Re: First Virus found that uses Sony Rootkit... in Security http://www.dslreports.com/forum/r14774805 en Thu, 03 Dec 2009 06:29:14 EDT Thu, 03 Dec 2009 06:29:14 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14779356 La Luna :
said by Anonymous See Profile :

Wow is this true?

»crookedtimber.org/2005/11/09/sonys-rootkit/

a Sony executive downplayed the controversy, saying: “Most people, I think, don’t even know what a rootkit is, so why should they care about it?”
He really meant: "Most people, I think, don't even know what a rootkit is, so why should they care about it so we can get away with it."
--
~~~Now and forever, you are a part of me, and the memory cuts like a knife...~~~]]> http://www.dslreports.com/forum/remark,14779356 Thu, 10 Nov 2005 22:15:43 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14778851 Mele20 : Yep. That is true. You can even listen to the recording of him saying it.

»www.npr.org/templates/story/stor···=4989260]]> http://www.dslreports.com/forum/remark,14778851 Thu, 10 Nov 2005 21:10:49 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14778667 Anonymous : Wow is this true?

»crookedtimber.org/2005/11/09/sonys-rootkit/

a Sony executive downplayed the controversy, saying: “Most people, I think, don’t even know what a rootkit is, so why should they care about it?”]]> http://www.dslreports.com/forum/remark,14778667 Thu, 10 Nov 2005 20:45:11 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14778176 sharpy merc : Symantec are chicken , scared to call it SecurityRisk.SonyDRM]]> http://www.dslreports.com/forum/remark,14778176 Thu, 10 Nov 2005 19:31:24 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14778141 nunsuperior : Symantec has definitions for the DRM rootkit as well.

»securityresponse.symantec.com/av···ies.html]]> http://www.dslreports.com/forum/remark,14778141 Thu, 10 Nov 2005 19:26:54 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14778084 ZOverLord : Somebody BUZZ me when the first release of Key-Logger DVD's from First4Internet is released, Will
Ya? ;-)

--
Black, Grey and White Hats Unite here -> »testing.OnlyTheRightAnswers.com]]> http://www.dslreports.com/forum/remark,14778084 Thu, 10 Nov 2005 19:18:15 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14777916 Blackbird :
said by ZOverLord See Profile :

... is it LEGAL to sell Root-Kits for commercial use?
I'm not at all sure there are any laws other than copyright (at least in the US) governing what code somebody can write or how it works. Europe might be another story. What does seem to come under legal scrutiny is how code gets used on other people's computers and what the end effects might be. In this case, the only publicly-identified company to-date using First4Internet code for DRM protection is Sony, and it's Sony's products that are being bought and are fouling peoples' computers. Given the large-settlement, shoot-'em-all mindset of most tort lawyers, of course it's a 'given' that First4Internet will get sucked into courtrooms before it's over. But Sony's pockets are much deeper than First4Internet's, and one can only expect they'll get the primary attention of the lawyers.

But your query is certainly valid and intriguing: "Now, where is it ALSO hiding, in what other company products..."
--
If God wanted us to work with electrons, He'd make them big enough to see...]]> http://www.dslreports.com/forum/remark,14777916 Thu, 10 Nov 2005 18:55:25 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14777721 ZOverLord : What I find Odd about this is few people seem to care where else this stuff is embedded, First4Internet came up with this Root-Kit, the Concept, the Product to be marketed to Sony.

Without the First4Internet Product being marketed, this could never have happened, is it LEGAL to sell Root-Kits for commercial use?

Now, where is it ALSO hiding, in what other company products, and when is somebody going to go after First4Internet for being so STUPID to try and sell Root-Kits on the open market to be embedded in products worldwide?
--
Black, Grey and White Hats Unite here -> »testing.OnlyTheRightAnswers.com]]> http://www.dslreports.com/forum/remark,14777721 Thu, 10 Nov 2005 18:26:27 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14777526 Blackbird : What Sony has yet to figure out, but will before this is all over, is that once you take an extremely legalistic approach to Intellectual Property protection and join in fervent prosecutions of those who copy your products, you'd better be double-dog certain that every single thing you yourself do is above-board, open, and legally unquestionable. The hypocrisy of Sony in all this is not something that will be lost upon juries as the wave of upcoming lawsuits begins to move to trial. To say that a lot of folks will be gunning for Sony is a classic understatement...
