April 19, 2024

Posts Comments

Update: Sony Uninstaller Hole Stays Open

November 15, 2005 by

Earlier today Ed Felten and I reported a serious security hole opened by the uninstaller that Sony provides to users who want to remove the First4Internet copy protection software. Further testing has confirmed that computers remain vulnerable even after the uninstall process is complete.

Sony’s web-based uninstaller is a three step process:

  1. You fill out an uninstall request on Sony’s web site.
  2. Sony sends you an email with a link to a second request form. When you follow this link, Sony’s site automatically installs a piece of software–an ActiveX control created by First4Internet–called CodeSupport.
  3. After delay, Sony sends another email with a link to a third web page that removes the copy protection software. However, the CodeSupport component remains on your computer indefinitely.

Due to a serious design flaw, the CodeSupport component allows any web site you visit to download and run software on your computer. A malicious web site author can write an evil program, package up that program appropriately, put the packaged code at some URL, and then write a web page that causes CodeSupport to download and run code from that URL. If you visit that web page with Internet Explorer, and you have previously performed at least step 2 of Sony’s uninstall process, then the evil program will be downloaded, installed, and run on your computer, immediately and automatically. Your goose will be cooked.

You can tell whether you are vulnerable by visiting our CodeSupport detector page.

If the component is installed, you should try to remove it using the instructions from our earlier post. However, this may not be enough to prevent the software from being installed again, depending on your security settings. If you have been exposed, the safest thing to do is to avoid using Internet Explorer until you receive a fix from Sony and First4Internet. Firefox should be a safe alternative.

UPDATE (11/16, 2am): Sony has removed the initial uninstaller request form (step 1, above). In its place is the following message:

November 15th, 2005 – We currently are working on a new tool to uninstall First4Internet XCP software. In the meantime, we have temporarily suspended distribution of the existing uninstall tool for this software. We encourage you to return to this site over the next few days. Thank you for your patience and understanding.

This is a positive step that will help prevent additional users from being exposed to the flawed component, but customers who already used the web-based uninstaller remain at risk.

Filed Under: Uncategorized Tagged With: , , ,

Sony Shipping Spyware from SunnComm, Too

November 11, 2005 by

Now that virus writers have started exploiting the rootkit built into Sony-BMG albums that utilize First4Internet’s XCP DRM (as I warned they would last week), Sony has at last agreed to temporarily stop shipping CDs containing the defective software:

We stand by content protection technology as an important tool to protect our intellectual property rights and those of our artists. Nonetheless, as a precautionary measure, SONY BMG is temporarily suspending the manufacture of CDs containing XCP technology. We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use.

What few people realize is that Sony uses another copy protection program, SunnComm‘s MediaMax, on other discs in their catalog, and that this system presumably is not included in the moratorium. Though MediaMax doesn’t resort to concealing itself with a rootkit, it does behave in several ways that are characteristic of spyware.

I originally wrote about MediaMax back in 2003. It was the first copy restricting technology that installed software in an attempt to block ripping and copying. SunnComm has continued to develop its anti-copying tools, and today MediaMax is distributed on albums from Sony-BMG and several smaller labels. Sony titles that use MediaMax include Grown and Sexy by Babyface and Z by My Morning Jacket. These discs aren’t hard to spot; the back album covers usually contain a label that includes a sunncomm.com URL.

Like XCP, recent versions of MediaMax engage in spyware-style behavior. They install software without meaningful consent or notification, they include either no means of uninstalling the software or an uninstaller that claims to remove the entire program but doesn’t, and they transmit information about user activities to SunnComm despite statements to the contrary in the end user license agreement and on SunnComm’s web site. I’ll describe each of these problems in detail below.

