Sony BMG Sold 2.1 Million Music CDs That Quietly Installed a Rootkit to Stop Buyers Copying Them. The Copy-Protection Software Appeared to Contain Open-Source Code Copied Without Honouring Its Licence.

On 30 September 2005, John Guarino, who ran a two-man computer repair shop in Manhattan called TecAngels, found a set of oddly named files hidden on his own PC. He had been finding the same files on customers' machines for weeks. His antivirus software did not flag them, and when he deleted them, the customers' CD drives stopped working, so he had taken to reinstalling Windows from scratch. According to Wade Roush's account in Technology Review, Guarino retraced his steps and remembered that the day before, he had bought a CD, Touch by the singer Amerie, and installed the player it insisted on. The jewel box said "Content Enhanced and Protected."

Guarino sent his logs to F-Secure, the Finnish security firm, which confirmed that the files formed a rootkit, software that hides things from the operating system, and that it would hide anything else that wanted hiding just as readily. F-Secure contacted Sony on 17 October. The rootkit had been put there by the second-largest record company in the world, on 52 albums released between January and November 2005, to stop people who had paid for a CD from making more than three copies of it.

The Blog Post

F-Secure was still waiting politely for an uninstaller before publishing when Mark Russinovich, a Windows internals specialist at Winternals Software, found the same thing on his own machine while testing his detection tool, RootkitRevealer. On 31 October 2005 he published the result on his Sysinternals blog under the title "Sony, Rootkits and Digital Rights Management Gone Too Far."

The post is a forensic account. The cloaking driver, Aries.sys, hid any file, directory, registry key or process whose name began with "$sys$". Russinovich renamed a copy of Notepad to $sys$notepad.exe "and it disappeared from view." A hidden service, $sys$DRMServer, presented itself to Windows as "Plug and Play Device Manager", and kept using one to two percent of the processor after the player was closed, scanning running programs every two seconds. The files traced back to a British company, First 4 Internet, and its copy-protection product XCP, and from there to a CD he had bought on Amazon: Get Right with the Man by the Van Zant brothers, "the name is ironic under the circumstances." There was no uninstaller and nothing in Add or Remove Programs. "I checked the EULA and saw no mention of the fact that I was agreeing to have software put on my system that I couldn't uninstall," he wrote. "Now I was mad."

He deleted the files, rebooted, and the CD drive was gone. A second hidden driver, Crater.sys, had registered itself as a filter on the drive; he called this "another ironic name, since it had 'cratered' my CD." Restoring it took a registry editor relaunched under the Local System account. Most users who found the files and took the obvious step, he concluded, would cripple their computers. "This is a clear case of Sony taking DRM too far."

The Explanation

On 4 November, NPR's Neda Ulaby put the matter to Thomas Hesse, president of Sony BMG's Global Digital Business. "Most people, I think, don't even know what a Rootkit is," Hesse said, "so why should they care about it?" He told NPR that only about 20 CDs carried the software, and that it was cloaked so that would-be pirates could not find and remove it. "No information ever gets gathered about the user's behavior," he said.

The same day, according to Technology Review, Russinovich reported that the player contacted a Sony BMG server each time a protected disc was played, to fetch a rotating banner advertisement, something the licence agreement did not mention. Less than two weeks after the rootkit came to light, the first piece of malware designed to hide inside it, a backdoor Trojan named Troj/Stinx-E, had appeared. Analysts at Gartner, quoted in The Register, noted that a fingernail-sized piece of tape on the disc could stop the software from running at all, and that it would "prevent neither informed casual copiers nor high-volume 'pirates' from doing whatever they like with the content of the disc."

The Uninstaller

Sony BMG's first remedy, in early November, was a web-based removal tool. To get it, a customer filled in a form, and the form installed an ActiveX control made by First 4 Internet called CodeSupport. On 15 November, after a Finnish researcher, Matti Nikki, spotted the problem, the Princeton computer scientists Ed Felten and J. Alex Halderman confirmed on their blog Freedom to Tinker that CodeSupport stayed on the machine, was marked safe for scripting, and would download and run code from any address without checking where it came from. "It allows any web page you visit to download, install, and run any code it likes on your computer," they wrote. For affected users it was "a far greater security risk than even the original Sony rootkit." The people exposed were those who had asked Sony how to remove the first problem.

Sony BMG announced on 11 November that it would stop making XCP discs and on 14 November that it would exchange them. Some 4.7 million had been manufactured and about 2.1 million sold. The exchange covered XCP. The company's other copy-protection system, SunnComm's MediaMax, which according to The Register was on about 20 million discs, was meanwhile added to the Electronic Frontier Foundation's list of complaints.

The Borrowed Code

Then there was the question of where XCP had come from. Volunteers taking it apart, among them Nikki and Sebastian Porst, reported that the XCP player component contained code from the open-source MP3 encoder LAME, from mpglib and from VideoLAN, free software distributed under licences with conditions attached. It was, The Register wrote, "pretty clear cut that First4Internet has used code without observing the terms under which it's distributed." Porst also identified a function he said came from drms.c, a program written by Jon Lech Johansen, known as DVD Jon, and Sam Hocevar, used to strip the copy protection from songs bought on Apple's iTunes. The Register headlined it "Sony's CD rootkit infringes DVD Jon's copyright." Software built to stop customers infringing copyright appeared, on the evidence, to infringe several, including that of a man famous for circumventing copy protection.

The Bill

On 21 November 2005, Texas Attorney General Greg Abbott sued Sony BMG under the state's Consumer Protection Against Computer Spyware Act, making Texas the first state to sue. "Sony has engaged in a technological version of cloak and dagger deceit against consumers by hiding secret files on their computers," he said. "Consumers who purchased a Sony CD thought they were buying music." Private suits were consolidated in federal court in Manhattan, and before the year was out Sony BMG had agreed a settlement giving XCP owners a replacement disc, $7.50 and, in a detail Technology Review called ironic, free downloads of the music. The company denied liability.

In December 2006 it settled with Texas and California for $750,000 each, plus refunds of up to $175 for computers damaged in attempts to remove the software. On 30 January 2007 the Federal Trade Commission announced its own settlement. "Installations of secret software that create security risks are intrusive and unlawful," said Chairman Deborah Platt Majoras. "Consumers' computers belong to them." Sony BMG would reimburse up to $150 in repair costs and stop using the listening data it had collected for marketing. It would also accept CD exchanges, according to the FTC's announcement, through 31 June 2007, a date the calendar does not supply.

The software that did all this installed itself when someone put a purchased Sony BMG disc into a Windows computer and clicked Agree. Among the comments posted beneath Russinovich's blog on 31 October, one reader predicted that next time he would not open the package at all, and would download the album through file-sharing instead, where "for some strange reason all DRM software is missing." Another asked how the post squared with section 2.1.d of the licence agreement, which prohibited reverse engineering the software.

Filed from public reporting:

• Mark Russinovich, Sysinternals — "Sony, Rootkits and Digital Rights Management Gone Too Far"
• NPR — "Sony Music CDs Under Fire from Privacy Advocates"
• MIT Technology Review — "Inside the Spyware Scandal"
• Freedom to Tinker — "Sony's Web-Based Uninstaller Opens a Big Security Hole; Sony to Recall Discs"
• The Register — "Sony's CD rootkit infringes DVD Jon's copyright"
• The Register — "Texas puts Sony BMG in its sights"
• Associated Press (via NBC News) — "Sony BMG settles suit over copy-protected CDs"
• Federal Trade Commission — "Sony BMG Settles FTC Charges"