i got to watch the game i bribed one of the other parents to tape it and i would make them all a copy yikes!!!!!!! thanks again.
    evilh0ly (Senior Member) 11 November 2005 19:27 Send private message to this user   
    anyone know that AnyDVD will prevent the rookit from download at the first place. god i love anydvd
    wild77 (Inactive) 11 November 2005 20:37 Send private message to this user   
    Edit double post

    This message has been edited since posting. Last time this message was edited on 11 November 2005 21:38

    wild77 (Inactive) 11 November 2005 20:38 Send private message to this user   
    Quote:
    If you play a game on your PS3, it'll only work on that PS3? Sorry, but that's so bullshit it's not even funny. That's a rumour that shouldn't be spread
    I found this link at Doom9 a pretty reliable source for news SONY can shove there PS3 and BLU-RAY right up there A**

    Read this
    http://www.theinquirer.net/?article=27568

    Run4two (Junior Member) 12 November 2005 5:48 Send private message to this user   
    "build it up, now take it apart...
    Climbed up real high, now fall down real far..."

    Never thought that NIN song Wish was about Sony, but it is.

    I'm done with Sony. My next ________ will be anything but Sony! Fill in the blank with anything they make. I hope they get their head handed to them over their deceat, hipocricy, and greed!
    Auslander (AfterDawn Addict) 12 November 2005 7:48 Send private message to this user   
    that's it. i officially hate Sony. F**k you, Sony, you're getting no more of my money.
    Mr-Movies (Member) 12 November 2005 10:54 Send private message to this user   
    Its funny Sony has been bad for years now, but no one was complaining before the DRM attack. My suggestion is to not just buy anything from anyone because once you had good luck with them. Also I have never found that one company does everything great but there are many people that consume in that fashion. If Sony wakes up and changes their ways I’ll buy from them again however it will be some time before they will change enough.

    All companies seem to cycle in there product value and quality as it seems they get greedy when times are good and try to live off their laurels in which they get crappy.
    OzMick (Senior Member) 12 November 2005 11:57 Send private message to this user   
    Hey, there were more than a few of us who weren't buying from Sony a long time before this happened. Their attitude towards customers has been shithouse for a very long time. Nobody remembers the whole PSP faulty button problem with the original design. One of the buttons refused to work, and Sony's response was not to rectify the situation, but told people to stick it, that was how the device was designed, and they should adapt. And then there were the dodgy first releases of their DRU line of dual format burners... Then there is the crappy stereo I bought from them when I was like 12 that cost $450 and was pretty much a steaming piece of crap. Then the walkman I got with the dodgy laser 12 months later.....
    Run4two (Junior Member) 12 November 2005 13:29 Send private message to this user   
    OzMick,
    Please elaborate,
    What do you mean by the first DRU burners being dodgy. I have burnt over 700 on my DRU 500 with both formats, both recordable and rewriteble. It's the most amazing piece of equipment I've bought. That being said, it's one of my last from Sony. No more. No more. I will look to make sure that Sony will not profit from anything I buy from this day on. Quite a shame, I hope my aunt doesn't lose her job at the Sony plant nearby in Ranch Bernardo, Calfornia.
    Mr-Movies (Member) 12 November 2005 14:29 Send private message to this user   
    OzMick see what I mean, I agree with you the DRU-500 was doggy and very expensive I could get a LiteOn much cheaper and it is better but people still loved getting ripped off by Sony. One of my friends bought that burner and has had plenty of problems with it mean while my LiteOn kept doing what his couldn't. Then he even went out and bought the 700 as if he didn't learn on the last one.
    freshguy (Member) 12 November 2005 19:37 Send private message to this user   
    I am not impressed with the overall quality of Sony products. To be fair, I will concede that their VAIO line of computers is reasonably decent. Other than that, in my opinion the performance level of Sony products is at the low end of the scale. Even their renowned Playstation has proven to be less than durable. I went through 3 Playstations and am currently on my 2nd PS2.
    The sound quality of Sony audio components is comparable to great brands such as "K-Pro" and "Valu-King". Sony is to Marantz and Denon as what MD 2020 and Thunderbird are to Dom Perignon.

