Sony has bowed to consumer pressure and will withdraw all CDs encumbered with its notorious 'rootkit' DRM, XCP. Sony says around 4m XCP CDs have been manufactured. For the 2.1m CDs already sold, Sony will institute an exchange program, with details to follow later in the week.

Sony remains committed to releasing all CDs next year with some form of copy restriction measures.

How many people have been infected with XCP? DNS hacker (http://www.theregister.co.uk/2005/02/14/codecon_2005/) Don Kaminsky investigated by querying DNS servers with the address XCP uses to 'phone home', and found traces on over half a million servers (http://www.doxpara.com/?q=sony).

Of these 217,296 were from Japan, 130,519 from the USA, and 44,421 from the United Kingdom. And one from Afghanistan.

The figure represents a minimum, as some domains, such as AOL, will have millions of users, but will register with a domain name server just once in a give time frame.

Sony's first 'fix' for XCP potentially opens the door for websites to take control of a PC, a Finnish researcher Muzzy has noticed. An ActiveX control installed by First4Internet Ltd, the British company that devised XCP, allows remote systems full access. First4Internet has since scrapped this method of delivery and now downloads an executable without this particular vulnerability. Princeton academic Ed Felten has a test page, here (http://www.cs.princeton.edu/~jhalderm/xcp/detect.html), where you can test if the CodeSupport ActiveX control is present on your system. ®

Related stories

ISP typo pimping exposes users to fraudulent web pages (20 April 2008)
http://www.theregister.co.uk/2008/04/20/kaminsky_demo_at_toorcon/
How fat is my DRM? (20 December 2006)
http://www.theregister.co.uk/2006/12/20/sony_rootkit_drm_settlement/
Intel readies rootkit- rooting hardware (9 December 2005)
http://www.theregister.co.uk/2005/12/09/intel_anti-rootkit_chip/
Sony opens up over another CD security hole (7 December 2005)
http://www.theregister.co.uk/2005/12/07/sony_cd_security/
Sony fiasco: More questions than answers (23 November 2005)
http://www.theregister.co.uk/2005/11/23/sony_drm_questions/
Sony unsinged by rootkit CD fiasco (22 November 2005)
http://www.theregister.co.uk/2005/11/22/analysis/
Texas puts Sony BMG in its sights (22 November 2005)
http://www.theregister.co.uk/2005/11/22/texas_sues_sony_bmg/
Gaffer tape defeats Sony DRM rootkit (21 November 2005)
http://www.theregister.co.uk/2005/11/21/gaffer_tape_trips_up_sony_drm/
Sony's CD rootkit infringes DVD Jon's copyright (18 November 2005)
http://www.theregister.co.uk/2005/11/18/sony_copyright_infringement/
Sony DRM uninstaller 'worse than rootkit' (17 November 2005)
http://www.theregister.co.uk/2005/11/17/sony_drm_uninstaller_peril/
Sony in USB lead porn punt shocker (17 November 2005)
http://www.theregister.co.uk/2005/11/17/sony_usb_offer/
Sony rootkit DRM: how many infected titles? (15 November 2005)
http://www.theregister.co.uk/2005/11/15/sony_bmg_bodycount/
Sony suspends rootkit DRM (12 November 2005)
http://www.theregister.co.uk/2005/11/12/sony_suspends_rootkit_drm/
Mac anti-rip code surfaces on Sony BMG CD (11 November 2005)
http://www.theregister.co.uk/2005/11/11/sony_bmg_mac_drm/
Sophos develops Sony DRM unmasking tool (10 November 2005)
http://www.theregister.co.uk/2005/11/10/sony_drm_unmasked/
Sony hit by lawsuits over root kit (10 November 2005)
http://www.theregister.co.uk/2005/11/10/sony_sued_for_rootkit/
First Trojan using Sony DRM spotted (10 November 2005)
http://www.theregister.co.uk/2005/11/10/sony_drm_trojan/
Sony digital boss - rootkit ignorance is bliss (9 November 2005)
http://www.theregister.co.uk/2005/11/09/sony_drm_who_cares/
Hidden DRM code's legitimacy questioned (3 November 2005)
http://www.theregister.co.uk/2005/11/03/secfocus_drm/
Sony to offer patch for 'rootkit' DRM (3 November 2005)
http://www.theregister.co.uk/2005/11/03/sony_rootkit_drm/
Removing Sony's CD 'rootkit' kills Windows (1 November 2005)
http://www.theregister.co.uk/2005/11/01/sony_rootkit_drm/
EMI recalls DRM-encumbered CD (29 September 2005)
http://www.theregister.co.uk/2005/09/29/emi_recalls_drm_cd/