Sony closes in on new program to cleanse PCs

[saraphen]

LOS ANGELES — The flap over Sony BMG Music Entertainment's infected copy-protected CDs shows few signs of abating.

Consumers, bloggers and lawyers are furious at the giant music label. On Nov. 14, Sony BMG said it would recall nearly 5 million CDs discovered to be susceptible to viruses from its Extended Copy Protection, or XCP, software.

When one of the CDs is played on a Windows computer, the XCP software controls how many times the CD can be copied. The software was found to have hidden files that could attract viruses.

Sony at first offered an uninstall program to get rid of the software, but that was found to attract viruses. On Nov. 18, the label said that it planned to release an updated virus-free uninstall program. Almost three weeks later, that program is scheduled to be released Monday on Sony BMG's website. Many of the infected CDs are still in record stores.

~~~~

Sony says it's been working diligently on getting the uninstaller ready. But "security is more important than speed," Thomas Hesse, president of Sony's Global Digital Business division, said Friday. "I have the best security experts triple-checking it."

When Sony announced the XCP recall, it said it would replace the infected CDs with new, non-protected versions.

In the interim, many of the artists with XCP CDs have seen their sales tumble.

http://www.usatoday.com/tech/news/co...-cd-flap_x.htm

I found what appears to be a solution on geekstogo.com, but I would rather wait for the solution from Sony...and give it a few weeks while the "early adopters" give it a try.

[JamieC]

If there's a will there's a way. This I've gotta see.

[Corals]

Sony BMG urges consumers to download security fix for CDs

LOS ANGELES (AP) - Sony BMG Music Entertainment said Tuesday some 5.7 million of its CDs were shipped with anti-piracy technology that requires a new software patch to plug a potential security breach in computers used to play the CDs.

The security vulnerability was discovered by online civil liberty group Electronic Frontier Foundation and brought to the attention of Sony BMG, which has been under fire in recent weeks over security issues with an unrelated CD copy-protection plan.

The company said Tuesday it brought the issue up with the MediaMax software maker, SunnComm Technologies Inc., which has developed a software patch to fix the problem.

``It's a security vulnerability and therefore needs to be dealt with,'' said Thomas Hesse, president of Global Digital Business for Sony BMG.

The MediaMax Version 5 software was loaded on 27 Sony BMG titles, including Alicia Keys' ``Unplugged,'' and Cassidy's ``I'm A Hustla.''

CD copy-protection software is generally designed to restrict how many times computer users can make duplicate versions of a CD in an effort to stem piracy.

A computer security firm working with EFF discovered the security issue with the MediaMax Version 5 CDs and how it affects computers running Microsoft Corp.'s Windows operating system.

Windows allows for different levels of access to a computer. The copy-protection software installs a file folder in the computer that could allow a guest user to gain unauthorized access to the computer.

``It's a privileged escalation attack,'' said Kurt Opsahl, an EFF staff attorney. ``On Windows you can have users with different privileges, and because of security weakness in the permissions of a folder, it allows a low-ranked user to act as a high-ranked user.''

The problem is commonly found on many computer programs, said Robert Horton, director of NGS Software, which tested SunnComm's software fix for the record company.

The MediaMax problem differs from the security hole discovered last month with the so-called XCP technology by First 4 Internet Ltd. of Oxfordshire, United Kingdom, that Sony BMG placed on more than 50 other CD titles. That copy-protection effort was found to leave computers vulnerable to hackers. Read More

http://www.siliconvalley.com/mld/sil...l/13347561.htm

[saraphen]

I'll give it a few weeks to age. I don't want a fix that turns out to be worse than the initial problem.

[Corals]

SonyBMG backtracks on buggy bug fix
By Team Register
Published Friday 9th December 2005 11:14 GMT

SonyBMG’s efforts to regain some credibility with PC users came unstuck again after it admitted that a patch for flawed content protection software included with some its CDs actually creates more problems for users.

The academics who have uncovered the latest security hole say the only way Sony can dig itself out is to recall all the CDs that shipped with the flakey software.

The hapless media giant snuggled up to the Electronic Frontier Foundation earlier in the week to admit that Sunncomm MediaMax content protection software on some of its CDs could leave users’ PCs open to hijacking by unauthorised users. It instructed users to download a patch from MediaMax.

Now, academics at Princeton University have found that the patch itself suffers from the same bug (http://www.freedom-to-tinker.com/?p=942), though in a slightly different way. They have advised users to not install the patch and indeed to not insert the affected disk in a PC under any circumstance, and the EFF and Sony have gotten behind them.

Professor Ed Felten and Alex Halderman the problem is “just as bad” as the DRM rootkit carried on other CDs and which caused a furore last month.

They go on to say that each CD sitting on a shelf is effectly a ticking timebomb, and the only way for Sony to really sort the problem is to recall all the affected disks.

Only the very paranoid would suggest that advice to not insert an audio CD into a PC delivers exactly the level of "content protection" Sony and the other music giants have been gunning for all this time.
http://www.channelregister.co.uk/200...amax_problems/
....................

Saraphen, I think you were right.

[saraphen]

Originally Posted by Corals

Saraphen, I think you were right.

I was hoping that I wouldn't be. A recall won't fix the security exposure on my PC.