Text 8036, 93 rader
Skriven 2005-11-01 08:40:22 av Glenn Meadows (1:379/45)
   Kommentar till text 8026 av Mike '/m' (1:379/45)
Ärende: Re: Sony, Rootkits and Digital Rights Management Gone Too Far
=====================================================================
From: "Glenn Meadows" <gmeadow@comcast.net>

And then this today as well:

http://www.theregister.co.uk/2005/11/01/sony_rootkit_drm/

--

Glenn M.
"Mike '/m'" <mike@barkto.com> wrote in message
news:psddm1pmv7sqtna7e0ele0982nproeoi76@4ax.com...
>
> http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.htm
l
>
> ===
> Last week when I was testing the latest version of RootkitRevealer (RKR)
> I ran a scan on one of my systems and was shocked to see evidence of a
> rootkit. Rootkits are cloaking technologies that hide files, Registry
> keys, and other system objects from diagnostic and security software,
> and they are usually employed by malware attempting to keep their
> implementation hidden (see my "Unearthing Rootkits" article from the
> June issue of Windows IT Pro Magazine for more information on
> rootkits)....
>
> Given the fact that I'm careful in my surfing habits and only install
> software from reputable sources I had no idea how I'd picked up a real
> rootkit, and if it were not for the suspicious names of the listed files
> I would have suspected RKR to have a bug. I immediately ran Process
> Explorer and Autoruns to look for evidence of code that would activate
> the rootkit each boot, but I came up empty with both tools. I next
> turned to LiveKd, a tool I wrote for Inside Windows 2000 and that lets
> you explorer the internals of a live system using the Microsoft kernel
> debugger, to determine what component was responsible for the cloaking.
>
> Rootkits that hide files, directories and Registry keys can either
> execute in user mode by patching Windows APIs in each process that
> applications use to access those objects, or in kernel mode by
> intercepting the associated kernel-mode APIs. A common way to intercept
> kernel-mode application APIs is to patch the kernel's system service
> table, a technique that I pioneered with Bryce for Windows back in 1996
> when we wrote the first version of Regmon. Every kernel service that's
> exported for use by Windows applications has a pointer in a table that's
> indexed with the internal service number Windows assigns to the API. If
> a driver replaces an entry in the table with a pointer to its own
> function then the kernel invokes the driver function any time an
> application executes the API and the driver can control the behavior of
> the API....
>
> I entered the company name into my Internet browser's address bar and
> went to http://www.first4internet.com/. I searched for both the product
> name and Aries.sys, but came up empty. However, the fact that the
> company sells a technology called XCP made me think that maybe the files
> I'd found were part of some content protection scheme. I Googled the
> company name and came across this article, confirming the fact that they
> have deals with several record companies, including Sony, to implement
> Digital Rights Management (DRM) software for CDs.
>
> The DRM reference made me recall having purchased a CD recently that can
> only be played using the media player that ships on the CD itself and
> that limits you to at most 3 copies. I scrounged through my CD's and
> found it, Sony BMG's Get Right with the Man (the name is ironic under
> the circumstances) CD by the Van Zant brothers. I hadn't noticed when I
> purchased the CD from Amazon.com that it's protected with DRM software,
> but if I had looked more closely at the text on the Amazon.com web page
> I would have known...
>
>
> At that point I knew conclusively that the rootkit and its associated
> files were related to the First 4 Internet DRM software Sony ships on
> its CDs. Not happy having underhanded and sloppily written software on
> my system I looked for a way to uninstall it. However, I didn't find any
> reference to it in the Control Panel's Add or Remove Programs list, nor
> did I find any uninstall utility or directions on the CD or on First 4
> Internet's site. I checked the EULA and saw no mention of the fact that
> I was agreeing to have software put on my system that I couldn't
> uninstall. Now I was mad....
> ===
>
>
> The entire article is very worth the read.
>
> /m
>
>
> p.s. first saw mention of this on /.
> http://it.slashdot.org/article.pl?sid=05/10/31/2016223&tid=172&tid=158
>
>
>

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)