Tuesday, November 1st 2005

Uncovering Sony's DRM software

The Digital Rights Management software that Sony BMG Music Entertainment uses is a bit of a security risk and CPU hog according to sysinternals.com. The website disassembled the DRM software and found a variety of problems with it.
The worst of it is that the software "hides any file, directory, Registry key or process whose name begins with '$sys$'" from the Windows API. Which can obviously allow malware writers to hide their programs from Windows users courtesy of Sony's DRM software.

Another problem is that it's un-uninstallable for most users. It doesn't register itself with Windows' Add/Remove Programs.
You need to have access to a variety of specialized programs and Windows knowledge to be able to first "uncloak" the files and reg keys the DRM software installs.

The guy who wrote up the original article had his CD drive disabled after he deleted the software. He had to get rid of more reg keys the software had created but...
Those keys have security permissions that only allow the Local System account to modify them, so I relaunched Regedit in the Local System account using PsExec: psexec -s -i -d regedit.exe. I retried the delete, succeeded, and searched for $sys$ again. Next I found an entry configuring another one of the drivers, Cor.sys (internally named Corvus), as an upper filter for the IDE channel device and also deleted it. I rebooted and my CD was back.
Obviously all the wrangling around to get rid of the software is to protect itself from being tampered with by the casual computer user. But by giving no option to uninstall itself if the user doesn't want it on their computer anymore is unnacceptable.

Another problem with it is the CPU usage it takes up after being used. It'll scan all the processes you're running even after you've "shut down" the software. The author of the article says it was taking up 1-2% of his CPU usage constantly after closing down the program.

bit-tech.net calls it malware and spyware but it looks as if it's a badly though-out and coded piece of software. Calling it spyware is pretentious, but Sony should enlighten it's customers on why such a poor program is required to listen to DRM protected Sony music on a computer.

Just another reason why DRM is a consumer's and end-user's dream come true...
Source: bit-tech.net
Add your own comment

5 Comments on Uncovering Sony's DRM software

#1
XooM
wikipediaSpyware is a broad category of malicious software intended to intercept or take partial control of a computer's operation without the user's informed consent. While the term taken literally suggests software that surreptitiously monitors the user, it has come to refer more broadly to software that subverts the computer's operation for the benefit of a third party.
Well, i'd call CD drive hijacking and thoroughly embedding a program into one's system spyware. Actually, it sounds worse than most spyware.
This is yet another reason why DRM is bad and needs to burn in hell.
Posted on Reply
#2
wazzledoozle
Hmm I had Sony Sonicstage on my computer for a whole 15 minutes before realizing what crap it was. Havent noticed any problems :twitch:
I did a find keywords : sony, sonicstage in regedit and deleted any entries.
Posted on Reply
#3
Thermopylae_480
All legit programs should be easily removable by users who have little knowledge of advanced computer operation. None of these programs should require that you hunt down and manually delete registry keys, with the added bonus that you might disable one of your hardware components. Sounds like a pretty malicious program to me. Shame on Sony:shadedshu
Posted on Reply
#5
boruvka
From what I gathered I doesn't REMOVE the malware, but only helps to FIND it on your system. To really REMOVE it you have to lower your pants in front of Sony and give them all sorts of personal data they have no right to ask for.
I do not know what it's like elsewhere, but in Germany the DRM malware used by Sony is a criminal offence, punishable as unlawful "Data manipulation", leading to sentences of up to two years imprisonment or a monetary fine.

bundesrecht.juris.de/bundesrecht/stgb/__303a.html
Posted on Reply
May 7th, 2024 19:32 EDT change timezone

New Forum Posts

Popular Reviews

Controversial News Posts