--
If God wanted us to work with electrons, He'd make them big enough to see...]]> http://www.dslreports.com/forum/remark,14777526 Thu, 10 Nov 2005 17:57:22 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14777304 paranoidxe : gee..I wonder if Sony would have issued a fix if no one discovered it? hummmm.....OF COURSE NOT.

MSNBC has the story too:
»www.msnbc.msn.com/id/9991596/

I would like to know since the Sony Rootkit is a copy protection scheme, does it prevent the copying of copies for other non-sony audio cds as well?
--
- paranoidxe (txtfiles.org)]]> http://www.dslreports.com/forum/remark,14777304 Thu, 10 Nov 2005 17:27:33 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14776781 SnowyOne : Just a screen shot of something that caught my eye.
Click for full size
Logical sequence of events
]]> http://www.dslreports.com/forum/remark,14776781 Thu, 10 Nov 2005 16:17:52 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14776558 GuruGuy : McAfee added this on Nov 8th.

Just curious, is this in the sigs for BoClean, T Hunter, etc., since technically this is classed as a trojan???
--
GuruGuy]]> http://www.dslreports.com/forum/remark,14776558 Thu, 10 Nov 2005 15:44:53 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14776527 Babar : »www.boycottsony.us/]]> http://www.dslreports.com/forum/remark,14776527 Thu, 10 Nov 2005 15:39:13 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14776319 mrchris :
said by s25 :

Would it be possible to get rid of this if you do a system restore in windows xp?

Quess I'm out of luck if I'm on 98 :( but I won't be getting this thats for sure.
It is possible, as one of the reviewers sysrestored a week old restore point or something.

Edit: »www.amazon.com/gp/product/custom···tart=101

Could the topmost reviewer on this page be our news guy? ;)]]> http://www.dslreports.com/forum/remark,14776319 Thu, 10 Nov 2005 15:03:34 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14776194 anon : No word about any of this on CNN yet. Did a quick site search. Nothing.]]> http://www.dslreports.com/forum/remark,14776194 Thu, 10 Nov 2005 14:46:08 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14776190 NyQuil Kid : Good question, and probably an affirmative on that. What would be of interest is whether Windows creates a restore point automatically before the DRM installation, or whether a user should manually create a restore point.

[8F] The NyQuil Kid
--
[8F] The NyQuil Kid comes into town not looking for trouble... n00bz gang up, but he ain't seein' double,... pulls and draws, his deagles two... n00bz litter the ground you know it's true.]]> http://www.dslreports.com/forum/remark,14776190 Thu, 10 Nov 2005 14:45:35 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14776155 anon : Would it be possible to get rid of this if you do a system restore in windows xp?

Quess I'm out of luck if I'm on 98 :( but I won't be getting this thats for sure.]]> http://www.dslreports.com/forum/remark,14776155 Thu, 10 Nov 2005 14:41:32 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14776015 catseyenu :
said by Link Logger See Profile :

I can't believe that Sony was this far out of step with its consumer market and technology.
It's looking like Sony's been headed this direction since 2001.
»blogs.washingtonpost.com/securit···rne.html
quote:
Sony's Attitude Has a History
Sony CEO Howard Stringer, who kept the audience laughing throughout the night with a battery of quips, said, “Right now it would be possible for us, and I’ve often thought it would cheer me up to do it, you could dispatch a virus to anybody whose files contain us or Columbia records

--
Sometimes we look for straws to grab, sometimes we bend over and grab our ankles]]> http://www.dslreports.com/forum/remark,14776015 Thu, 10 Nov 2005 14:21:33 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14775930 NyQuil Kid : What I found interesting was how this variant (and presumably any future ones) attempts to add itself as a trusted application in the Windows Firewall list. Now while I have seen/heard of other viral infections disabling firewalls, I wonder if any other firewall product would be susceptible or at the very least transparent to this type of modification.

Wonder if Vista's firewall will be better, since it is supposed to monitor outgoing as well as incoming connections.

