This is old news but VERY important to understand yet another angle of the NWO's total enslavement agenda. This directly parallels the "smart appliances" that will be governed by the "Smart (tyranny) grid".
First 4 Internet *LIES* about DRM scheme
Posted by on November 7, 2005 at 8:18 PM (printer friendly)
http://www.sysinternals.com/blog/2005/11/sonys-rootkit-first-4-internet.htmlinfo@first4internet.co.uk sales@first4internet.co.ukwebmaster@first4internet.co.ukTel: +44 (0)1295 255777 Fax: +44 (0)1295 262682
Nick Bingham Chairman Mathew Gilliat-Smith CEO
Tony Miles Operations & Technical Director
Peter Worrall Marketing & Research Director
Nick Drew ICA Business Development Manager
"Sony�s Rootkit: First 4 Internet Responds
First 4 Internet, the company that implements Sony�s Digital Rights Management (DRM) software that includes a rootkit, has responded to my last post, More on Sony: Dangerous Decloaking Patch, EULAs and Phoning Home. They rebut four of the points I raise in the post. Their first statement relates to my assertion that Sony�s player contacts Sony�s web site each time it runs and sends the site an ID associated with the CD the user is playing:
The player has a standard rotating banner that connects the user to additional content (e.g. provides a link to the artist web site). The player simply looks online to see if another banner is available for rotation. The communication is one-way in that a banner is simply retrieved from the server if available. No information is ever fed back or collected about the consumer or their activities.
I speculated that the player sends Sony�s web site a CD identifier as part of a check to see if new song lyrics or artwork was available, which they essentially confirm. Their claim that the communication is �one way� from Sony�s web site is false, however, since Sony can make a record of each time their player is used to play a CD, which CD is played, and what computer is playing the CD. If they�ve configured standard Web server logging then they are doing that. As I stated earlier, I doubt Sony is using this information to track user behavior, but the information allows them to do so. In any case, First 4 Internet cannot claim what Sony is or is not doing with the information since they do not control those servers, and the First 4 Internet response fails to address the fact that the End User License Agreement (EULA) and Sony executives either make no mention of the �phone home� behavior or explicitly deny it.
Another point that I made in the post is that the decloaking patch that Sony has made available weighs in at a relatively large 3.5 MB because it not only removes the rootkit, it also replaces most of the DRM files with updated versions. First 4 Internet responded with this:
In addition to removing the cloaking, Service Pack 2 includes all fixes from the earlier Service Pack 1 update. In order to ensure a secure installation, Service Pack 2 includes the newest version of all DRM components, hence the large file size for the patch. We have updated the language on our web site to be clearer on this point.
It�s not clear to me what they mean by �a secure installation�, but like most of the disclosure in this story, they�ve acknowledged the updating nature of the patch only after someone else has disclosed it first. What�s also lost in their response is that Sony DRM users not following this story as it develops have no way of knowing that there�s a patch available or that they even have software installed that requires a patch.
Further, Sony�s patch is dangerous because the way that it removes the cloak could crash Windows. I discussed the flaw in the patch�s decloaking method in the first post and again in the last one (I also provide a simple way for users to remove the cloak safely), yet First 4 Internet refuses to recognize it. They contest my claim in their comment:
This is pure conjecture. F4I is using standard Windows commands (net stop) to stop their driver. Nothing more.
While the probability of a crash is relatively small, its not �pure conjecture�, but fundamental to multithreaded programming concepts. Anyone that writes Windows device driver code must have a firm grasp of these concepts or they can easily introduce bugs and security holes into Windows. Here�s one of many scenarios that will lead to a crash when the patch decloaks Sony�s rootkit:
1. Thread A invokes one of the functions that Aries.sys, the Sony rootkit driver developed by First 4 Internet, has redirected
2. Thread A reads the address of the redirected function from the system service table, which points at the rootkit function in Aries.sys
3. Thread A executes the first few instructions of the Aries.sys function, which is enough to enter the driver, but not enough to execute the Aries.sys code that attempts to track threads running within it
4. Thread A is context swapped off the CPU by the Windows scheduler
5. The scheduler gives thread B the CPU, which executes the patch�s �unload driver� command, unloading the Aries.sys driver from memory
6. The scheduler runs thread A again, which executes memory that previously held the contents of Aries.sys, but is now invalid or holds other code or data
7. Windows detects thread A�s illegal execution and crashes the system with a blue screen
First 4 Internet�s failure to imagine this control flow is consistent with their general failure to understand Windows device driver programming.
