Sony’s Cure against XCP Copy-Protection, Worse than XCP Itself – Experts

Sony Recalls CDs with Extensive Copy-Protection Software

by Anton Shilov

[ 11/15/2005 | 12:12 PM ]

Sony Corp., whose digital right management (DRM) program on some of the CDs the company sold behaved like malicious software and embedded itself into operating system creating security threats, recently provided its customers another program that removed the denounced XPC copy-protection and promised to exchange affected discs. But according to software experts, the tool for removing XPC creates even more danger for end-users.

<%BANNER[article_nw]%>

“This is a surprisingly bad design from a security standpoint,” said Ed Felten, a Princeton University computer science professor who explored the removal program with a graduate student, J. Alex Halderman. “It endangers users in several ways.”

When the discs were put into a PC in order to transfer music to portable music players, the CD automatically installed a program that restricted how many times the discs’ tracks could be copied, and made it extremely problematic to transfer songs to players.

Furthermore, the antipiracy software – which works only on Windows PCs – came with a cloaking feature that allowed it to hide files on users’ computers. Security researchers classified the program as “spyware,” saying it secretly transmits details about what music the PC is playing. Manual attempts to remove the software can disable the PC’s CD drive, Associated Press reports.

Moreover, the program also gave virus writers an easy tool for hiding their malicious software. Last week, virus-like “Trojan horse” programs emerged that took advantage of the cloaking feature to enter computers undetected, antivirus companies said.

But the uninstaller for the XCP software is even worse that the program itself. To request the tool, users have to fill-in form and allow the program to be automatically downloaded. According to the Princeton analysis, the program fails to make the computer confirm that such code should come only from Sony or First 4 Internet, the developer of the XCP, which, the researchers believe, “allows any Web page you visit to download, install, and run any code it likes on your computer”, which poses further dangers, as a computer can be hacked. Sony is expected to provide a standalone tool to remove the XCP. Microsoft is reported to have said that it would also be able to disable XCP with its Malicious Software Removal Tool software.

“We share the concerns of consumers regarding these discs, and we are instituting a program that will allow consumers to exchange any CD with XCP software for the same CD without copy protection.  We also have asked our retail partners to remove all unsold CDs with XCP software from their store shelves and inventory.  We will make further details of this program available shortly,” Sony said in a statement.

• AP: Fallout from Sony CD Flap Getting Worse.
• Sony-BMG: The List of Titles with XCP.
• Sony-BMG: A Statement to Customers.