Sony BMG copy protection rootkit scandal

The scandal erupted on October 31, 2005, when Winternals (later acquired by Microsoft Corporation) researcher Mark Russinovich posted to his blog a detailed description and technical analysis of F4I's XCP software that he ascertained had been recently installed on his computer by a Sony BMG music CD. Russinovich compared the software to a rootkit due to its surreptitious installation and its efforts to hide its existence. He noted that the EULA does not mention the software, and he asserted emphatically that the software is illegitimate and that digital rights management had "gone too far".[9]

Anti-virus firm F-Secure concurred: "Although the software isn't directly malicious, the used rootkit hiding techniques are exactly the same used by malicious software to hide. The DRM software will cause many similar false alarms with all AV software that detect rootkits. ... Thus it is very inappropriate for commercial software to use these techniques."[10] After public pressure, Symantec[11] and other anti-virus vendors included detection for the rootkit in their products as well, and Microsoft announced it would include detection and removal capabilities in its security patches.[12]

Russinovich discovered numerous problems with XCP:

• It creates security holes that can be exploited by malicious software such as worms or viruses.
• It constantly runs in the background and excessively consumes system resources, slowing down the user's computer, regardless of whether there is a protected CD playing.
• It employs unsafe procedures to start and stop, which could lead to system crashes.
• It has no uninstaller, and is installed in such a way that inexpert attempts to uninstall it can lead to the operating system failing to recognize existing drives.

Soon after Russinovich's first post, there were several trojans and worms exploiting XCP's security holes.[13] Some people even used the vulnerabilities to cheat in online games.[14]

Sony BMG quickly released software to remove the rootkit component of XCP from affected Microsoft Windows computers,[15] but after Russinovich analyzed the utility, he reported in his blog that it only exacerbated the security problems and raised further concerns about privacy.[16] Russinovich noted that the removal program merely unmasked the hidden files installed by the rootkit, but did not actually remove the rootkit. He also reported that it installed additional software that could not be uninstalled. In order to download the uninstaller, he found it was necessary to provide an e-mail address (which the Sony BMG Privacy Policy implied was added to various bulk e-mail lists), and to install an ActiveX control containing backdoor methods (marked as "safe for scripting", and thus prone to exploits).[17][18] Microsoft later issued a killbit for this ActiveX control.

On November 18, 2005, Sony BMG provided a "new and improved" removal tool to remove the rootkit component of XCP from affected Microsoft Windows computers.

On November 15, 2005 vnunet.com announced[19] that Sony BMG was backing out of its copy-protection software, recalling unsold CDs from all stores, and offering consumers to exchange their CDs with versions lacking the software. The Electronic Frontier Foundation compiled a partial list of CDs with XCP.[20] Sony BMG was quoted as maintaining that "there were no security risks associated with the anti-piracy technology", despite numerous virus and malware reports. On November 16, 2005, US-CERT, part of the United States Department of Homeland Security, issued an advisory on XCP DRM. They said that XCP uses rootkit technology to hide certain files from the computer user and that this technique is a security threat to computer users. They also said one of the uninstallation options provided by Sony BMG introduces further vulnerabilities to a system. US-CERT advised, "Do not install software from sources that you do not expect to contain software, such as an audio CD."[21]

Sony BMG announced that it had instructed retailers to remove any unsold music discs containing the software from their shelves.[22] It was estimated by internet security expert Dan Kaminsky that XCP was in use on more than 500,000 networks.[23]

CDs with XCP technology can be identified by the letters "XCP" printed on the back cover of the jewel case for the CD according to SonyBMG's XCP FAQ.[24]

On November 18, 2005, Reuters reported that Sony BMG would exchange affected insecure CDs for new unprotected disks as well as unprotected MP3 files.[25] As a part of the swap program, consumers can mail their XCP-protected CDs to Sony BMG and be sent an unprotected disc via return mail.

On November 29, then-New York Attorney General Eliot Spitzer found through his investigators that, despite the recall of November 15, Sony BMG CDs with XCP were still for sale in New York City music retail outlets. Spitzer said "It is unacceptable that more than three weeks after this serious vulnerability was revealed, these same CDs are still on shelves, during the busiest shopping days of the year, [and] I strongly urge all retailers to heed the warnings issued about these products, pull them from distribution immediately, and ship them back to Sony."[26]

The next day, Massachusetts Attorney General Tom Reilly issued a statement saying that Sony BMG CDs with XCP were still available in Boston despite the Sony BMG recall of November 15.[27] Attorney General Reilly advised consumers not to purchase the Sony BMG CDs with XCP and said that he was conducting an investigation of Sony BMG.

As of May 11, 2006, Sony BMG's website offered consumers a link to "Class Action Settlement Information Regarding XCP And MediaMax Content Protection."[28] It has online claim filing and links to software updates/uninstallers. The deadline for submitting a claim was June 30, 2007.