1. MediaMax installs without meaningful consent or notification

When a MediaMax-protected CD is inserted into a computer running Windows, the Windows Autorun feature launches a program from the CD called PlayDisc.exe. Like most installers, this program displays a license agreement, which you may accept or decline. But before the agreement appears, MediaMax installs around a dozen files that consume more than 12 MB on the hard disk. Most are copied to the folder c:Program FilesCommon FilesSunnComm Shared, shown below:

These files remain installed even if you decline the agreement. One of them, a kernel-level driver with the cryptic name “sbcphid”, is both installed and launched. This component is the heart of the copy protection system. When it is running, it attempts to block CD ripping and copying applications from reading the audio tracks on SunnComm-protected discs. MediaMax refrains from making one final change until after you accept the license—it doesn’t set the driver to automatically run again every time Windows starts. Nevertheless, the code keeps running until the computer is restarted and remains on the hard disk indefinitely, even if the agreement is declined. [Update 11/28: In several common scenarios, MediaMax goes a step further and sets the driver to automatically run again every time Windows starts, even if the user has never agreed to the license.]

To see if SunnComm’s driver is present on a Windows XP system, open the start menu and select Run. In the box that pops up, type

cmd /k sc query sbcphid

and click OK. If the response includes “STATE: 1 STOPPED”, the driver is installed; if it includes “STATE: 4 RUNNING”, the driver is installed and actively restricting access to music. Alternately, you can look for the driver’s file, sbcphid.sys, which will be located in the c:windowssystem32drivers folder if it is installed.

(Newer version of SunnComm’s software can also block copying on Mac systems, as reported by MacInTouch. However, since Mac OS X does not automatically run software from CDs, Mac users will only be affected if they manually launch the installer.)

Is there any meaningful notice before the program is installed? On the contrary, the Sony license agreement (which happens to be identical to the agreement on XCP discs, despite significant differences between XCP and MediaMax) states that the software will not be installed until after you accept the terms:

As soon as you have agreed to be bound by the terms and conditions of the EULA, this CD will automatically install a small proprietary software program (the “SOFTWARE”) onto YOUR COMPUTER. The SOFTWARE is intended to protect the audio files embodied on the CD, and it may also facilitate your use of the DIGITAL CONTENT. Once installed, the SOFTWARE will reside on YOUR COMPUTER until removed or deleted.

Notice too that while the agreement partially describes the protection software, it fails to disclose important details about what the software does. Yes, the MediaMax driver tries to “protect the audio files embodied on the CD,” but it also attempts to restrict access to any other CD that use SunnComm’s technology. You only need to agree to installation on one album for the software to affect your ability to use many other titles.

2. MediaMax discs include either no uninstaller or an uninstaller that fails to remove major components of the software

None of the MediaMax albums I’ve seen from Sony-BMG include any option to uninstall the software. However, some titles from other labels do include an uninstall program. For instance, the album You Just Gotta Love Christmas by Peter Cetera (Viastar Records) adds MediaMax to the Windows Add/Remove Programs control panel, the standard interface for removing programs. If you elect to remove the software, it displays the following prompt:

Clicking “Yes” does cause parts of MediaMax to be deleted, including nearly all the files in the SunnComm shared folder. However, the protection driver remains installed and active despite the suggestion that “MediaMax and all of its components” would be removed. That means iTunes and other programs still cannot access music for any SunnComm-protected CD.

[Update: Apparently SunnComm was providing an uninstaller to users who persistently demanded one, but the uninstaller opened a severe security hole in users’ systems.]

3. MediaMax transmits information about you to SunnComm without notification or consent

Sony and SunnComm seem to go out of their way to suggest that MediaMax doesn’t collect information about you. From the EULA:

[T]he SOFTWARE will not be used at any time to collect any personal information from you, whether stored on YOUR COMPUTER or otherwise.

SunnComm’s customer care web page is equally explicit:

Is any personal information collected from my computer while using this CD?:
No information is ever collected about you or your computer without you consenting.

