DVD Jon's Code In Sony Rootkit?

Found on Slashdot on Wednesday, 16 November 2005
Browse Legal-Issues

With some help from Sabre Security, Sebastian Porst and Matti Nikki have identified some stolen GPL'd code in Sony's rootkit. Ironically the code in question seems to be VLC's demux/mp4/drms.c -- the de-DRMS code which circumvents Apple's DRM, written by 'DVD' Jon Lech Johansen and Sam Hocevar.

Just another update. LGPL, GPL, DMCA, EUCD violations... Looks like this little rootkit from Sony really violates about everything and comes with integrated blacklists. Also, their uninstaller isn't much better it seems. Some more research reveals some nasty leftovers; like a RebootMachine and ExecuteCode method which both can be exploited. I really hope Sony gets slammed for this, and not just First 4 Internet who came up with the software. Because if Sony can get out of this without any problems, they will keep on using small companies to do the dirty work.

Microsoft claims firms 'hitting a wall' with Linux

Found on Vnunet on Tuesday, 15 November 2005
Browse Software

Microsoft today released the findings of an independent report claiming that the Windows platform is "more consistent, predictable and easier to manage than Linux".

The study, commissioned by the software giant from Security Innovation, a provider of application security services, claimed that Linux administrators took 68 per cent longer to implement new business requirements than their Windows counterparts.

"This study shows that IT administrators are better able to maintain the system while delivering new capabilities predictably and consistently on the Windows platform."

I always like to compare the "Administrator" and "root" here: sometimes, when a process acts weird and you try to end it in Windows, you get an error, and it keeps on running, usually forcing you to reboot the machine. Under Linux, you issue a "kill -9" in the worst case, and the process goes down.

'Spyware' vendor bangs copyright shield

Found on The Register on Monday, 14 November 2005
Browse Software

RetroCoder, developers of the SpyMon remote monitoring program, is brandishing copyright law in a bid to protect its software from being detected by anti-spyware or anti-virus products.

SpyMon is marketed as a means for the paranoid to surreptitiously monitor the activities of their partners or kids online - behaviour that has brought it to the attention of security vendors.

"If you do produce a program that will affect this softwares ability to perform its function then you may have to prove in criminal court that you have not infringed this warning. Infringement of a copyright licence is a criminal offence," RetroCoder's End User Licensing Agreement (EULA) states.

It's questionable whether this agreement would withstand legal challenge but RetroCoder is making good on its threat to take security vendors to task for detecting its product. Anti-spyware maker Sunbelt Software has been sent a nastygram threatening legal action against it for labelling SpyMon as spyware.

Don't complain about being unliked and monitored when you make a software that is questionable.

Sony's rootkit infringes on software copyrights

Found on Boing Boing on Sunday, 13 November 2005
Browse Various

Close examination of the rootkit that Sony's audio CDs attack their customers' PCs with has revealed that their malicious software is built on code that infringes on copyright. Indications are that Sony has included the LAME music encoder, which is licensed under the Lesser General Public License (LGPL), which requires that those who use it attribute the original software and publish some of the code they write to use the library. Sony has done none of this.

The evidence against Sony is compelling, and this further reveals the hypocrisy of Sony's actions. Sony claims that it needs to install dangerous, malicious, underhanded software on its customers' computers to protect its copyrights, but in order to write this malware, it has no compunction about infringing on the copyrights of public-spirited software authors who make their works available under free software licenses like the GPL.

It seems to be impossible to avoid news about Sony at the moment. Especially with all those juicy details that are coming out piece after piece. Sony's "do as we say, don't do as we do" way isn't really helping to convince people; why should copyright be important if they break it? Everything that hit the news in the last few weeks isn't helping at all. But I'm quite confident that Sony will top even those news in a few days. Nothing is unimaginable right now.

Now the Legalese Rootkit: Sony-BMG's EULA

Found on Electronic Frontier Foundation on Saturday, 12 November 2005
Browse Legal-Issues

If you thought XCP "rootkit" copy-protection on Sony-BMG CDs was bad, perhaps you'd better read the 3,000 word (!) end-user license agreement (aka "EULA") that comes with all these CDs.

If your house gets burgled, you have to delete all your music from your laptop when you get home.

You can't keep your music on any computers at work.

If you move out of the country, you have to delete all your music.

You must install any and all updates, or else lose the music on your computer.

Sony-BMG can install and use backdoors in the copy protection software or media player to "enforce their rights" against you, at any time, without notice.

The EULA says Sony-BMG will never be liable to you for more than $5.00.

If you file for bankruptcy, you have to delete all the music on your computer.

You have no right to transfer the music on your computer, even along with the original CD.

Forget about using the music as a soundtrack for your latest family photo slideshow, or mash-ups, or sampling.

Ok, it looks like Sony won't be out of the news in the next few weeks. Their idea of what's right and wrong is seriously way off. Having to choose between their "license" and an illegal copy, I would get copy for sure. From the moral aspect, the copy is the better solution.

US DoJ offers to jail copyright infringers

Found on The Register on Friday, 11 November 2005
Browse Legal-Issues

US Attorney General Alberto Gonzales has proposed tough new copyright enforcement laws that would criminalise consumers simply for trying to make unauthorised copies of music, movies and software, whether they are successful or not.