    Having said that, Sony would be wise to rethink this arrogantly agressive strategy of infecting our computers and other electronic devices with their immoral cybervermin. These activities are a disgusting slap in the face to all consumers, and should in fact prove to be illegal, at least in a court not affected by corporate corruption.
    Mr-Movies (Member) 12 November 2005 20:18 Send private message to this user   
    I have a friend with a VAIO Intel 677MHz notebook and we tried to upgrade his RAM which is 144 pin standard stuff supposively but when we put the new memory in it wouldn't run. The memory that was in there was double sided cheap memory and this was single sided decent stuff. It ran in my Trogon AMD K6 300 no problem and my old notebook would run his memory. So you tell me is VAIO good?
    freshguy (Member) 12 November 2005 22:04 Send private message to this user   
    I don't think that I ever used the word "good" in reference to Sony anywhere in my post. To answer your question, I can only go by my own experience but I am currently using a VAIO desktop. It runs XP with a P4 2.4 GHz cpu and 512 Meg of RAM. In the 2.5 years that I've used it I haven't had anything too terrible go wrong with it so I think that would qualify as "reasonably decent".
    If you take a glance back at my previous post you will find that I did not have anything good to say about Sony, and in fact Mr-Movies, I pretty much said that they are a company run by BLEEPheads, that produces a lot of low-grade crap.

    OS Name Microsoft Windows XP Home Edition
    Version 5.1.2600 Service Pack 2 Build 2600
    OS Manufacturer Microsoft Corporation
    System Manufacturer Sony Corporation
    System Model PCV-RZ22G(UC)
    System Type X86-based PC
    Processor x86 Family 15 Model GenuineIntel ~2394 Mhz
    SMBIOS Version 2.3
    Locale United States
    Time Zone Eastern Standard Time
    Total Physical Memory 512.00 MB
    Available Physical Memory 118.00 MB
    Total Virtual Memory 2.00 GB
    Available Virtual Memory 1.96 GB
    Page File Space 1.97 GB
    OzMick (Senior Member) 13 November 2005 10:49 Send private message to this user   
    What I mean by saying that they were dodgy:
    Back in the day when I was looking for a burner I made the decision that I was going to be patient and wait for the new dual-format (+/-) burners to come out before committing to one or the other. And then WOW! The Sony line was the first to hit the stores, and I almost got swept up and bought one at the markets straight away. Luckily, there was a bit of a lag between Australia receiving them, so I hit the forums and read up a bit and came across an absolute ton of people complaining about noisy drives or media incompatibilities. And seeing as media was still pretty expensive back then, I figured I could wait a little while. Then the Pioneer drives came out. Haven't had a worry in the world with that one, and they get recommended by me to everyone I know. But then yeah, LiteOn have theirs around now, so they're always a great option too.

    "I love it when a plan comes together..."
    John "Hannibal" Smith
    Reasons? (Inactive) 13 November 2005 13:15 Send private message to this user   
    Haven't checked this threa din awhile but, to the one who posted underneath mine- Virus scanning in your e-mail should show the virus, even id it's a rootkit, because it hasn't had a chance to hide itself yet, it's just a single file attachment.
     Post your comment
     

    Subscribe to our newsfeed

    Get the latest headlines delivered directly to your favourite RSS reader or content aggregation service by using the links below.

    AfterDawn.com: News - RSS feed
    Add to Google
    Add to My Yahoo!
    Add to MyMSN

    Search for headlines

    Search through our news archive.

    Last week's most popular software downloads

    Digital video: AfterDawn.com | AfterDawn Forums | DVD X Copy Forums
    Music: MP3Lizard.com
    Gaming: Blasteroids.com | Blasteroids Forums
    Software: Software downloads
    Blogs: User profile pages
    RSS feeds: AfterDawn.com News | Software updates | AfterDawn Forums
    International: AfterDawn in Finnish | AfterDawn in Swedish | download.fi | fin.MP3Lizard.com
    Navigate: Search | Site map
    About us: About AfterDawn Ltd | Advertise on our sites | Rules, Restrictions, Legal disclaimer & Privacy policy
    Contact us: Send feedback | Contact our media sales team
     
      © 1999-2008 by AfterDawn Ltd.