Yet like XCP, the MediaMax software “phones home” to SunnComm every time you play a protected CD. Using standard network monitoring tools, you can observe MediaMax connecting to the web server license.sunncomm2.com and sending the following request headers:

POST /perfectplacement/retrieveassets.asp?id=
   7F63A4FD-9FBD-486B-B473-D18CC92D05C0 HTTP/1.1
Accept: */*
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: license.sunncomm2.com
Content-Length: 39
Connection: Keep-Alive
Cache-Control: no-cache

This shows that MediaMax opens a web page from a SunnComm server and sends a 32-character identifier (highlighted)—apparently a unique code that tells SunnComm what album you’re listening to. The request also contains standard HTTP headers from which the company can learn what operating system you are running (in the above example, NT 5.1, a.k.a. Windows XP) and what version of Internet Explorer you use (here, IE 6).

SunnComm also gets to observe your computer’s IP address, which is transmitted to every Internet server you connect to. You are assigned an IP address by your Internet service provider or system administrator. Many users are issued frequently changing “dynamic” IP addresses that make it difficult to track them individually, but others have fixed, “static” addresses. If you have a fixed address, SunnComm can piece together the messages from your computer to find out all the protected discs you listen to and how often you play them. In some cases, such as if you are a Princeton student, knowing the address is enough to let SunnComm track down your name, address, and phone number.

So why does MediaMax contact a SunnComm server in the first place? The server’s response to the above request isn’t very informative:

Microsoft VBScript runtime

error ‘800a000d’

Type mismatch: ‘ubound’

/perfectplacement/retrieveassets.asp, line 26

Apparently a bug in the server software prevents it from returning any useful information. However, the name “Perfect Placement” in the URL provides a valuable clue about the server’s purpose. A SunnComm web page describes “Perfect Placement” as a MediaMax feature that allows record labels to “[g]enerate revenue or added value through the placement of 3rd party dynamic, interactive ads that can be changed at any time by the content owner.” Presumably the broken site is supposed to return a list of ads to display based on the disc ID.

Just because the server software is buggy doesn’t mean it isn’t collecting data. If SunnComm’s web site is configured like most web servers, it logs the information described above for every request. We can’t know for certain what, if anything, SunnComm does with the data, but that’s why transmitting it at all raises privacy concerns.

…

To summarize, MediaMax software:

  • Is installed onto the computer without meaningful notification or consent, and remains installed even if the license agreement is declined;
  • Includes either no uninstall mechanism or an uninstaller that fails to completely remove the program like it claims;
  • Sends information to SunnComm about the user’s activities contrary to SunnComm and Sony statements and without any option to disable the transmissions.

Does MediaMax also create security problems as serious as the Sony rootkit’s? Finding out for sure may be difficult, since the license agreement specifically prohibits disassembling the software. However, it certainly causes unnecessary risk. Playing a regular audio CD doesn’t require you to install any new software, so it involves minimal danger. Playing First4Internet or SunnComm discs means not only installing new software but trusting that software with full control of your computer. After last week’s revelations about the Sony rootkit, such trust does not seem well deserved.

Viewed together, the MediaMax and XCP copy protection schemes reveal a pattern of irresponsible behavior on the parts of Sony and its pals, SunnComm and First4Internet. Hopefully Sony’s promised re-examination of its copy protection initiatives will involve a hard look at both technologies.

Filed Under: Uncategorized Tagged With: , , ,

CD DRM Makes Computers Less Secure

November 1, 2005 by

Yesterday, Sysinternals’s Mark Russinovich posted an excellent analysis of a CD copy protection system called XCP2. This scheme, created by British-based First4Internet, has been deployed on many Sony/BMG albums released in the last six months. Like the SunnComm MediaMax system that I wrote about in 2003, XCP2 uses an “active” software-based approach in an attempt to stifle ripping and copying. The first time an XCP2-protected CD is inserted into a Windows system, the Windows Autorun feature launches an installer, which copies a small piece of software onto the computer. From then on, if the user attempts to copy or rip a protected CD, the software replaces the music with static.

This kind of copy protection has several weaknesses. For instance, users can prevent the active protection software from being installed by disabling autorun or by holding the shift key (which temporarily suspends autorun) while inserting protected discs. Or they can remove the software once it’s been installed, as was easily accomplished with the earlier SunnComm technology. Now, it seems, the latest innovations in CD copy protection involve making the protection software harder to uninstall.

