more on the Sony Rootkit

[David Farber <dave () farber net>]

Begin forwarded message:

From: "Steven M. Bellovin" <smb () cs columbia edu>
Date: November 5, 2005 6:03:15 PM EST
To: dave () farber net
Subject: more on the Sony Rootkit

The Sony rootkit saga continues.  Mark Russinovich, who found the
original problem, notes several more:

        * the "fix" from Sony is not only incomplete and perhaps
        dangerous, you can't get it via the normal path without
        implicitly agreeing to a privacy policy that says your email
        address will be added to Sony marketing mailing lists.  (Hmm --
        I wonder if that's a violation of the CAN SPAM act.)

        * The patch produces strange error messages

        * The software phones home during player startup.  It appears
        to be seeing if there are updates for the lyrics or cover art,
        but of course it's also telling Sony (a) when the CD is played,
        and (b) what IP address it's coming from.  The trace posted
        by Russinovich is http, which (to me) raises the question of
        whether or not previously-set tracking cookies are accepted.
        I've verified that the site contacted (connected.sonymusic.com)
        does set a session cookie; that, at least, is innocuous.

As he points out, the real issue is full disclosure of what software
does, and what the user is actually agreeing to in the EULA.

                --Steven M. Bellovin, http://www.cs.columbia.edu/~smb



-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/