Sony-BMG and its woeful XCP
Some time ago, Sony issued a controversial memo announcing that no more than 20 CD titles have been released containing what was called an XCP protection software that was similar to Microsoft’s DRM technology. As it turns out, there’s more to it than meets the eye.
XCP is a rootkit-style software that installs itself deep into the computer without the consent of the user. Hmm. Wait a minute. Sounds more like malware to me! In fact the entire world has reached a concensus that this XCP rootkit is indeed a virus that can become a security threat to Windows itself. Microsoft has declared the XCP as hazardous to MS Windows because not only can it disable your CD-ROM drive, but it also opens a gateway to a wide-spreading virus for Windows. It’s so rampant that Symantec has released a security response to remove the XCP-drawn virus.
The software giant said a key part of the XCP copy protection system counted as malicious software under the rules it uses to define what Windows should be protected against.
It plans to include detection and removal tools for parts of XCP in its weekly anti-spyware software update.
The news came as Sony BMG suspended production of CDs that use XCP.
How exactly does XCp destroy your CD-ROM drive?
Sony’s anti-piracy program installer pops up when you drop one of these content-protected CDs into your drive. If you agree to install it, there is no “uninstall” feature. Russinovich was able to use his knowledge of rootkits and the Windows operating system to zero in on the offending driver files needed to run the software. Unfortunately, he found that removing the program also erased the system files that power his CD-ROM drive, rendering it useless.
c/o Brian of Security Fix (Washington Post Blog)
There is a partial list here and here of albums that contain this XCP copy protection. These albums include titles such as Foo Fighters’ In Your Honor and Switchfoot’s Nothing Is Sound. Sony claimed that these copy-protected CD’s number no more than 20 titles but from indie surveys and blogger counts, the number is in the 50’s.
It has to be noted that the XCP protection scheme was only used in CD’s sold in the United States. Is this a preview of things to come? With the bad publicity the XCP DRM has generated, Sony might have to rethink their overall strategy for world domination as well as make several apologies suspending the DRM technology bundled in their CD’s.
Point of clarification: a swelling majority of people are all up in arms, shrieking, “Virus! Sony XCP discs have a virus! Aaagh!” when that’s not exactly correct. There is no self-replicating action going on with the Sony XCP rootkit; it gets in there, and it stays there. The freaky (and absolutely terrifying) thing is that it opens up a gaping security hole in Windows, throwing wide the gates to any virus or malware out there based on Sony’s rootkit. The thing is, the rootkit will not install if you decline the EULA which pops up when you stick one of these things in your PC. So decline, and you’re okay. Plus, the fact that it calls Sony’s servers whenever you play a Sony CD and tells them so — well. That just brings vastly paranoid new meaning to the phrase “They’re Playing Our Song”…