MediaMax Bug Found; Patch Issued; Patch Suffers from Same Bug
iSEC, EFF, and SonyBMG issued a joint press release yesterday, announcing yet another serious security bug in the SunnComm MediaMax copy protection software that ships on many SonyBMG compact discs.
Context & Ripple Effects
This is the second act of the Sony BMG copy-protection crisis. In early November, Freedom to Tinker documented how CD DRM made computers less secure, Sony BMG promised a fix in its first patch commitment, and the resulting First4Internet software update drew criticism for being undocumented. What was then framed as one vendor's rootkit problem is now visibly systemic: SunnComm's MediaMax — the other copy-protection system Sony BMG ships on its discs — has its own serious security bug.
The response structure itself marks a shift: iSEC Partners, EFF, and Sony BMG issued yesterday's disclosure as a joint press release rather than through separate channels, an unusual degree of coordination between the researchers who found the flaw and the company responsible. Notably, in a follow-up update EFF stated it does not recommend the patch at this time — and the patch, per the joint announcement, suffers from the very same bug it was meant to repair.
First-order effects
- Consumers who installed the MediaMax patch get no remediation — their computers remain exposed to the same serious vulnerability, and anyone still deciding whether to apply the fix has EFF explicitly advising against it.
- Sony BMG's remediation effort is effectively back to square one on MediaMax, with its own named security researchers now co-signing the announcement that the fix failed.
Second-order effects
- SunnComm, previously overshadowed by First4Internet in the November fallout, now faces the same spotlight — two of Sony BMG's copy-protection vendors have each produced software that weakens customer machines, putting both contracts and reputations at risk.
- The joint-disclosure model gives outside researchers a formal gatekeeping role over Sony BMG's patches, meaning future fixes must clear third-party verification before the public is advised to install them — a slower, more scrutinized pipeline than the label's original update process.
Third-order effects
- If the pattern holds — flawed DRM, failed patch, external auditors stepping in — client-side copy protection becomes a liability question for record labels generally: shipping software that degrades buyer security invites legal claims and regulatory interest that outweigh whatever piracy deterrence the discs provide.
- Security research is consolidating into a standing audit function for commercial DRM, with firms like iSEC and advocacy groups like EFF positioned between vendors and the public as the de facto certification layer for fixes.
The trend: Copy-protection software is moving from vendor-controlled, opaque patching toward externally verified disclosure and remediation, as repeated DRM security failures force labels to accept researcher oversight.