As further evidence of this, I�ve performed further testing of the Aries.sys driver using a program I wrote, NTCrash2, and found that Aries.sys fails to perform basic checks on the data passed to it by applications. NTCrash2 passes randomly-generated invalid data to Windows APIs and on a stock Windows system simply receives error codes from the APIs. However, when NTCrash2 runs on a system that has the Sony rootkit installed Windows crashes. Here�s an example Windows blue screen that identifies Aries.sys as the cause of a crash that occurred while NTCrash2 ran:
Besides demonstrating the ineptitude of the First 4 Internet programmers, this flaw highlights my message that rootkits create reliability risks in addition to security risks. Because the software package that installed the rootkit is hidden when Windows is running (in this case Sony�s DRM software), and even if exposed not clearly identified, if an application triggers one of Aries.sys�s bugs a user would have no way of associating the driver responsible for the resulting crash with any software package they have installed on their system. The user would therefore be unable to conclusively diagnose the cause of the crash, check to see if they have the most recent version of the driver or of uninstalling the driver.
First 4 Internet and Sony also continue to argue that the rootkit poses no security vulnerability, repeating it in the description of the patch download. Any software that hides files, processes, and registry keys based on a prefix of letters can clearly be used by malicious software.
First 4 Internet�s final rebuttal relates to my complaint that as part of a request to uninstall their DRM software Sony requires you to submit your email address to their marketing lists. First 4 Internet says:
An email address is required in order to send the consumer the uninstall utility. The wording on the web site is the standard Sony BMG corporate privacy policy that is put on all Sony web sites. Sony BMG does nothing with the customer service data (email addresses) other than use them to respond to the consumer.
The Sony privacy policy the comment refers to clearly states that Sony may add a user�s email address to their marketing lists:
Except on sites devoted to particular recording artists, we may share the information we collect from you with our affiliates or send you e-mail promotions and special offers from reputable third parties in whose products and services we think you may have an interest. We may also share your information with reputable third-parties who may contact you directly.
Again, the fact is that most users of Sony�s DRM won�t realize that they even have software that can be uninstalled. Also, the comment does not explain why Sony won�t simply make the uninstaller available as a freely accessible download like they do the patch, nor why users have to submit two requests for the uninstaller and then wait for further instructions to be emailed (I still have not received the uninstaller). The only motivation I can see for this is that Sony hopes you�ll give up somewhere in the process and leave their DRM software on your system. I�ve seen similar strategies used by adware programs that make it difficult, but not impossible, for you to remove them.
Instead of admitting fault for installing a rootkit and installing it without proper disclosure, both Sony and First 4 Internet claim innocence. By not coming clean they are making clear to any potential customers that they are a not only technically incompetent, but also dishonest."
posted by Mark Russinovich @ 7:29 PM
First 4 Internet street address:
6 South Bar Street
Banbury
Oxfordshire
OX16 9AA
United Kingdom
Give these bastards HELL
info@first4internet.co.uk sales@first4internet.co.ukwebmaster@first4internet.co.ukTel: +44 (0)1295 255777 Fax: +44 (0)1295 262682
Nick Bingham Chairman Mathew Gilliat-Smith CEO
Tony Miles Operations & Technical Director
Peter Worrall Marketing & Research Director
Nick Drew ICA Business Development Manager
__________________________________________________________________
http://www.boycott-riaa.com/article/18634TrueAudio Date: November 8, 2005 @ 4:53 PM
The plot thickens (see actual site to see the screenshots)
http://www.sysinternals.com/Blog/I laughed when I read the following: "Thank you for contacting Sony BMG Online. Sony BMG and First 4 Internet have released an update that will reveal and remove the original rootkit-based DRM content protection replace it with non-rootkit DRM technology....-- UMM, YEAH, catch a f**king clue? Trying to validate the existence of the DRM claiming the rootkit is the only bad part? LOL, try again. No one wants the DRM period and the implementation of a rootkit ONLY shows why the DMCA must be striken off the law books forever, with huge fines and prison time for anyone who creates DRM in the firstplace.
