Text 8032, 87 rader
Skriven 2005-10-31 22:26:04 av Ellen K. (1:379/45)
   Kommentar till text 8026 av Mike '/m' (1:379/45)
Ärende: Re: Sony, Rootkits and Digital Rights Management Gone Too Far
=====================================================================
From: Ellen K. <72322.1016@compuserve.com>

That's really horrible.    :(

On Mon, 31 Oct 2005 19:35:51 -0500, Mike '/m' <mike@barkto.com> wrote in
message <psddm1pmv7sqtna7e0ele0982nproeoi76@4ax.com>:

>
>http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html
>
>===
>Last week when I was testing the latest version of RootkitRevealer (RKR)
>I ran a scan on one of my systems and was shocked to see evidence of a
>rootkit. Rootkits are cloaking technologies that hide files, Registry
>keys, and other system objects from diagnostic and security software,
>and they are usually employed by malware attempting to keep their
>implementation hidden (see my “Unearthing Rootkitsö article from the
>June issue of Windows IT Pro Magazine for more information on
>rootkits)....
>
>Given the fact that I’m careful in my surfing habits and only install
>software from reputable sources I had no idea how I’d picked up a real
>rootkit, and if it were not for the suspicious names of the listed files
>I would have suspected RKR to have a bug. I immediately ran Process
>Explorer and Autoruns to look for evidence of code that would activate
>the rootkit each boot, but I came up empty with both tools. I next
>turned to LiveKd, a tool I wrote for Inside Windows 2000 and that lets
>you explorer the internals of a live system using the Microsoft kernel
>debugger, to determine what component was responsible for the cloaking.
>
>Rootkits that hide files, directories and Registry keys can either
>execute in user mode by patching Windows APIs in each process that
>applications use to access those objects, or in kernel mode by
>intercepting the associated kernel-mode APIs. A common way to intercept
>kernel-mode application APIs is to patch the kernel’s system service
>table, a technique that I pioneered with Bryce for Windows back in 1996
>when we wrote the first version of Regmon. Every kernel service that’s
>exported for use by Windows applications has a pointer in a table that’s
>indexed with the internal service number Windows assigns to the API. If
>a driver replaces an entry in the table with a pointer to its own
>function then the kernel invokes the driver function any time an
>application executes the API and the driver can control the behavior of
>the API....
>
>I entered the company name into my Internet browser’s address bar and
>went to http://www.first4internet.com/. I searched for both the product
>name and Aries.sys, but came up empty. However, the fact that the
>company sells a technology called XCP made me think that maybe the files
>I’d found were part of some content protection scheme. I Googled the
>company name and came across this article, confirming the fact that they
>have deals with several record companies, including Sony, to implement
>Digital Rights Management (DRM) software for CDs.
>
>The DRM reference made me recall having purchased a CD recently that can
>only be played using the media player that ships on the CD itself and
>that limits you to at most 3 copies. I scrounged through my CD’s and
>found it, Sony BMG’s Get Right with the Man (the name is ironic under
>the circumstances) CD by the Van Zant brothers. I hadn’t noticed when I
>purchased the CD from Amazon.com that it’s protected with DRM software,
>but if I had looked more closely at the text on the Amazon.com web page
>I would have known...
>
>
>At that point I knew conclusively that the rootkit and its associated
>files were related to the First 4 Internet DRM software Sony ships on
>its CDs. Not happy having underhanded and sloppily written software on
>my system I looked for a way to uninstall it. However, I didn’t find any
>reference to it in the Control Panel’s Add or Remove Programs list, nor
>did I find any uninstall utility or directions on the CD or on First 4
>Internet’s site. I checked the EULA and saw no mention of the fact that
>I was agreeing to have software put on my system that I couldn't
>uninstall. Now I was mad....
>===
>
>
>The entire article is very worth the read.
>
> /m
>
>
>p.s. first saw mention of this on /.
>http://it.slashdot.org/article.pl?sid=05/10/31/2016223&tid=172&tid=158
>
>

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)