[8F] The NyQuil Kid
--
[8F] The NyQuil Kid comes into town not looking for trouble... n00bz gang up, but he ain't seein' double,... pulls and draws, his deagles two... n00bz litter the ground you know it's true.]]> http://www.dslreports.com/forum/remark,14775930 Thu, 10 Nov 2005 14:09:32 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14775893 Kayrac : »securityresponse.symantec.com/av···nos.html

note it says this
Creates the following registry subkey:

HKEY_CURRENT_USER\WkbpsevaXImgvkwkbpXSmj`kswXGqvvajpRavwmkjXVqj

adding the following value to it:

"$sys$drv" = "$sys$drv.exe"

Note: Due to bugs in the code, the Trojan attempts, but fails, to create a registry subkey under the following subkey:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Run

looks like it won't be spreading since it can't make itself run :P]]> http://www.dslreports.com/forum/remark,14775893 Thu, 10 Nov 2005 14:04:23 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14774881 pcdebb :
said by aquias0 See Profile :

I found this link highly interesting

»www.amazon.com/gp/product/custom···m02/ref=

It appears that consumers are really willing to "take the fight" to Sony on this one.

By the by, the link came from Alex Eck's Sunbelt blog (»sunbeltblog.blogspot.com/)
wow, the reviews are literally pouring in on that one (and i imagine any other sony cds). I tell you, my trust in Sony anything has been weakened by this episode.
--
babbling | Donate]]> http://www.dslreports.com/forum/remark,14774881 Thu, 10 Nov 2005 11:42:58 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14774805 BQuick : And same news from Kaspersky Newsletter:

1. New backdoor program uses Sony rootkit

Kaspersky Lab, a leading developer of secure content management
solutions that protect against viruses, Trojans, worms, spyware, hacker
attacks and spam announces that a new backdoor program has been
detected. This is the first malicious program to use Sony rootkit
technology to hide its presence in the system.

The media has already written extensively about how Sony BMG applied
rootkit technology to hide and protect DRM components used to prevent
disks from being copied. One highly unfortunate effect of Sony's
decision to use this rootkit was the possibility that malicious programs
might implement the same technology. Kaspersky Lab virus analysts can
confirm that this has now happened.

Today a backdoor program which utilizes the rootkit technology was
detected. Kaspersky Lab classifies the program as
Backdoor.Win32.Breplibot.b. The backdoor was mass mailed using spamming
technologies, and attached to a message which uses classic social
engineering techniques to entice the recipient into launching the
attachment. The attachment allegedly contains a photograph. Once the
user launches the attached file, the backdoor code will penetrate the
victim machine.

Breplibot.b is a file 10240 bytes in size, packed using UPX. When
launching, the backdoor copies itself to the Windows system directory as
$SYS$DRV.EXE. Using this name makes it possible for the Sony rootkit
technology to be used to hide the activity of the malicious program. Of
course, the backdoor's activity will only be hidden if DRM protection,
as used on some Sony Audio CDs, functions on the victim machine.

As usual, Kaspersky Lab warns users to be careful, and not to open email
from unknown senders, or open attachments to suspicious messages.
------------

Great job Sony!Thank you!]]> http://www.dslreports.com/forum/remark,14774805 Thu, 10 Nov 2005 11:31:25 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14774310 aquias0 : I found this link highly interesting

»www.amazon.com/gp/product/custom···m02/ref=

It appears that consumers are really willing to "take the fight" to Sony on this one.

By the by, the link came from Alex Eck's Sunbelt blog (»sunbeltblog.blogspot.com/)]]> http://www.dslreports.com/forum/remark,14774310 Thu, 10 Nov 2005 10:26:06 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14774285 NyQuil Kid :
said by Link Logger See Profile :

I can't believe that Sony was this far out of step with its consumer market and technology...
I can; usually it's the result of pressure from marketing people who haven't the faintest idea how a computer works.

