Sony pwns your computer
October 31, 2005 5:01 PM   Subscribe

drat, the link should be here. jessamyn, or matt, help!
posted by pjern at 5:06 PM on October 31, 2005

If you ask me, the authors of this software ought to be arrested for hacking, EULA or no.
posted by delmoi at 5:06 PM on October 31, 2005

Disabling autorun is one of the first things I take care of when I buy a new computer. I understand why the default is to have it on, but most people really don't need it.
posted by caddis at 5:13 PM on October 31, 2005

How about a much, much better way of turning off AutoPlay for starters? (Tweak UI - why it's not bundled with Windows I have no idea).
posted by Pretty_Generic at 5:13 PM on October 31, 2005

(I think you had the permalink right. His site is just barfing, or there's a typo somewhere.)

Reading the article now. Fascinating ...
posted by mrgrimm at 5:14 PM on October 31, 2005

I'll second the Tweak UI suggestion. Useful for lots of little things for fixing Windows.
posted by mrgrimm at 5:15 PM on October 31, 2005

Why do record companies insist of treating their paying customers as thieves? It seems to give them the idea that they can do anything they want. Like, say, installing rootkits.
posted by tommasz at 5:16 PM on October 31, 2005

By the way, I am hoping some aggressive lawyer decides to take this case and sue these bastards for trespass, etc.

(on preview: Tweak UI is definitely the easy way to go here)
posted by caddis at 5:17 PM on October 31, 2005

Lemme guess, Mac users need not worry? :D
posted by keswick at 5:18 PM on October 31, 2005

Disabling autoplay is good, but categorically to buy these musical trojan horses is better.

If you treat me like a thief I will simply not do business with you.
posted by clevershark at 5:20 PM on October 31, 2005

duh... I meant "categorically refusing to buy", of course.
posted by clevershark at 5:23 PM on October 31, 2005

So, am I right in saying that this doesn't actually prevent someone downloading Audacity, selecting What-U-Hear or Wave Out or suchlike as recording input and making a DRM-free MP3? And is hence almost worthless, since if someone intends to share music they will probably have the modicum of technical knowledge required to do this?

Sony manufacturers PCs. Sony breaks same PCs. PROFIT! Does anyone know the process that would lead Symantec and co to treat this as a virus or hostile program?
posted by Pretty_Generic at 5:24 PM on October 31, 2005

...or will spyware detectors like AdAware sniff it out?
posted by TechnoLustLuddite at 5:26 PM on October 31, 2005

This sort of criminal BS makes me want to, say, rip such albums using a strong OS (like freeBSD, for example) and making them available on P2P networks.

Then again I'll leave the law-breaking (suck cracking is a computer crime) to the record companies. I guess the music industry *is* a criminal cartel after all.
posted by clevershark at 5:28 PM on October 31, 2005

duh... "such cracking is a computer crime." I don't know why my typing is so bad today, I haven't even been drinking!
posted by clevershark at 5:29 PM on October 31, 2005

TechnoLustLuddit - you'll need something like RootkitRevealer.

(- and a modicum of technical knowledge...)
posted by PurplePorpoise at 5:32 PM on October 31, 2005

Unleash the fury!
posted by Pretty_Generic at 5:44 PM on October 31, 2005

"...am I right in saying that this doesn't actually prevent someone downloading Audacity, selecting What-U-Hear or Wave Out"

That's a strange question. We'll forever be able to make analog copies of digital recordings. They can't stop that.
posted by Ethereal Bligh at 5:47 PM on October 31, 2005

the link looks ok to me, email me if you need something changed.
posted by jessamyn at 5:55 PM on October 31, 2005

Ethereal Bligh, maybe I'm missing the point but I don't see what element of the method I've suggested is analog... Windows gives digital output to the soundcard, the soundcard gives digital output back to windows, Audacity records it... does it not result in a perfect copy (if you use WAV instead of MP3 I mean)?
posted by Pretty_Generic at 5:59 PM on October 31, 2005

I wonder what happens when one of these "protected" CDs is inserted into a system that no longer supports the Win32 mechanisms required to make this work. Such systems will be the norm in 5-10 years, and an awful lot of people will still have shelves full of CDs.
posted by Western Infidels at 5:59 PM on October 31, 2005

Link was only temporarily brok
posted by Pretty_Generic at 5:59 PM on October 31, 2005

Query: Does Sony put the "Compact Disc Digital Audio" logo on these monstrocities, even when they, um, aren't?
posted by Pretty_Generic at 6:01 PM on October 31, 2005

nb while this post is certainly public, a service and an announcement, those tags would probably be better off as one.
posted by Pretty_Generic at 6:09 PM on October 31, 2005

This really is beyond the pale. It's amazing that they'd go into a legal grey area for the (vanishingly marginal) benefit that this kind of copy protection gives them. I guess they figure a EULA will shield them from any liability; I suspect they might be wrong.

