Microsoft to Root Out Sony Spyware

Microsoft Corp. has joined a growing group of security software vendorswho are treating Sony BMG Music Entertainment’s controversial XCP(Extended Copy Protection) copy protection software as a threat. OnSaturday, Microsoft announced that it would begin treating the softwareas spyware and offering users tools to remove it, just as a PrincetonUniversity computer science researcher raised questions about a secondSony copy protection product.

“We have analyzed this software, and have determined that in order tohelp protect our customers we will add a detection and removalsignature for the rootkit component of the XCP software to the WindowsAntiSpyware beta,” wrote Jason Garms, group program manager forMicrosoft’s Anti-Malware Technology Team, in a Web log posting.(http://blogs.technet.com/antimalware/archive/2005/11/12/414299.aspx)

Sony had come under heavy fire for using so-called “rootkit” cloakingtechniques — normally associated with hackers — to make it nearlyimpossible to detect the XCP software. After nearly two weeks ofconsumer backlash, however, Sony announced on Friday that it wouldtemporarily suspend production of XCP-enabled CDs.

In an upcoming weekly software update, Microsoft will add the newelectronic signature so that Windows AntiSpyware can spot andautomatically remove the software, Garms wrote. Windows AntiSpyware isa beta product that Microsoft eventually plans to rename WindowsDefender.

Microsoft will also include the XCP signature in the next update to itsMalicious Software Removal tool, and with its Web-based securityservice called Windows Live Safety Center, according to Garms.

Microsoft joins security vendors like CA Inc. and Symantec Inc. inidentifying XCP as a possible security threat. Computer experts hadworried that hackers might use XCP’s cloaking capabilities to hidemalicious software of their own, and last week the first few examplesof such programs began surfacing.

Meanwhile, a Princeton University computer scientist has posted ananalysis of a second copy protection product used by Sony, saying thatit, too, suffers from many of the same problems as XCP. That software,called MediaMax, was written by SunnComm International Inc. Sony hasconfirmed that it ships CDs with both SunnComm’s software and XCP,which was created by a Banbury, U.K., company called First 4 InternetLtd.

Both copy protection products are bad for consumers, according to J.Alex Halderman, a Ph.D. student in computer science at Princeton. “LikeXCP, recent versions of MediaMax engage in spyware-style behavior,” hewrote in a Saturday posting to the Freedom to Tinker Web log. (https://www.freedom-to-tinker.com/?p=925)

Halderman reported that MediaMax automatically installed files withoutuser consent, that its uninstaller program does not completely removethe software, and that it secretly transmits user information back toSunnComm’s servers.

“Playing First 4 Internet or SunnComm disks means not only installingnew software, but trusting that software with full control of yourcomputer,” Halderman wrote. “After last week’s revelations about theSony rootkit, that trust does not seem well deserved.”

This is not the first time Halderman has had something to say aboutSunnComm. In 2003, SunnComm threatened the computer scientist with alawsuit after he published a paper that exposed weaknesses in theircopy-protection mechanism. No legal action was ever brought againstHalderman, according to SunnComm.

Sony, First 4 Internet and SunnComm Monday were unable to comment for the story.

By Robert McMillan – IDG News Service (San Francisco Bureau)

For more information, check out Talk Back and tell us what you think.