[8F] The NyQuil Kid
--
[8F] The NyQuil Kid comes into town not looking for trouble... n00bz gang up, but he ain't seein' double,... pulls and draws, his deagles two... n00bz litter the ground you know it's true.]]> http://www.dslreports.com/forum/remark,14774285 Thu, 10 Nov 2005 10:22:43 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14773999 Link Logger : I can't believe that Sony was this far out of step with its consumer market and technology. What software product doesn't get analyzed up the whazoo anymore when its releases, did they think that no one would notice and second did they think that no one would mind? I can only imagine the backlash this is going to have as consumer trust in Sony takes a hit.

Now of course I'm sure that others had similar products ready for release and now that Sony has taken a pounding over theirs I'm betting there are all sort of companies racing back to the drawing boards.

Now that a Virus has been released that takes advantage of their product to further compromise a system, Sony's reputation will get thumped even further (think what the news headlines are going to read like), but it really makes me wonder just how insane Sony really is, I mean again you have to know that hackers are out there, and yes they would certainly love to take advantage of a preinstalled root kit on a large number of client systems, duh. I'm betting more then a couple heads are going to roll over this disaster and so they should.

Blake
--
Vendor: Firewall Logging Software »www.SonicLogger.com - SonicWall and 3Com »www.LinkLogger.com - Linksys, Netgear and Zyxel]]> http://www.dslreports.com/forum/remark,14773999 Thu, 10 Nov 2005 09:37:06 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14773596 Shriyash : Sony, are you listening?? :mad:]]> http://www.dslreports.com/forum/remark,14773596 Thu, 10 Nov 2005 08:18:29 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14773547 Diazruanova : I found this info too on BitDefender´s site:
----------------------------------------
First Trojan Using Sony DRM Detected
DRM Abuse

A new trojan which uses the cover provided by the Sony DRM component to hide has been detected by BitDefender Labs at 12.15 PM GMT today. This is the first ever observed instance of malware using the Sony DRM rootkit detected and analysed by Mark Russinovich.

The trojan apparently installs an IRC backdoor on the affected system and may have other functions.

"We have been aware for some time that malware can be written which may exploit the Sony DRM component's hiding capabilities for its own good. Therefore, BitDefender software has been upgraded to include heuristic detection for all software trying to use this technique. The trojan is not very widely spread at this time, but its mere existence is a worrying confirmation of our concerns." declared Viorel Canja, Head of BitDefender Labs.

BitDefender users are protected against this new threat, since it is detected proactively and blocked. A signature update is also underway, to aid administrators in identifying the new threat.
--
Diazruanova]]> http://www.dslreports.com/forum/remark,14773547 Thu, 10 Nov 2005 08:07:40 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14773517 sharpy merc : Considering the figures in this :

»news.bbc.co.uk/2/hi/technology/4378186.stm

A lot of people(22%) STILL open them. Thats UK figures.]]> http://www.dslreports.com/forum/remark,14773517 Thu, 10 Nov 2005 07:59:41 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14773503 Cudni : So the general advice not to open .exe etc, should be amended to include not to run Sony disks ;)

Cudni
--
....nothing but a well informed optimist
Help yourself so God can help you]]> http://www.dslreports.com/forum/remark,14773503 Thu, 10 Nov 2005 07:57:30 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14773473 sharpy merc : BUT if They do GET someone , what chance has the victim of finding this virus.

Pretty bloody slim.]]> http://www.dslreports.com/forum/remark,14773473 Thu, 10 Nov 2005 07:50:46 EDT Re: First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14773462 Vvian Kalyss : Much as I love watching Sony getting it, this doesn't seem like a good idea (for malware writers, that is) - the chances of infecting a machine already borged by Sony's kit isn't high.

Yet :)
--
Mikami Vvian, resident Girlfriend of Steel, care of the Tokyo-3 Middle Daughters Club]]> http://www.dslreports.com/forum/remark,14773462 Thu, 10 Nov 2005 07:46:45 EDT First Virus found that uses Sony Rootkit... http://www.dslreports.com/forum/remark,14773443 sharpy merc : Well it's started.

»www.viruslist.com/en/weblog

When this story broke , they said months before this happend what is it 7-8 days. ]]> http://www.dslreports.com/forum/remark,14773443 Thu, 10 Nov 2005 07:40:54 EDT