Feeds

Sophos develops Sony DRM unmasking tool

Unplugging Sony's Root-man

Security for virtualized datacentres

UK security firm Sophos plans to release a tool which will detect the existence of Sony's DRM copy-protection rootkit on Windows computers, disable it, and prevent it from re-installing.

The move follows the discovery of the first malware (a Trojan called Breplibot) that takes advantage of Sony-BMG's use of rootkit technology in DRM software bundled with its music CDs to mask its presence on infected systems.

"Sophos is acting on customers' concern that the software on Sony's CDs is introducing a vulnerability which hackers and virus writers are able to exploit," explained Cluley. "We will give customers the ability to determine if their computers suffer from the vulnerability and remove it if necessary." The free download should be available today.

Sony-BMG's rootkit DRM technology masks files whose filenames start with "$sys$". A newly-discovered variant of of the Breplibot Trojan takes advantage of this to drop the file "$sys$drv.exe" in the Windows system directory. Once loaded in this way the malware will be invisible to anti-virus scanners. Only rootkit scanners, such as the free utility RootkitRevealer, can unmask the malware.

Sophos's tool will remove this cloaking behaviour but will not remove the software components installed by Sony-BMG, the deletion of which might cause system instability. But this very cloaking means it may not be obvious to users that they need the tool. Around 20 CDs from Sony-BMG which have shipped an estimated 2m copies around the world feature the controversial DRM technology, developed by UK security developer First4Internet. Sophos obtained advice from First4Internet in developing its tool.

We wanted to ask First4Internet and Sony-BMG what they intended to do to make sure their copy-protection technology wasn't abused by virus writers but neither returned our calls this afternoon. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.