Pretty_Generic writes " Query: Does Sony put the 'Compact Disc Digital Audio' logo on these monstrocities, even when they, um, aren't?"

I think they're multisession discs, and the audio data does conform to the standard. That's how they play in most devices. In fact, the only device they don't behave as normal CDs on is a computer running Microsoft Windows.
posted by mr_roboto at 6:14 PM on October 31, 2005

Pretty_Generic: Does Sony put the "Compact Disc Digital Audio" logo on these monstrocities, even when they, um, aren't?

These malware-protected discs could actually be perfectly standards-compliant, and as worthy of the CD-DA name and logo as any other music CD.

There are other systems that try to confuse CD-ROM drives by corrupting the actual musical data - those are not CD-DA standards-compliant.
posted by Western Infidels at 6:14 PM on October 31, 2005

In fact, the only device they don't behave as normal CDs on is a computer running Microsoft Windows.

I can't understand why, if the CD-DA section is truly standards compliant, it can't be read by Windows Media Player etc as a normal CD that happens to have some data on it. Please be as technical as you like in explanation...
posted by Pretty_Generic at 6:34 PM on October 31, 2005

That's the part I don't entirely get. I know that if you let it install the malware, it will be on the lookout for the disc, and won't let it be played. Based on what I've read though, even if you have autorun disabled and fail to install the malware, you can't see the music on the disc. I don't quite get that. Especially since it looks like a regular audio CD in other OSs.
posted by mr_roboto at 6:43 PM on October 31, 2005

As if the average consumer didn't have enough reasons not to purchase a CD.
posted by fire&wings at 6:44 PM on October 31, 2005

This is why I stopped buying CDs.
posted by showmethecalvino at 6:59 PM on October 31, 2005

I'd love to operate outside the confines of the law through a corporation. Then I could r00t people's computers without getting an 18 month jail sentence.
posted by Civil_Disobedient at 7:04 PM on October 31, 2005

Ah, Sony BMG. This is just as great as the last time Germans and Japanese started working together.
posted by Pretty_Generic at 7:09 PM on October 31, 2005

If so, you might be wide open in terms of security.

Nope. Gotta Mac. Happy days!

In fact, the only device they don't behave as normal CDs on is a computer running Microsoft Windows.

Nope. It doesn't play in a good number of car stereos, either. Sad days!
posted by five fresh fish at 7:23 PM on October 31, 2005

Pretty Generic: I can't understand why, if the CD-DA section is truly standards compliant, it can't be read by Windows Media Player etc as a normal CD that happens to have some data on it. Please be as technical as you like in explanation...

As long as you keep the included self-installing stealth malware from installing, you probably can play the disc in WMP or what-have-you just fine. I'm guessing these CDs are CD-Extra discs, or "Blue Book" discs. The non-protected versions are usually marketed as "CD Enhanced" audio CDs - here's one example. They generally include some music videos, song lyrics, promos for other albums, etc. Auto-mounted in Windows, they appear to be data discs, but they respond to CD player apps like WMP as well.
posted by Western Infidels at 7:26 PM on October 31, 2005

As long as you keep the included self-installing stealth malware from installing, you probably can play the disc in WMP or what-have-you just fine.

Can anyone verify this? I find it kinda hard to believe - it undermines the whole DRM thing entirely.
posted by Pretty_Generic at 7:28 PM on October 31, 2005

Geez, just download your music, people. It's the 21st Century.
posted by Eideteker at 7:31 PM on October 31, 2005

Well, this copy protection bullsh*t has resulted in one lost sale as far as I'm concerned -- I was going to shell out for Paul van Dyk's Reflections album, until I saw the sticker notifying me of the copy protection on the CD. I left the store without buying anything -- if the music industry is going to treat me like a thief no matter what I do, I might as well act the part and save myself a few bucks in the process.
posted by clevershark at 7:33 PM on October 31, 2005

Can anyone verify this? I find it kinda hard to believe - it undermines the whole DRM thing entirely.

It looks like that's not actually true -- if you disable autorun, the computer loads the data session, not the audio.

It's still trivially easy to circumvent, it seems.

(1) Disable autorun and load.
(2) Make bitwise copy of disc with EAC (or otherwise rip the audio session to .wav or .flac with EAC).

Badabing, badaboom. Not that I've verified this.

Lots of DRM is absolutely trivial to defeat. Earlier cd protection schemes could be entirely defeated by disabling autoplay, and Acrobat encyption is/was just plain old ROT13.
posted by ROU_Xenophobe at 7:56 PM on October 31, 2005

Occasional bizarre, self-defeating attempts at DRM aside (anyone really suprised to see this coming from Sony?), seems to me that buying CDs is still a much better idea than buying DRMed music online.

