« Sony backs down | Main | The Beazley-Howard axis »
November 05, 2005
On not trusting Sony
Remember we said that we weren't proposing to lift our black ban on Sony BMG products, because the company had lost our trust? Fred Nerk accuses us of engaging in a vendetta. He couldn't be more wrong. A long career in journalism has taught Bleeding Edge that once an individual or company lies to you, hides something from you or tramples over your rights, they're likely to do it again. Well, it turns out that Princeton professor Ed Felten has had a look at the software update that Sony claims removes the DRM cloaking technology that upset most people who know anything about rootkits.
According to Ed, it doesn't just do what Sony suggests: "The update is more than 3.5 megabytes in size, and it appears to contain new versions of almost all the files included in the initial installation of the entire DRM system, as well as creating some new files. In short, they’re not just taking away the rootkit-like function — they’re almost certainly adding things to the system as well. And once again, they’re not disclosing what they’re doing."
Ed's view is pretty much identical to ours: "No doubt they’ll ask us to just trust them. I wouldn’t. The companies still assert — falsely — that the original rootkit-like software 'does not compromise security' and '[t]here should be no concern' about it. So I wouldn’t put much faith in any claim that the new update is harmless. And the companies claim to have developed 'new ways of cloaking files on a hard drive'. So I wouldn’t derive much comfort from carefully worded assertions that they have removed 'the … component .. that has been discussed'."
Posted by cw at November 5, 2005 09:03 AM
Comments
Mark Russinovich's Sysinternals blog has a update on the Sony DRM issue. In this post he goes through how and what the software update performs on a system affected by this problem.
The scary part is that the software actually does a 'Phone Home' on the internet tracking the title ID of the CD and posting your internet IP address back to a Sony website.
On a NPR.org news item
Thomas Hesse president of Sony BMG's Global Digital Business division state the following two quotes:-
“Most people I think don't even know what a root kit is so why should they care about it” and
“No information ever gets gathered about the user’s behaviour, no information ever gets communicated back to the user. This is purely about restricting the ability to burn MP3 files in an unprotected manner”
An offical reply from XCP Support has also been posted on the latest Sysinternals post.
http://www.sysinternals.com/blog/2005/11/more-on-sony-dangerous-decloaking.html#113115114916278358
Posted by: Stephen at November 5, 2005 12:55 PM
...once an individual or company lies to you...
"You look great in that suit, honey... now let's go, we're late..."
"This DRM software is a ROOTKIT!!! (Well, not really, but it _could_ be part of something that might be a rootkit if some "crackers" already got into your computer and decided to use their access to make this into a rootkit (rather than doing all the other things they could conceivably far more easily do))."
"I'm just finishing up my article now, Mr. Editor..."
Is there _anyone_ you trust, Charles?
Posted by: Fred Nerk at November 5, 2005 02:54 PM
Fred, have you noticed how hollow the words 'media beat up' sound as you say them?
How many times do you need to be slapped in the face before you decide not to stick your neck out?
The fact is Sony have deceived their paying customers.
The end result now is that the only way for these customers ensure that they can play Sony/BMG music on their PC/MP3 player (without adding potentially harmful software that can't be uninstalled) is to use a P2P service to download it.
That's my favourite kind of irony!
Posted by: ajm at November 5, 2005 05:14 PM
For the sake of clarity when I say "...slapped in the face..." of course, I'm refering being slapped in the face by a business.
Posted by: ajm at November 5, 2005 05:28 PM
This is not just Sony telling a lie. There is a pattern here and the pattern is one of systematic deceit.
It is clear Sony is deliberately pursuing a policy that has as central components (a) interfering with consumers hardware and software without their knowledge (b) not disclosing, and even misleading, consumers about what they are doing (c) flagrantly violating people's privacy (apparently on the basis that their rights are greater than yours, ie a human being has less rights than a company)
To not trust someone because in a moment of weakness they lied to you is harsh but not unreasonable. To trust or forgive an impersonal company dedicated to profit, that has a policy of systematic deceit and manipulation, is plain foolishness.
The message remains simple - Don't buy Sony, and, if you can, contribute to undermining and exposing their dirty tricks.
Posted by: tflip at November 7, 2005 03:42 PM
Skype is Malware that allows hackers to run malicous code on your home PC.
http://www.channelregister.co.uk/2005/11/07/skype_vuln_analysis/
A security bug in the Skype for Windows means the software can be crashed and forced to execute arbitrary code through a buffer overflow when presented with malformed URLs in the Skype-specific URI format callto:// and skype://. Skype can also be made to execute arbitrary code via the importation of a maliciously formated VCARD (an electronic business card format).
A second security vulnerability covers a heap-based buffer overflow security flaw that is not restricted to Windows PCs and hits Skype across all supported platforms.
Regardless of efforts to correct these vulnerabilities both Skype and Yahoo can no longer be trusted and have endangered large numbers of computers. Do not use these service providers.
Posted by: Stuart at November 8, 2005 01:58 PM
I'll go along with the "misleading" tag for the sake of argument -- although it's all in the EULA I'll accept that most users don't read them and therefore "weren't told".
But where do you get this:
...flagrantly violating people's privacy...
Not even the most paranoid of Mark Russinovitch's fantasy "could/might/maybes" about this software came up with anything about any personal details being sent to anyone. Stephen's comment above is a flat-out misrepresentation of what Mark said.
Thinking more about the way this has been represented in even the cleverer portions of the press, this last is actually the thing that irks me most. After Y2K, the computer press has been largely an island of sanity compared to the popular press, where every virus is a "killer flu" and every criminal is a "crime wave".
But now, five years later, and that's changing. This isn't poorly-designed DRM, it's a !!!ROOTKIT!!! We don't put pressure on Sony BMG to provide an uninstaller, we scream !!!BLACK BAN!!!
People (rightly) stopped believing the IT guy after Y2K, and that trust has taken years to restore.
I wonder what will happen after the world spectacularly fails to end this time?
Posted by: Fred Nerk at November 8, 2005 08:14 PM
I think we can say Fred, that as far as Sony's DRM software is concerned, the world has now ended. Spectacularly.
Posted by: cw at November 12, 2005 03:46 PM