Another Sony rootkit worms its way to the surface
Sony can't catch a break after their infamous rootkit scandal back in 2005. In fact, we know from talking to security researchers and black hats alike that Sony is under the careful eye of many as a result of that major screw-up.
Context & Ripple Effects
Sony's copy-protection problems began with the rootkit Mark Russinovich exposed on Sysinternals in late 2005, hidden on music CDs that reported themselves as malware-grade stealth software. The company has spent the period since trying to close the chapter, most recently by suing the developer of its own MediaMax DRM in July 2007 to force legal resolution of the fiasco.
A second Sony rootkit coming to light complicates that closure attempt: per the reporting, security researchers and black hats alike keep Sony under careful watch because of the original screw-up, so anything new on the company's discs or installs gets found fast. The pattern matters less for any single infection than for what it says about how Sony's content-protection engineering is now policed.
First-order effects
- Sony faces renewed scrutiny of every installer and DRM component it ships, from an audience of researchers actively hunting for repeats of the 2005 behavior.
- The July 2007 MediaMax lawsuit, framed as seeking closure on the DRM fiasco, now sits alongside evidence the problem extended beyond the discs already litigated.
Second-order effects
- Other labels and DRM vendors shipping stealthy protection code inherit the reputational hit, since buyers cannot easily distinguish one vendor's anti-copy software from another once the category is associated with rootkits.
- Antivirus and antispyware firms face pressure to flag commercial DRM as malicious, blurring the line between their threat lists and legitimate business software.
Third-order effects
- If the security community keeps holding content-protection software to malware standards, DRM shifts away from stealthy client-side installs toward formats and delivery that never touch the user's system files — with regulators and class-action lawyers watching the same signals.
The trend: Commercial DRM is being re-judged by the security industry as potentially hostile code, forcing content owners toward protection schemes that do not require stealth on the customer's PC.