The only alternative that gives you more actual options is pirating the music. Of course, then you give up your right to bitch and moan, which is no fun.
posted by selfnoise at 8:01 PM on October 31, 2005

I wonder if this nonsense can be defeated using a Sharpie marker...
posted by clevershark at 8:02 PM on October 31, 2005

Pretty_Generic: Can anyone verify this? I find it kinda hard to believe - it undermines the whole DRM thing entirely.

It does seem hard to believe that record execs would risk so much consumer backlash for a pathetically-ineffective copy protection scheme that could very well also be lawsuit-bait, but there's precedent. From the "this" link in the OP, concerning a similar system:

The disc has “Copy Protection” from SunnComm called MediaMax, which on some Windows systems will force the user to install software in order to listen to their music, and restrict what they do with the audio (for example you cannot make MP3s). If SunnComm sounds familiar, they should. These are the folks who were going to sue a Princeton student for 10 million dollars for writing a paper that showed by pressing the shift key while inserting the CD (and of course, pressing the shift key still worked on this CD, according to all reports) you can bypass their copy protection.

Holding down the shift key while inserting the CD is just a case-by-case way to disable AutoPlay. Without SunComm's malware crippling the music-owner's PC, the SunComm "protected" audio tracks are completely exposed.

I think this sort of behavior is good evidence that the decision makers at the record companies aren't very technically savvy, which isn't too surprising. What's more surprising is that they haven't done anything to rectify that situation over the last 10 years. As a result, they buy into bogus snake-oil "copy prevention" schemes again and again. What delicious irony - the record companies really are victims these days, although not quite in the way they imagine. The execs would be better off spending the dough on promotion. Or beer, even.
posted by Western Infidels at 8:19 PM on October 31, 2005

Aren't very technically savvy? They've managed to infiltrate your computer to such an extent that Russinovich had to use tools he built himself to peer at the inner workings of the kernel, just to find out what this stuff was. No regular user would even think to use Rootkit Revealer; few computer savvy users who aren't system admins or IT-trained will be able to go much further without assistance. Just because it's essentially a trojan horse that you have to run doesn't mean it's not sophisticated.

In addition to Sony BMG releases, a quick glance at the company's press site reveals that Upstairs Records (distributed by Universal Music) and EMI are also using the technology. Just so you know who to boycott.
posted by chrominance at 8:45 PM on October 31, 2005

Aren't very technically savvy? They've managed to infiltrate your computer to such an extent that Russinovich had to use tools he built himself to peer at the inner workings of the kernel, just to find out what this stuff was ...

All of which, of course, has nothing to do with RIAA executives - and everything to do with their hired guns, the SunComm folks. Just because they're completely illiterate when it comes to technology doesn't mean they don't know how to find people who aren't.

Unluckily for them - the folks they found are clever enough to know how much money they can siphon out of RIAA by claiming to have the perfect copy-protection solution. I'm absolutely certain that everyone at SunComm that actually touches code knows such a thing is impossible. But, that's what pays their bills - even if it is pretty unethical.
posted by odinsdream at 9:43 PM on October 31, 2005

Geez, just download your music, people. It's the 21st Century.

Care to point me to a legal site that wil sell me music without DRM?

EMusic doesn't have any major label music, and allofmp3 is of dubious legality.
posted by salmacis at 2:43 AM on November 1, 2005

I am no fan of "stealing" music online. However, when the music company is trespassing in your computer like this, I think the moral compass swings much more strongly in favor of just downloading it for free. It's not really for sale legitimately anyway, not when it comes with malware.
posted by caddis at 3:58 AM on November 1, 2005

Here's a tip on digital rights management protected discs (that probably only works with small to medium-sized labels):

Call the label's customer service department and ask for a non-copy protected disc. Most will replace it for you. I know of several labels that tested the waters with digital rights management and after enough complaints, just decided to go without it.

Or, as I do, when you find you've bought such a disc, return it and notify the label and distributor that released it.
posted by Captaintripps at 4:39 AM on November 1, 2005

I don't know who Van Zant are - maybe some hip dude could fill me in - but I definitely plan on finding this album online and permanently sharing it via ftp and bittorrent. Obviously, there are plenty of other artists who are forced to use Sony's insane DRM, but, like the 10 year-old girls the RIAA sues, someone has to be made an example of.
posted by Optimus Chyme at 5:41 AM on November 1, 2005

Jesus fucking Christ. EULA's like this send shivers down my spine.

As soon as you have agreed to be bound by the terms and conditions of the EULA, this CD will automatically install a small proprietary software program ... onto YOUR COMPUTER. The SOFTWARE is intended to protect the audio files embodied on the CD, and it may also facilitate your use of the DIGITAL CONTENT. Once installed, the SOFTWARE will reside on YOUR COMPUTER until removed or deleted. (ok. how?)

