Sony BMG has done a marvellous job of dealing with fallout from secretly installing spyware on consumers' machines - but now unfortunately it has attracted the attention of New York's Attorney General Eliot (the Blitzer) Spitzer.

Spitzer's office found that despite Sony's claim that it had recalled the affected products Sony's dodgy CDs were still available in various New York stores including BestBuy, Circuit City, Sam Goody, WalMart and Virgin Megastore.

Spitzer said: "It is unacceptable that more than three weeks after this serious vulnerability was revealed, these same CDs are still on shelves, during the busiest shopping days of the year." He told consumers to take CDs back to retailers for a refund.

The CDs contain malware which secretly installs itself onto your computer if you play the disc. This could leave your machine more at risk from hack attacks.

Spitzer has not ruled out further legal action against the music giant.

California and Texas have already filed lawsuits against Sony.

Spitzer earned his reputation by forcing Merrill Lynch and other investment banks to do a better job of separating their supposedly independent research from investment activities.

More details from BusinessWeek . (http://businessweek.com/technology/content/nov2005/tc20051128_573560.htm)

Much of the cricitism of Sony is that it failed to act quickly enough when the problem became clear. This is likely to get worse with today's news that Finnish security firm F-Secure warned Sony about problems with its software on 4th October. This was followed by a more detailed report on 17 October.

A few days later, 20 October, a conference call was held between First4Internet, which wrote the rootkit for Sony, F-Secure and Sony. F-Secure claims that Sony decided at that point to keep things quiet. At the end of October the vulnerability was found, and published, by software engineer Mark Russinovich.

More details on BusinessWeek here. (http://www.businessweek.com/technology/content/nov2005/tc20051129_938966.htm)®

Related stories

Hacker cracks Netflix copy restrictions (9 August 2007)
http://www.theregister.co.uk/2007/08/09/netflix_drm_is_cracked/
How fat is my DRM? (20 December 2006)
http://www.theregister.co.uk/2006/12/20/sony_rootkit_drm_settlement/
Judge approves Sony rootkit settlement (23 May 2006)
http://www.theregister.co.uk/2006/05/23/sony_rootkit_settlement/
Researcher: Sony BMG rootkit still widespread (16 January 2006)
http://www.theregister.co.uk/2006/01/16/sony_bmg_rootkit_still_widespread/
Sony 'rootkit' settlement clamps down on DRM (29 December 2005)
http://www.theregister.co.uk/2005/12/29/sony_settles_rootkit/
Sony BMG 'diligently re-evaluates' CD anti-piracy tech (12 December 2005)
http://www.theregister.co.uk/2005/12/12/sony_anti-piracy_review/
Intel readies rootkit- rooting hardware (9 December 2005)
http://www.theregister.co.uk/2005/12/09/intel_anti-rootkit_chip/
SonyBMG backtracks on buggy bug fix (9 December 2005)
http://www.theregister.co.uk/2005/12/09/sony_mediamax_problems/
Sony opens up over another CD security hole (7 December 2005)
http://www.theregister.co.uk/2005/12/07/sony_cd_security/
Music biz to 'hijack' Europe's data retention laws (25 November 2005)
http://www.theregister.co.uk/2005/11/25/data_retention/
Sony fiasco: More questions than answers (23 November 2005)
http://www.theregister.co.uk/2005/11/23/sony_drm_questions/
Texas puts Sony BMG in its sights (22 November 2005)
http://www.theregister.co.uk/2005/11/22/texas_sues_sony_bmg/
Gaffer tape defeats Sony DRM rootkit (21 November 2005)
http://www.theregister.co.uk/2005/11/21/gaffer_tape_trips_up_sony_drm/
Sony DRM uninstaller 'worse than rootkit' (17 November 2005)
http://www.theregister.co.uk/2005/11/17/sony_drm_uninstaller_peril/
Sony rootkit DRM: how many infected titles? (15 November 2005)
http://www.theregister.co.uk/2005/11/15/sony_bmg_bodycount/
Sony suspends rootkit DRM (12 November 2005)
http://www.theregister.co.uk/2005/11/12/sony_suspends_rootkit_drm/
Sony hit by lawsuits over root kit (10 November 2005)
http://www.theregister.co.uk/2005/11/10/sony_sued_for_rootkit/
Sony digital boss - rootkit ignorance is bliss (9 November 2005)
http://www.theregister.co.uk/2005/11/09/sony_drm_who_cares/