Dubbed the Intellectual Property Protection Act of 2005 (IPPA), the bill, which has yet to be put before the US Congess, seeks to provide harsher penalties for copyright infringers, in particular those who do so persistently.

For tougher sentences, think not only bigger fines, but also jail terms, the seizure of equipment used to make illegal copies and the payment of compensation to the owner of the copied work, Gonzales indicated.

Gonzales' IPPA proposal comes after the US Supreme Court ruled that anyone seen to be knowingly aiding and abetting copyright infringement can be sued by copyright holders. That judgement led to renewed efforts by the Recording Industry Ass. of America (RIAA) to force P2P companies to block copyright infringement and to obtain licences to allow copyright works to be shared.

If you share files, you go to jail, just like all the other terrorists. Is there nobody at the top who thinks this is a little too weird? There was something like the evolution of the market once, but now it's all about criminalizing those who don't like your ideas of a controlled and unfair market. There's not much to say about Gonzales, except that he's from Texas and a buddy of Dubya. More details are available at Wikipedia.

Russia offers football thugs to France

Found on Ananova on Thursday, 10 November 2005
Browse Various

A Russian politician has offered to send the country's violent football thugs to France to sort out the rioters.

Far right politician Vladimir Zhirinovsky says he already has hundreds of volunteers many with special forces training.

In a telegram sent to France, Zhirinovsky, who is also Deputy Speaker of the Duma, said: "We are ready with volunteer units of football fans and activists who have served in military combat hot spots."

"I am convinced that our initiative would restore total order and calm the rioting within 48 hours."

French authorities have had to use emergency powers in a bid to tackle rioters who have swept the country in the last two weeks.

Now that's international help.

If You're Bankrupt, You Must Delete All Music

Found on Techdirt on Wednesday, 09 November 2005
Browse Various

While, at some level, this seems like just piling on to the PR disaster facing Sony-BMG following the rootkit fiasco, it's still important to highlight some of the ridiculous things the company has done. After telling everyone that rootkits don't matter, because no one knows what they are, and doing various other questionable moves -- almost all of which amount to "trust us," some people decided to figure out just what kind of bargain they were getting when they trust Sony-BMG. While it's already been shown that the end user license agreement that comes with Sony's copy protected CDs doesn't disclose the rootkit functionality that weakens the security on your computer and is quite difficult to uninstall without breaking parts of your computer -- and also doesn't disclose that the CD phones home occasionally -- there's a lot of things that the EULA does tell you. The folks at the EFF went through it and pulled out some of the more ridiculous terms. By far, the absolute best term in the EULA is that if you file for bankruptcy, you need to delete the music. Recall, of course, that when you buy a standard, non-copy protected CD, there is no EULA at all. However, Sony would apparently prefer that all of you out there who have gone through any form of bankruptcy didn't listen to their music.

It's just like if Sony tries to kill itself. They are really successful so far.

No pre-owned games to be allowed for PS3

Found on Sony on Tuesday, 08 November 2005
Browse Software

A patent may allow Sony to ensure that no game would be playable from any console other than the one in which it was first read.

The technology would allow an authentication code to be read and then rendered unreadable, making the software unplayable on any machine but the one which first read it.

But this has caused considerable backlash from the gaming community. While many are aware of the double profit companies make on pre-owned games, this would ensure the death of trading games between friends and even going to a friend's house to play a little multiplayer.

While the PS3 hasn't been expressly mentioned in the patent in English or Japanese it would be the obvious place to employ this new technology, regardless of how little gamers will appreciate it. Between this and the DRM scandal, Sony could be looking at a serious drop in interest in the PS3.

Sony and DRM, the neverending story. Less people will buy a PS3, more people will try to break the DRM, and Sony will whine again. I already can hear all the complains about how evil the gamers are and how much their hurt poor Sony.

Online Terror Threat Hits Local High School

Found on WOAI on Monday, 07 November 2005
Browse Various

All but 400 of the 3,000 students at San Antonio Warren High School either didn't show up or walked out of class today due to threats against the school posted on a popular teen web site, 1200 WOAI news reported today.

"About mid morning today we were able to confirm that the web site 'MySpace-dot-com' allowed several students to post threatening messages on it's web site, messages threatening Warren High School," Pascual Gonzales of the Northside School District said. "This message said two boys were planning to show up at school with guns."

Administrators say the students who posted the messages on the web site have been identified and will face felony charges, including making terroristic threats and disruption of a high school campus. Officials say all four are 'current students at Warren High School.

Gonzales said Northside officials will also hold MySpace-dot-com "accountable."

"It just seems to me that if you put up a public web site, and you allow students, teeangers, minors to post their thoughts and ideas, and not monitor it in an adult manner, you are asking for trouble," Gonzales said. "This particular web site has been a pain for all Bexar County schools for a long time now, and it just seems that the owners of MySpace-dot-com should be held accountable."

Yes, and while you're at it, make sure they also monitor email, chatrooms, all blogs and SMS. You know, people of every age could use that without supervision; what a dangerous threat to national security. Be sure to extend your accusations as much as possible, blaming everybody who was (even just remotely) involved, in an attempt to get money from possible lawsuits.