Now for the second part "If you still wish to fully uninstall our DRM software..." --wow lets hold it right there. BEHOLD, the perpetrator THEMSELVES realizing that they have brought this upon themselves (not quite but at least an inkling). Hahaha, this puts the screws right to these scumbags. THEY have to offer a full uninstall themselves and in so doing SONY, a.k.a. the RIAA is about to commit a FELONY by violating THEIR OWN piece of shit legislation, the DMCA. Hahahaha, f**k you you bastards, you have fallen to your own corruption, and it is just the beginning. Behold the power of what you sow, you shall also reap!!!!!
"EULAs and Disclosure: Sony's Player Phones Home
There's more to the story than rootkits, however, and that's where I think Sony is missing the point. As I've pointed out in press interviews related to the post, the EULA does not disclose the software's use of cloaking or the fact that it comes with no uninstall facility. An end user is not only installing software when they agree to the EULA, they are losing control of part of the computer, which has both reliability and security implications. There's no way to ensure that you have up-to-date security patches for software you don't know you have and there's no way to remove, update or even identify hidden software that's crashing your computer.
The EULA also makes no reference to any "phone home" behavior, and Sony executives are claiming that the software never contacts Sony and that no information is communicated that could track user behavior. However, a user asserted in a comment on the previous post that they monitored the Sony CD Player network interactions and that it establishes a connection with Sony's site and sends the site an ID associated with the CD.
I decided to investigate so I downloaded a free network tracing tool, Ethereal, to a computer on which the player was installed and captured network traffic during the Player's startup. A quick look through the trace log confirmed the users comment: the Player does send an ID to a Sony web site. This screenshot shows the command that the Player sends, which is a request to an address registered to Sony for information related to ID 668, which is presumably the CD's ID:
In response the Sony web site reports the last time a particular file was updated:
I dug a little deeper and it appears the Player is automatically checking to see if there are updates for the album art and lyrics for the album it's displaying. This behavior would be welcome under most circumstances, but is not mentioned in the EULA, is refuted by Sony, and is not configurable in any way. I doubt Sony is doing anything with the data, but with this type of connection their servers could record each time a copy-protected CD is played and the IP address of the computer playing it.
The media has done a great job of publicizing this story, which has implications that extend beyond DRM to software EULAs and disclosure, and I hope that the awareness they're creating will result in Congressional action. Both the software industry and consumers need laws that will clearly draw lines around acceptable behaviors."
_______________________________________________________
TrueAudio
Date: November 8, 2005 @ 6:03 PM
"No comments" - baloney
Reader post by: Wally Bass
Posted on: Wed Nov 02 19:23:09 PST 2005
Story: Sony CD protection sparks security concerns
>>"I think this is slightly old news,"Gilliat-
Smith said. "For the eight months that these CDs have been out, we haven't had any comments about malware (malicious software) at all."
TrueAudio
Date: November 8, 2005 @ 6:06 PM
oops let me repost this
>>"I think this is slightly old news,"Gilliat-
Smith said. "For the eight months that these CDs have been out, we haven't had any comments about malware (malicious software) at all."
________________________________________________________
TrueAudio
Date: November 8, 2005 @ 6:09 PM
aarggh ldunno whats going on here
Let me translate this.
"Since most people lack the skills of
Russinovich, no one else so far has been able to track any of the system failures that we have induced back to us. You see, we spent an extraordinary amount of time covering our tracks by cloaking things that people would normally able to see in their systems.
"As to the (probably thousands of) poor smucks whose CD disappeared due to our code, or who blue screened, or whatever, and who spend hours trying to figure out what was wrong, and then more hours rebuilding their systems - well - who cares. They didn't trace it back to us - it doesn't affect our bottom line."
I really love his attitude: "well, we knew that we screwed you eight months ago - boy are you guys dummies that you only now have figured it out."
Hopefully, a good case will be made against these clowns, and Sony will pay heavily though a class action suit, and in the marketplace. With a little luck, maybe someone will even do some jail time.
http://news.com.com/5208-7355-0.html?forumID=1&threadID=11069&messageID=82524&start=-1