You expressly acknowledge and agree that you are installing and using the licensed materials at your own sole risk. Should the licensed materials prove to be defective, you ... agree to assume the entire cost of all necessary servicing, repairs or corrections. (not sure this is possible under UK law)

No SONY BMG party shall be liable for any loss or damage ... such damages include, but are not limited to, loss of profits, loss of revenue, loss of data, loss of use of the product or any associated equipment, down time and user’s time, even if the SONY BMG party concerned has been advised of the possibility of such damages.

The SONY BMG PARTIES may from time to time provide you with updates of the SOFTWARE in a manner that the SONY BMG PARTIES deem to be appropriate. (this worries me. can you say 'backdoor'?)

I would love to see this tested in court: isn't there a long-standing precedent which requires that the parties to an agreement need to understand fully what they're entering into?
posted by blag at 6:21 AM on November 1, 2005

EULAs are still subject to a lil thang we call "rule of law". Don't be too scared.
posted by Pretty_Generic at 6:27 AM on November 1, 2005

From the article comments:

First4Internet, eh?... let's see... according to public records, they were incorporated 24/11/1999. In 2004 they had a turnover of £709,941 and operating expenses of £1,301,546 -- meaning an operating loss of £591,605. In the last five years they have, on average, lost £541,067 a year. For 2004, their credit rating is "HIGH RISK" (complete with capitalisation). Meanwhile, the four directors share annual renumeration of £224,413 between them (average £56,103 each).

One of the directors, Nicholas Bingham, (appointed in 2002) was director of "Sony pictures home entertainment Ltd." from 1989 to 1997, and director of "Sony pictures television production UK Ltd." from 1996 to 2000, and director of "Sony digital radio europe Ltd." from 1994 to 2000.

A cynic might say Sony selected this inept copy protection technology because it was supplied by one of thier cronies. The reason this is a bad business practice can be seen by the software's many failings.

lol.
posted by Pretty_Generic at 6:32 AM on November 1, 2005

salmacis: Care to point me to a legal site that wil sell me music without DRM?

Audiolunchbox.com (currently down for maintenance, oops). Of course, if you mean, "point me to a legal site that sells all the music in iTunes' catalog without DRM", you're probably out of luck. But for indie stuff, you might want to check this store out.
posted by mumble at 6:41 AM on November 1, 2005

What about all those Russian sites?
posted by Pretty_Generic at 6:47 AM on November 1, 2005

Whoops, sorry, salmacis, didn't read that bit about major labels. Nevermind.
posted by mumble at 6:48 AM on November 1, 2005

"Ethereal Bligh, maybe I'm missing the point but I don't see what element of the method I've suggested is analog... Windows gives digital output to the soundcard, the soundcard gives digital output back to windows, Audacity records it... does it not result in a perfect copy (if you use WAV instead of MP3 I mean)?"

No. Look at what's happening inside the soundcard. It's not going to be an exact copy. I think you're probably right that the CD player's output stays in the digital realm (providing it started there), but it's still been changed as the soundcard processes it. Not to mention that I don't think that what you get when you play a song via IDE is necessarily the bitwise copy you (ideally) get when you rip it with software.

You might argue that this gives you something that might as well be a perfect copy, but the same thing could be said of high-quality analog copying, too. Because as long as we can hear it, it's copyable.

DRM may succeed in making it very difficult for anyone to make bitwise copies of audio recordings. But then we'll just start making our copies from signals that aren't bitwise identical but for the purposes of human hearing, might as well be.
posted by Ethereal Bligh at 9:57 AM on November 1, 2005

EB's right - as far as I know, recording your soundcard's "Wave Out" essentially re-routes the analog output of the soundcard back into the analog input. It doesn't re-route the digital output to digital input - to do that you need software like TotalRecorder that installs a virtual device driver. You can test this by playing nothing...silence...and recording your soundcard's Wave Out. Normalize it and it will be full of noise from your soundcard's amplifiers.
posted by Jimbob at 8:13 PM on November 1, 2005

An interesting point about the specific way this DRM works: anyone who knows about this exploit can also cloak malicious files on your system by using the same filename convention as the DRM files. So not only have the record labels infiltrated your computer, they've left the backdoor open for everyone else as well.

This just went from pretty bad to mind-numbingly horrible in terms of computer security.
posted by chrominance at 10:38 PM on November 1, 2005

I'll never buy another CD until Sony stops this shit.
posted by dingobully at 3:22 AM on November 3, 2005

World of Warcraft hackers using Sony BMG rootkit
posted by caddis at 2:38 PM on November 3, 2005

The story hit NPR today.
posted by mrgrimm at 9:53 AM on November 4, 2005

A first wave of malicious software written to piggyback on Sony BMG Music Entertainment CD copy protection tools has been spotted online, computer security companies said Thursday.
posted by zarah at 5:37 PM on November 10, 2005