As of April 2, 2008, Sony BMG's website offered consumers an explanation of the events, as well as a list of all affected CDs.[29]

On November 21, 2005, Texas Attorney General Greg Abbott sued Sony BMG.[30] Texas was the first state in the United States to bring legal action against Sony BMG in response to the rootkit. The suit was also the first filed under the state's 2005 spyware law. It alleged that the company surreptitiously installed the spyware on millions of compact music discs (CDs) that compromised computers when consumers inserted them into their computers in order to play.

On December 21, 2005, Abbott added new allegations to his lawsuit against Sony-BMG, regarding MediaMax.[31] The new allegations claimed that MediaMax violated the state's spyware and deceptive trade practices laws, because the MediaMax software would be installed on a computer even if the user declined the license agreement authorizing the action. Abbott stated, "We keep discovering additional methods Sony used to deceive Texas consumers who thought they were simply buying music", and "Thousands of Texans are now potential victims of this deceptive game Sony played with consumers for its own purposes." In addition to violations of the Consumer Protection Against Computer Spyware Act of 2005, which allowed for civil penalties of $100,000 for each violation of the law, the alleged violations added in the updated lawsuit (on December 21, 2005) carried maximum penalties of $20,000 per violation.[32][33] Sony was ordered to pay $750,000 in legal fees to Texas, accept customer returns of affected CDs, place a conspicuous detailed notice on their homepage, make "keyword buys" to alert consumers by advertising with Google, Yahoo! and MSN, pay up to $150 per damaged computer, among other remedies. Sony BMG also had to agree that they would not make any claim that the legal settlement in any way constitutes the approval of the court.[34]

Class action suits were filed against Sony BMG in New York and California.[35]

On December 30, 2005, the New York Times reported that Sony BMG had reached a tentative settlement of the lawsuits, proposing two ways of compensating consumers who have purchased the affected recordings.[36] According to the proposed settlement, those who purchased an XCP CD will be paid $7.50 per purchased recording and given the opportunity to download a free album or be able to download three additional albums from a limited list of recordings if they give up their cash incentive. District Judge Naomi Reice Buchwald entered an order tentatively approving the settlement on January 6, 2006.

The settlement was designed to compensate those whose computers were infected, but not otherwise damaged. Those who have damages that are not addressed in the class action are able to opt out of the settlement and pursue their own litigation.

A fairness hearing was held on May 22, 2006, at 9:15 am at the Daniel Patrick Moynihan United States Courthouse for the Southern District of New York.

Claims had to be submitted by December 31, 2006. Class members who wished to be excluded from the settlement must have filed before May 1, 2006. Those who remained in the settlement could attend the fairness hearing at their own expense and speak on their own behalf or be represented by an attorney.

In Italy, ALCEI (an association similar to EFF) also reported the rootkit to the Financial Police, asking for an investigation under various computer crime allegations, along with a technical analysis of the rootkit.[37][38]

The US Department of Justice (DOJ) made no comment on whether it would take any criminal action against Sony. However, Stewart Baker of the Department of Homeland Security publicly admonished Sony, stating, "it's your intellectual property—it's not your computer".[39]

On November 21, the EFF announced that it was also pursuing a lawsuit over both XCP and the SunnComm MediaMax DRM technology. The EFF lawsuit also involves issues concerning the Sony BMG end user license agreement.

It was reported on December 24, 2005, that then-Florida Attorney General Charlie Crist was investigating Sony BMG spyware.[40]

On January 30, 2007, the U.S. Federal Trade Commission (FTC) announced a settlement with Sony BMG on charges that their CD copy protection had violated Federal law[41]—Section 5(a) of the Federal Trade Commission Act, 15 USC 45(a)—by engaging in unfair and deceptive business practices.[42] The settlement requires Sony BMG to reimburse consumers up to $150 to repair damage that resulted directly from their attempts to remove the software installed without their consent.[41] The settlement also requires them to provide clear and prominent disclosure on the packaging of future CDs of any limits on copying or restrictions on the use of playback devices, and ban the company from installing content protection software without obtaining consumers' authorization.[41] FTC chairwoman Deborah Platt Majoras added that, "Installations of secret software that create security risks are intrusive and unlawful. Consumers' computers belong to them, and companies must adequately disclose unexpected limitations on the customer use of their products so consumers can make informed decisions regarding whether to purchase and install that content."[43][44]

Researchers found that Sony BMG and the makers of XCP also apparently infringed copyright by failing to adhere to the licensing requirements of various pieces of free and open-source software whose code was used in the program,[45][46] including the LAME MP3 encoder,[47] mpglib,[48] FAAC,[49] id3lib,[50] mpg123 and the VLC media player.[51]

In January 2006, the developers of LAME posted an open letter stating that they expected "appropriate action" by Sony BMG, but that the developers had no plans to investigate or take action over the apparent violation of LAME's source code license.[52]