<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<h1>Virus writers exploit Sony DRM</h1>
<h6>
<p>Sony doomsday scenario becomes reality</p>
</h6>
<div class="articlebyline">Iain Thomson and Tom Sanders, <a
href="http://www.vnunet.com/">vnunet.com</a> <span class="datecolour">10
Nov 2005</span></div>
<div class="articlempu" style="margin-top: 9px;">
<div class="adtop">Virus writers have already started to exploit
<a href="http://www.sony.com/" target="_blank">Sony</a>'s controversial
digital
rights management software, which <a
href="http://www.vnunet.com/2145413">uses a rootkit</a> to hide
the code and ensure that the CDs are not copied.</div>
</div>
<p>A new Trojan,
<a href="http://www.sophos.com/virusinfo/analyses/trojstinxe.html"
target="_blank">Troj/Stinx-E</a>,
has been mass-mailed to UK email addresses. The worm is a variant of
what McAfee
referred to as the
<a
href="http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=133091">Brepibot</a>
virus that was first discovered on April this year. BitDefender calls
the new
worm
<a
href="http://www.bitdefender.com/VIRUS-1000058-en--Backdoor.IRC.Snyd.A.html">Backdoor
IRC Snyd A</a> and F-Secure
<a href="http://www.f-secure.com/v-descs/breplibot_b.shtml">Breplibot.B</a>.
</p>
<p>The new version has been altered to exploit a feature in the XCP
digital
rights management technology for Windows systems that comes bundled
with several
audio CDs from the Sony BMG record label. The software will
automatically
install the first time a user tries to play an infected audio CD on his
computer's CD Rom drive.</p>
<p>In addition to digital rights manament technology, CD also installs
a
so-called root kit that hides files from the user and the system,
including
anti-virus software. Security experts have argued that it is extremely
poorly
engineered and that worm authors can exploit it by simply placing the
characters
"$sys$" in front of a file name.</p>
<p>The new variant of the Stinx trojan tries to do exactly that.</p>
<p>"Sony started off with the right intentions but did not recognise
the
implications of what it was doing," said Graham Cluley, senior
technology
consultant at <a href="http://www.sophos.com/" target="_blank">Sophos</a>.</p>
<p>"We've had companies calling up all day asking what to do with this.
We feel
sorry for the musicians; if you look on
<a href="http://www.amazon.com/" target="_blank">Amazon</a> right now
reviewers
are telling people not to buy the album, not because of the music but
because of
the copy protection. <br>
</p>
<p>See the Full Story:
<a class="moz-txt-link-freetext" href="http://www.vnunet.com/vnunet/news/2145874/virus-writers-exploit-sony-drm">http://www.vnunet.com/vnunet/news/2145874/virus-writers-exploit-sony-drm</a></p>
</body>
</html>