Around August of 2005, some savvy developers discovered Sony had introduced stealthing tactics to try and keep people from copying music CDs, and possibly movie DVDs, in a PC. I am not going to repeat everything regarding this topic, because searching in Yahoo & Google for Sony BMG Root Kit will bring up many articles. The short of it is that Sony has agreed to stop using this practice. But, for those media that have this, the potential to install this application still exists.
. 2005-11-16 Update -- Here is a good article... E-Week: Security Vendors Clueless Over Rookit Invasion
. 2005-11-17 Update -- A Major RootKit Virus articcle... E-Week: AIM Rootkit Attack Traced to Middle East
What's Short Of It?
. For those not following the Digital Millennium Rights Act, the software, music and movie industry has been trying to combat piracy. And, this act makes it illegal to copy such things. So, Sony has included a supposed experience enhancement application to their discs. When inserted into a PC, an autoplay screen pops up asking if it OK to install. When it does install, it utilizes a root kit stealthing technique that allows it to run undetected... hidden.
Why Is This A Concern?
. Many persons who have done so have experienced unstable operating systems, afterward. In most instances, they end up having to reinstall Windows to resolve the issue. In other instances, CD & DVD drives begin to malfunction. This is especially true for the more savvy user who finds ways of uninstalling it.
. Now, virus writers have figured out how to use the Sony application to hide their applications. So, you could have a virus that not even your antivirus program can detect... much less remove.
Is There A Way To Know If I Have This Sony Application On My PC?
It turns out that there is. The Sony application looks for file names that start with $SYS$. So, an astute developer put a file on his desk top that started with these letters. If it ever disappears, he will know he has this particular root kit application running on his system.
. Use Notepad to create a text file and name it $SYS$ROOTKIT.TXT. Leave it on your desk top. If it ever goes away, you'll know why.
Whether it is good or bad that Sony wants this on your system is not the point of this article. But, the fact that it can be abused to put viruses on you system is the point. At this time, viruses have already been found that do this. And, it is won't be long before new ones show up that use different character strings to trigger the stealthing technique. Eventually, $SYS$ won't be the only thing that hides files.
|