What Russinovich discovered is that XCP2 borrows techniques from malicious software to accomplish this. When XCP2 installs its anti-copying program, it also installs a second component which serves to hide the existence of the software. Normally, programs and data aren’t supposed to be invisible, particularly to system administrators; they may be superficially hidden, but administrators need to be able to see what is installed and running in order to keep the computer secure. What kind of software would want to hide from system administrators? Viruses, spyware, and rootkits (malicious programs that surreptitiously hand over control of the computer to a remote intruder). Rootkits in particular are known for their stealthiness, and they sometimes go to great lengths to conceal their presence, as Russinovich explains:

Rootkits that hide files, directories and Registry keys can either execute in user mode by patching Windows APIs in each process that applications use to access those objects, or in kernel mode by intercepting the associated kernel-mode APIs. A common way to intercept kernel-mode application APIs is to patch the kernel’s system service table, a technique that I pioneered with Bryce for Windows back in 1996 when we wrote the first version of Regmon. Every kernel service that’s exported for use by Windows applications has a pointer in a table that’s indexed with the internal service number Windows assigns to the API. If a driver replaces an entry in the table with a pointer to its own function then the kernel invokes the driver function any time an application executes the API and the driver can control the behavior of the API.

Sure enough, XCP2 adopts the latter technique to conceal its presence.

Russinovich is right to be outraged that XCP2 employs the same techniques against him that a malicious rootkit would. This makes maintaining a secure system more difficult by blurring the line between legitimate and illegitimate software. Some users have described how the software has made their anti-virus programs “go nuts,” caused their system to crash, and cost them hours of aggravation as they puzzled over what appeared to be evidence of a compromised system.

But things are even worse than Russinovich states. According to his writeup, the XCP driver is indiscriminant about what it conceals:

I studied the driver’s initialization function, confirmed that it patches several functions via the system call table and saw that its cloaking code hides any file, directory, Registry key or process whose name begins with “$sys$”. To verify that I made a copy of Notepad.exe named $sys$notepad.exe and it disappeared from view.

Once the driver is installed, there’s no security mechanism in place to ensure that only the XCP2 software can use it. That means any application can make itself virtually invisible to standard Windows administration tools just by renaming its files so that they begin with the string “$sys$”. In some circumstances, real malicious software could leverage this functionality to conceal its own existence.

To understand how, you need to know that user accounts on Windows can be assigned different levels of control over the operation of the system. For example, some users are granted “administrator” or “root” level access—full control of the system—while others may be given more limited authority that allows them to perform every day tasks but prevent them from damaging other users’ files or impairing the operation of the computer. One task that administrators can perform that unprivileged users cannot is install software that uses the cloaking techniques that XCP2 and many rootkits employ. (Indeed, XCP2 is unable to install unless the user running it has administrator privileges.)

It’s a good security practice to give users as little permission as they need to do their jobs—we call this the “Principle of Least Privilege” in the security trade—because, among other reasons, it restricts the activities of malicious software. If every user on a system has administrator access, any malicious programs that become installed can put up their own cloaking mechanisms using the same techniques that XCP2 uses. However, consider what happens when there are multiple accounts on the system, some with Administrator access and some with more limited control. Such a setup is fairly common today, even on family computers. If the administrator uses a CD that installs XCP2, the XCP2 cloaking driver will be available to applications installed by any user on the system. Later, if one of the unprivileged users installs some malware, it can use the XCP2 driver to hide itself from the user and the Administrator, even though it wouldn’t have permission to perform such cloaking on its own.

This kind of security bug is called a “privilege escalation vulnerability.” Whenever such a vulnerability is discovered in Windows, Microsoft quickly rolls out a patch. If Sony and First4Internet have any regard for their customers’ security, they must immediately issue a fix for this serious problem.

