New Sony rootkit scandal?
p2pnet news | Security:- Is it possible? Could Sony be stupid enough to get itself involved in another rootkit scandal?
If Finlands if F-Secure is correct, the answer to both questions is Yes.
Years after Mark Russinovich and F-Secure separately caught Sony red-handed secretly installing dangerous DRM spyware in the computers of people whod bought its music CDs, Sony is at it again, blogs F-Secures Mikko Hyponnen.
Mondays post disclosed our investigation of Sonys MicroVault USM-F fingerprint reader software, he says, going on, Sonys software installs a driver that creates a hidden folder using rootkit techniques.
Is it as lethal bad as the first Sony BMG XCP DRM case?
No, because, The user understands that he is installing software, its on the included CD, and has a standard method of uninstalling that software.
Hyponnen adds:
The fingerprint driver does not hide its folder as deeply as does the XCP DRM folder. The MicroVault software probably wouldnt hide malware as effectively from (some) real-time antivirus scanners.
The Microvault software does not hide processes or registry keys. XCP DRM did.
Its also trickier to run executables from the hidden directory than with XCP. However, it can be done.
And lastly, there seems to be a use-case: The cloaking is most likely used to protect fingerprint authentication from tampering. Sony is attempting to protect the users own data. In the DRM case, Sony was attempting to restrict you the user from accessing the music on the CD you bought. So their intent was more beneficial to the consumer in this case.
But it isnt over yet.
The latest (will there be more?) Sony rootkit can still be downloaded from sony.net and can be used by any malware author to hide any folder, says F-Secure, adding:
We didnt want to go into the details about this in our public postings, but we suppose the cats out of the bag now that our friends at McAfee blogged about this yesterday. If you simply extract one executable from the package and include it with malware, it will hide that malwares folder, no questions asked.
We still havent received any kind of response from Sony International. Sony Sweden did however confirm in a public IDG story that the rootkit is indeed part of their software.
Stay tuned.