Rootkits: the latest in DRM from Sony

DRM can range from a nuisance to downright intrusive. A nuisance would be something along the lines of SunnComm’s ill-fated MediaMax CD3 system, which could be thwarted by holding down the Shift key the first time the protected music CD is loaded into your PC’s optical drive. Downright intrusive? Early audio CD DRM that kept CDs from playing on your PC under any circumstances. Sony appears to have gone beyond the pale with its latest antipiracy scheme: software that installs a rootkit on your PC.

For the uninitiated, a rootkit is a program or set of programs that allow a usually malicious user to maintain access to an compromised computer by sinking deep hooks into the OS. In the case of Windows, a rootkit will attempt to shield changes to the registry along with files from the user, and more importantly, from antivirus or spyware detection software. In so many words, letting someone install an undetected rootkit on your system is not a good thing.

Some newer CDs from Sony BMG contain an antipiracy application that must be installed in order to play the CD on your Windows PC. Should the unwary consumer say "yes" to the license agreement, the application implants hooks into the Windows kernel to make sure you don’t use the CD in a manner Sony doesn’t approve of. Those hooks are undetectable unless you know exactly what you’re looking for, and are all but impossible to uninstall apart from contacting Sony and requesting removal. Attempting to remove the software yourself will leave you with a nonfunctional CD-ROM drive. Heaven help you if you’re running a beta of Vista. Sony’s application will utterly hose your Vista install.

What’s even more infuriating is that Sony’s rootkit provides a means of entry for other hackers to compromise your system (assuming they are able to gain access). All they have to do is use the same naming convention Sony’s software uses. And even if your system is never compromised, you still have a process you didn’t ask for taking up CPU cycles1 to 2 percent even when your PC is otherwise idle.

Sony confirmed that it began using this particular DRM, which was developed by a British company called First 4 Internet, at some point in 2005. While the company refused to say how many CDs are protected via this method, it did say that such CDs are labeled "Content enhanced & protected" on both front and back. So if you’ve purchased a CD from Sony BMG this year, you may want to read the label and see if it has enhanced and protected content. If it does and you’ve installed the application that came with the CD, then congratulations! You’ve got a rootkit on your system.

This seems like a perfect time to stop using Sony products and consuming Sony content. The company has a long track record of doing whatever it can to protect its products. As Hannibal pointed out,

The company is obsessed with digital piracy, and the PC interfaces for their digital devices are invariably buggy, intrusive, slow, and almost seem to be designed to make the user just give up and buy Sony physical media.

In this case, even buying the Sony physical media is a spectacularly bad idea given what it will do to your system. If it’s already on there, good luck getting it off.