Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
After Business Week magazine revealed that F-Secure had alerted Sony to the problem on Oct. 4 – weeks before the spyware-like device became a full-fledged media circus – Sony took no action on the application installed on its CD-Roms until mid-November when it pulled discs containing the program from stores.
F-Secure told the magazine that it had learned of the rootkit from John Guarino, a Manhattan computer technician.
Mark Russinovich, the Windows system expert who revealed the existence of the Sony rootkit in late October, said he still felt the company wasn't ating in the best interests of its customers in a recent posting.
"Two weeks ago, I declared victory in what the media is now referring to as the 'Sony rootkit debacle,' but I'm now wondering if I jumped the gun," he said on his blog. "It turns out that the CDs containing the XCP rootkit technology are still widely available, there's still no sign of an uninstaller and comments made recently by the president of the Recording Industry Association of America make it clear that the music industry is still missing the point."
Russinovich's disclosure preceded the appearance of trojans that took advantage of the First4Internet cloaking technology on Sony CDs. Bloggers also revealed that the uninstaller Sony had offered opened up other vulnerabilities on a PC.
An investigation by New York State Attorney General and Democratic gubernatorial candidate Elliot Spitzer revealed last week that CDs containing the spyware-like technology were still widely available in stores.
The state of Texas and the Electronic Frontier Foundation also filed suits against Sony on behalf of consumers, < href='http://www.scmagazine.com/us/news/article/530902/private-dc-suit-filed-against-sony/'>as did the firm Finkelstein, Thompson & Loughran on behalf of District of Columbia residents.
Ed Felten, a Princeton University computer science professor, asked on his "Freedom to Tinker" blog on Wednesday, "What did Sony-BMG know and when did it know it?"
"We have to consider the possibility that Sony and First4Internet understood the significance of the rootkit, but simply felt that copy protection trumped users' security," he said. "First4Internet held that view – otherwise it's hard to explain their design decision to deploy rootkit functionality – and Sony may well have held it too."
www.f-secure.com www.freedom-to-tinker.com www.sysinternals.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.
