The Register ®

Biting the hand that feeds IT

The Register » Security » Spyware »

Original URL: http://www.theregister.co.uk/2005/11/17/sony_drm_uninstaller_peril/

Sony DRM uninstaller 'worse than rootkit'

By John Leyden
Published Thursday 17th November 2005 16:38 GMT

Hacker websites are using Sony's DRM uninstaller in an attempt to take over Windows PCs. Under pressure, Sony recently released a tool to remove the rootkit technology installed when users play Sony BMG CDs on Windows PCs. This happened after it was shown Sony's DRM code (First4Internet XCP program) created a handy means for hackers to hide malware from anti-virus scanning programs.

Several malware variants have been created that try to hide with the help of the Sony DRM cloaking technology. Coding errors in the malware mean none have been particularly successful. In fact, work by security researchers suggest that a vulnerable ActiveX control (http://secunia.com/advisories/17610) in Sony's DRM uninstaller is a greater security risk than the original Sony rootkit.

The warning (http://www.freedom-to-tinker.com/?p=927), by Ed Felten of Freedom to Tinker, is borne out by the discovery (http://www.websensesecuritylabs.com/alerts/alert.php?AlertID=340) by Websense of exploit websites that attempts to use the trick. Sony has stopped distributing its flawed DRM uninstaller. But that still leaves any user who has downloaded and run the Sony uninstaller program susceptible to attack, providing they can be tricked into visiting hacker sites. So users need to remove the vulnerable ActiveX component as explained here (http://www.f-secure.com/weblog/archives/archive-112005.html#00000709).

To remove the DRM software entirely is a far trickier proposition that security researchers have only partially answered. An expert might (with effort) be able to remove the software but for an average user the situation is quite hopeless, and getting more complicated by the day. ®

© Copyright 2008