Sony Rootkit Version 2

It appears that Sony is one company that just cannot learn from history. Back in October/November of 2005, Sony employed a DRM scheme based on the Extended Copy Protection (XCP) technology by a company called First 4 Internet Ltd. The uproar that occurred when the public found out that Sony had installed a rootkit in the DRM software that came with a number of their CDs caused Sony to rethink this "we will undermine the security of your computer to protect our own arses" policy that Sony had put in place and they stopped using this rootkit technology. With the number of CD sales that were affected by this unbelievably poor initial decision by Sony to use rootkits (they did, after all, issue a product recall), you'd have thought they'd have learned a very difficult lesson.

Well, not Sony! Most of us even try to learn from the past mistakes made by others, but they seem unable to learn from their own past mistakes.

Scroll forward to August 2007 - not even 2 years after Sony's initial rootkit blunder. Sony has released a range of "Microvault" USB 2.0 sticks with fingerprint security. So what did they decide to do when they wrote the driver for this fingerprint security functionality? That's right - they decided to employ a rootkit to protect it.

Now, I mean, who at Sony needs to get fired for this decision?

The important thing to know about rootkits, for those unfamiliar with them, is that they are used to hide programs and complete directories from the operating system and quite often results in a directory that some AntiVirus software doesn't even know exists and therefore cannot scan. Yup, that's right - the Sony Microvault drivers create a folder on your hard drive - inside the C:\Windows folder - that can be used by all forms of malware to hide from detection.

If you think this is not only a stupid thing for Sony to do, but bordering on criminal, then please send an email using this form and explain your thoughts on Sony's plans to place a rootkit on your computer.

Also, out of interest, on the Microvault site you will find this notice:

An Important Notice for USM-F usersIn case of the notice by Anti-Virus protection found when the Fingerprint Access Software is operated, please download the latest version of the Fingerprint Access Software for your update to avoid this symptom.USM-F : http://www.sony.net/Products/Media/Microvault/usm-f.html

Of course, this software is also going to place a rootkit on your computer. If you want to read more about this new Sony rootkit, have a read of the F-Secure Weblog where they mention how it was found and some more information on rootkits.

This is appalling. A company like Sony, especially since they have done this in the past and been sued for it, should know better.

Regards,

The Outspoken Wookie