Text 8026, 75 rader
Skriven 2005-10-31 19:35:50 av Mike '/m' (1:379/45)
Ärende: Sony, Rootkits and Digital Rights Management Gone Too Far
=================================================================
From: Mike '/m' <mike@barkto.com>


http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html

===
Last week when I was testing the latest version of RootkitRevealer (RKR) I ran
a scan on one of my systems and was shocked to see evidence of a rootkit.
Rootkits are cloaking technologies that hide files, Registry keys, and other
system objects from diagnostic and security software, and they are usually
employed by malware attempting to keep their implementation hidden (see my
“Unearthing Rootkitsö article from the June issue of Windows IT Pro Magazine
for more information on rootkits)....

Given the fact that I’m careful in my surfing habits and only install software
from reputable sources I had no idea how I’d picked up a real rootkit, and if
it were not for the suspicious names of the listed files I would have suspected
RKR to have a bug. I immediately ran Process Explorer and Autoruns to look for
evidence of code that would activate the rootkit each boot, but I came up empty
with both tools. I next turned to LiveKd, a tool I wrote for Inside Windows
2000 and that lets you explorer the internals of a live system using the
Microsoft kernel debugger, to determine what component was responsible for the
cloaking.

Rootkits that hide files, directories and Registry keys can either execute in
user mode by patching Windows APIs in each process that applications use to
access those objects, or in kernel mode by intercepting the associated
kernel-mode APIs. A common way to intercept kernel-mode application APIs is to
patch the kernel’s system service table, a technique that I pioneered with
Bryce for Windows back in 1996 when we wrote the first version of Regmon. Every
kernel service that’s exported for use by Windows applications has a pointer in
a table that’s indexed with the internal service number Windows assigns to the
API. If a driver replaces an entry in the table with a pointer to its own
function then the kernel invokes the driver function any time an application
executes the API and the driver can control the behavior of the API....

I entered the company name into my Internet browser’s address bar and went to
http://www.first4internet.com/. I searched for both the product name and
Aries.sys, but came up empty. However, the fact that the company sells a
technology called XCP made me think that maybe the files I’d found were part of
some content protection scheme. I Googled the company name and came across this
article, confirming the fact that they have deals with several record
companies, including Sony, to implement Digital Rights Management (DRM)
software for CDs.

The DRM reference made me recall having purchased a CD recently that can only
be played using the media player that ships on the CD itself and that limits
you to at most 3 copies. I scrounged through my CD’s and found it, Sony BMG’s
Get Right with the Man (the name is ironic under the circumstances) CD by the
Van Zant brothers. I hadn’t noticed when I purchased the CD from Amazon.com
that it’s protected with DRM software, but if I had looked more closely at the
text on the Amazon.com web page I would have known...


At that point I knew conclusively that the rootkit and its associated files
were related to the First 4 Internet DRM software Sony ships on its CDs. Not
happy having underhanded and sloppily written software on my system I looked
for a way to uninstall it. However, I didn’t find any reference to it in the
Control Panel’s Add or Remove Programs list, nor did I find any uninstall
utility or directions on the CD or on First 4 Internet’s site. I checked the
EULA and saw no mention of the fact that I was agreeing to have software put on
my system that I couldn't uninstall. Now I was mad....
===


The entire article is very worth the read.

 /m


p.s. first saw mention of this on /.
http://it.slashdot.org/article.pl?sid=05/10/31/2016223&tid=172&tid=158

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)