Copy protection vendors admit that their software is merely a “speedbump” to copyright infringement, so why do they resort to such dangerous and disreputable means to make their systems only marginally more difficult to bypass? One of the recording industry’s favorite arguments why users should avoid P2P file sharing is that it can expose them to spyware and viruses. Thanks to First4Internet’s ill-conceived copy protection, the same can now be said of purchasing legitimate CDs.

In case you haven’t already disabled Autorun, now might be a good time.

Filed Under: Uncategorized Tagged With: , ,

Berkeley to victims of personal data theft: "Our bad"

April 20, 2005 by

Last week I and 98,000 other lucky individuals received the following letter:

University of California, Berkeley
Graduate Division
Berkeley, California 94720-5900

Dear John Alexander Halderman:

I am writing to advise you that a computer in the Graduate Division at UC Berkeley was stolen by an as-yet unidentified individual on March 11, 2005. The computer contained data files with names and Social Security numbers of some individuals, including you, who applied to be or who were graduate students, or were otherwise affiliated with the University of California.

At this time we have no evidence that personal data were actually retrieved or misused by any unauthorized person. However, because we take very seriously our obligation to safeguard personal information entrusted to us, we are bringing this situation to your attention along with the following helpful information.

You may want to take the precaution of placing a fraud alert on your credit file. This lets creditors know to contact you before opening new accounts in your name. This is a free service which you can use by calling one of the credit bureau telephone numbers:

Equifax 1-800-525-6285     Experian 1-888-397-3742     Trans Union 1-800-680-7289

To alert individuals that we may not have reached directly, we have issued a press release describing the theft. We encourage you to check for more details on our Web site at http://newscenter.berkeley.edu/security/grad. The following Web sites and telephone numbers also offer useful information on identity theft and consumer fraud.

California Department of Consumer Affairs, Office of Privacy Protection:
http://www.privacy.ca.gov/cover/identitytheft.htm

Federal Trade Commission’s Website on identity theft: http://www.consumer.gov/idtheft/

Social Security Administration fraud line: 1-800-269-0271

Unfortunately, disreputable persons may contact you, falsely identifying themselves as affiliated with US Berkeley and offer to help. Please be aware that UC Berkeley will only contact you if you ask us, by email or telephone, for information. We recommend that you do not release personal information in response to any contacts of this nature that you have not initiated.

UC Berkeley deeply regrets this possible breach of confidentiality. Please be assured that we have taken immediate steps to further safeguard the personal information maintained by us. If you have any questions about this matter, please feel free to contact us at or toll free at 1-800-372-5110.

Sincerely,
Jeffrey A. Reimer
Associate Dean

In a few days I’ll post more about my experience with the “fraud alert” procedure.

UPDATE 11:45pm – I should add that I gave Berkeley my ‘personal data’ when I applied to their computer science PhD program in 2003. (I ended up at Princeton.) Why, two years later, are they still holding on to this information?

Filed Under: Uncategorized Tagged With:

Grokster: The Case is Submitted

March 31, 2005 by

Greetings Freedom to Tinker readers! I’m Alex Halderman, one of Ed Felten’s grad students at Princeton. I’d like to thank Ed for the opportunity to be a regular contributor to this site.

On Tuesday I had the privilege of attending the MGM v. Grokster oral arguments along with several students from Ed’s Information Technology and the Law seminar. The class spent weeks discussing the Grokster case, and our field trip to Washington afforded a rare opportunity to witness the legal process in person instead of just on paper. We camped overnight outside the court to secure seats for what proved to be a fascinating argument. Some of the students have posted commentaries [1, 2, 3] and photographs [1,2,3,4], of which this is my favorite.

It was difficult to tell what the Justices were thinking, since their questions deeply probed the arguments from both sides of the case, but I was left with the impression that they are leaning towards a revision or reinterpretation of secondary liability law. None of their questions directly addressed Grokster’s argument that the matter should be deferred to Congress, and Justice Scalia emphasized that the case certainly wouldn’t hinge on stare decisis. In contrast, what a new liability test might look like was a recurring theme.

