Real Story of the Rogue Rootkit - Antivirus software makers are nowhere to be found when Sony's CD Trojan horse comes knocking. Mere incompetence can't explain that. Commentary by Bruce Schneier. [Security Blanket]

Yet another mega-corporation tries to circumvent the law. Not only is it illegal for Sony to put this type of program into people's computers, but Sony is also trying to restrict people from using the music files that they paid for the ways that they could under fair use laws. This is an extraordinary breach of ethical and privacy rights on the part of Sony. If an individual tries to pull this off, they would have been jailed for sure, but somehow it's ok for corporations to do it.

For those of you that have not heard about this XCP rootkit that Sony has unleashed on the world, here's a brief description: certain music CDs released by Sony BMG, Sony’s music division, contains software that, when installed on someone’s computer, will restrict how many times the computer can burn a copy of that CD and prevent the user from copying the music files to another location.

Those restrictions might already be pretty bad themselves, but it’s the way Sony achieve these ends that has everyone in an uproar. If a user wants to listen to the music CD on their computer, they have to agree to an undecipherable EULA, and the CD installs a proprietary music player, along with the XCP rootkit.

This rootkit is dangerous because it gains control of the computer’s operating system at it’s highest level, mimicking as an important part of the operating system that, if a user tries to remove it, the action may very well damage Windows and make it inoperable. The reason it is called a rootkit is because it uses a special process that hides itself within the system, ‘cloaking’ it and rendering it undetectable by even anti-virus scanners. This very reason makes it a security risk because malicious programs such as virus and spyware can use the XCP rootkit to make themselves undetectable nearly impossible to get rid of, short of a complete reformat and reinstall of the entire operating system.

Anti-virus companies and even Microsoft was slow to respond to this threat to computer security, only because a multinational corporation, and not some two-bit hackers, released this rootkit. But thanks to technology blogs that spread the story, which was picked up by the mainstream media, Microsoft finally caved in to public pressure, stated that they considered the XCP rootkit to be malware, and released a patch to remove the clocking portion of the rootkit.

Sony also responded by recalling all CDs that contain the rootkit, and by temporarily halting the production of CDs that contain the XCP rootkit. Sony is doing this now to mainly to protect itself from the public relations nightmare the rootkit has spawned, and the pending litigation that both the states of California and New York is bringing to Sony. Basically Sony is trying to cover its own ass after being caught with its hand in the cookie jar.

What is scary, besides the fact that this rootkit has already infected about half a million computers around the world, is the attitude of the executives at Sony. It’s a damning indication of the lack of respect Sony has for it’s customers when Thomas Hesse, Sony BMG's president of global digital business, was quoted as saying, "Most people don't even know what a rootkit is, so why should they care about it?"

I’m disturbed by how willing Sony was to intrude peoples’ computers simply for their own agendas. It makes me wonder just how trustworthy corporations are in general these days. We should all be diligent whenever another multinational corporation wants to install anything on our computers.