MGM argued that businesses centered on infringement should not be seen as engaged in “substantially unrelated areas of commerce” as required by the Betamax test. Several Justices questioned whether this reading would make it too easy for copyright holders to intimidate creators of new technologies. Justice Breyer wondered whether the creators of the iPod, the VCR, or the Guttenberg press would have feared liability under such a test, Justice Scalia asked whether new technologies would need to be given a decade or more to prove their non-infringing uses before such a standard could be applied, and Justice Souter worried about the fate of lone innovators without access to expensive legal guidance (the “guy in his garage”). Clearly, Grokster’s council and amici have done a commendable job explaining these issues to the Court, and I’m relived to say that the worst-case outcomes, such as a complete replacement of the bright line protections for innovation afforded by the Betamax test, no longer seem likely.

On the other hand, some of the Justices were no more receptive to Grokster’s interpretation of the Betamax defense, under which products “merely capable of substantial non-infringing use” would not be subject to liability. Justice Ginsberg called this an overly simplistic reading of Sony and pointed out that the decision continues for 13 pages of nuanced discussion after the phrase cited by Grokster. She also emphasized differences between Grokster’s product and the Betamax: the primary use of the Betamax was found to be non-infringing, but the district court in the present case established that at least 90% of Grokster’s traffic infringed.

What most surprised me was that several Justices repeatedly asked about a standard barely mentioned in the main briefs from either side: a so-called “active inducement” test. Inducement is a concept borrowed from patent law under which parties can be held liable for encouraging others to misappropriate protected intellectual property. Tests based on active inducement were discussed in the U.S. Government’s amicus brief (filed in support of MGM) and in the IEEE’s amicus brief (filed in support of neither party). The Induce Act, debated in Congress last summer, would have created a test based on an inducement theory, but it was widely criticized for giving copyright holders too much control over new technologies and making it too easy for them to bring frivolous lawsuits. IEEE, which opposed the Induce Act, says its model of an inducement test would require a much higher standard of proof involving evidence that parites committed overt acts of encouragement, not merely that they failed to do all they could to prevent illegal copying.

Several questions about inducement came from Justice O’Connor, who cast the deciding vote in the Betamax case. She asked MGM’s lawyer whether inducement was a way to resolve the case. Along with Justice Scalia, she seemed skeptical of Grokster’s attempt to separate out its past actions that could be seen as inducing infringement. Those acts do apply to the current case, Scalia insisted, because they were what developed Grokster’s current clientele. Scalia also wondered whether an active inducement standard would go far enough. Couldn’t a successor build a product identical to Grokster, he asked, but escape liability by being careful not to induce? Both MGM’s counsel, Donald Verrilli, and Paul Clement, speaking for the Government, responded that inducement would not be a sufficient remedy. Creators of future file sharing products would be careful not to leave a paper trail documenting their inducement, Verrilli warned.

Despite these objections, I think it is plausible that the Court will craft a narrow active inducement test resembling the IEEE proposal. This is likely for several reasons. Such a test would be neutral with respect to technology, thus creating a precedent applicable to much more than peer-to-peer file sharing. It would be responsive to the worries of technologists by clearly defining how innovators would need to act to avoid liability, yet it would also allow the courts to hold Grokster accountable because of its past encouragement of infringement. Inducement would function as a parallel category of liability complementing Sony, so the Court could leave the celebrated Betamax test intact. With both rules in place, defendants would need to demonstrate substantial non-infringing uses of their products and refrain from overtly encouraging infringement. Perhaps the most attractive feature of an inducement test is that both the Government, which sided with the content industry, and the pro-technology IEEE support it in some form. This is the closest thing to a compromise that we have seen in the case. Neither Grokster nor MGM would be wholly satisfied with a narrow inducement test, but it could potentially cure the most imminent harms cited by the copyright owners while causing minimal collateral damage to innovation.

Now the waiting begins. We’ll find out what the Justices were really thinking in a few months when the Court issues its decision.

Filed Under: Uncategorized Tagged With: