6 ms·

No privacy terrors? What short memories we have. https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_

No privacy terrors? What short memories we have. https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

rawTruthHurts 7y ago
In all fairness, I'm not sure how much of that applies 14 years later.
- garmaine 7y ago
  We’re now invulnerable to rootkits?
- ckastner 7y ago
  Speaking as someone who actively boycotted Sony products for a decade because of this fiasco, I also think it's time to put this to rest.
  - dingaling 7y ago
    I'm still boycotting Sony, for the rootkit and the PlayStation Linux switcheroo. They never actually apologised for either.
- Kye 7y ago
  Trust is hard to earn and easy to lose.
quickthrower2 7y ago
> It then released, for one of the programs, an "uninstaller" that only un-hid the program, installed additional software which could not be easily removed, collected an email address from the user, and introduced further security vulnerabilities.
dirkt 7y ago
To nitpick: Pure musics CD (CD-DA) can't contain any DRM or rootkits, because the format doesn't allow for data - it's all sound. Only combined CD-ROM/CD-R + CD-DA formats together with the unfortunate eagerness of Windows to auto-execute everything allows such rootkits. So if you feed a music CD to a real old CD player, or to (say) a properly configured Linux computer: No privacy terrors.
- Moru 7y ago
  Or a properly configured windows. Not even windows 95 would autorun a CD if you didn't tell it to.
  - delinka 7y ago
    > ... if you told it not to. FTFY By default, Win96 would run that CD. You didn't tell it to. You had to go change the setting from the default. You had to tell Win95 to not autorun a CD.
    - xattt 7y ago
      Win96 = Win95OSR?
      - snazz 7y ago
        I think it’s a typo.
        delinka 7y ago
        Indeed a typo that I didn't catch until after the edit window.
    - dijit 7y ago
      Autorunning CDs was the default until windows vista, which is how the u3 usb devices were used for “hacksaw”[0] and “switchblade”[1] attacks. More on u3: https://en.m.wikipedia.org/wiki/U3_(software)?wprov=sfti1 https://en.m.wikipedia.org/wiki/U3_(software)?wprov=sfti1 0: https://forums.hak5.org/topic/2843-usb-hacksaw-development/ https://forums.hak5.org/topic/2843-usb-hacksaw-development/ 1: https://forums.hak5.org/topic/2361-usb-switchblade-development/ https://forums.hak5.org/topic/2361-usb-switchblade-developme...
alias_neo 7y ago
I came here to mention exactly this and am glad to see it at the top. I, as a teenager bought a Sony BMG album with this rootkit. At the time I didn't own a standalone music player, just my PC. I had a nice Creative sound card and some decent speakers, and an appreciation for audio quality. To my surprise I found that the Sony album prevented you from playing back anything but some low-quality 128Kb MP3s stored in that data portion of the Disc if using a PC and there was zero chance I was allowing their crapware onto my machine. I contacted them and they sent me out a replacement disc without the root-kit data rubbish but only upon me first posting back my own disc, without its case no less.
- rusk 7y ago
  wasn't it a thing, that you could bypass this by holding shift (to disable autoplay) when inserting the disc?
  - geggam 7y ago
    or use linux :)
    - alias_neo 7y ago
      I know this statement of yours is somewhat of a meme, and you may even be saying it tongue-in-cheek, but, this is one of many tiny cuts over the years that caused me to switch entirely to Linux. I don't run Windows at home or at work for the best part of a decade now. I run bleeding edge hardware, I have a high-end gaming PC, my laptop is a 2019 model that only works if I use Linux 5.0 and my wife complains that Open/Libre Office sucks on her laptop. Don't get me wrong, I have my issues, sometimes I have to fix things, but I would rather this any day than having to go back to using Windows.
      - rusk 7y ago
        > I have a high-end gaming PC Is gaming a thing on Linux now? I was given to thinking that if you're into PC gaming you're really stuck with Windows ...
segfaultbuserr 7y ago
A standard Red Book audio CD cannot install malware to your system. It was the data CD with music that Sony shipped made it possible. This is why, I, sometimes a CD buyer, believe all listeners of Audio CD should try maintaining the status quo of CD, as defined by the Red Book, and resist/boycott any attempt by the industry to "make a better CD" (e.g. SACD, Audio DVD, Audio Bluray), or "add more functionalities" to the existing CD standards. Technologically, I would be happy to see a Doubly 5.1 Bluray Audio CD playing at living room from my surrounding speakers (better channel separation allows improvements of sound reproduction even on speakers of moderate quality), or CDs with real filesystem and error correction (an Audio CD by its original design, only streams music in real time, as if it's a digital LP track. There is no way to even know if the data you've just read from the disc is correct or not [0]), or a FLAC-encoded stereo CD (it would allow 30% more songs to be recorded on a single CD). However, I'd better to live without them, as history has shown: all the newer standards would definitely be more "consumer-unfriendly" at best (go to any AV forum, and see the compatibility issues caused by HDCP [1] for example...), and malware at worst. The Audio CD, even with its historical limitations, is good enough, it plays lossless music with 44100 kHz sampling rate, and it did/does this job well. Also, you may have noticed the recent renaissance of LP discs, and some LP lovers' arguments of how analog has better sound quality. While I don't believe those arguments are persuasive, I'm highly supportive of the LP industry for the same reason - you cannot install malware on a LP disc. [0] Why I Ripped the Same CD 300 Times https://news.ycombinator.com/item?id=17649374 https://news.ycombinator.com/item?id=17649374 [1] https://news.ycombinator.com/item?id=1689823 https://news.ycombinator.com/item?id=1689823
- pbhjpbhj 7y ago
  >A standard Red Book audio CD cannot install malware to your system. // I don't think I'd ever be so confident as to say that given some of the incredible hacks I've seen ;o)
  - segfaultbuserr 7y ago
    Well, theoretically, "an Audio CD that exploits a buffer overflow of your music player on your computer and installs malware" is always a possibility, and a good intellectual challenge. But doing it at an industrial scale and including an 0day exploit in all albums is a separate thing, I don't believe it would ever happen. On the other hand, creating an extension of the standard to "make a better CD" is a real threat, for example, a plausible example would be: "a CD-based service that connects to a server to obtain metadata and lyrics of your music, like a proprietary version of MusicBrainz, but with ads and tracking added."
snvzz 7y ago
Brutal, but only really affects people who should have no expectation of privacy to begin with, such as Windows users.
- yjftsjthsd-h 7y ago
  Everyone should have a reasonable expectation of privacy. That certain groups more frequently find this expectation violated does not mean that it is not a reasonable expectation.
  - snvzz 7y ago
    I have no expectation of privacy when I use windows. You shouldn't, either. It simply got this bad.
astraltheman 7y ago
I guess I should've scrolled down more, I made a similar comment. How quickly people forget!

No privacy terrors? What short memories we have. https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

rawTruthHurts 7y ago

In all fairness, I'm not sure how much of that applies 14 years later.

garmaine 7y ago
We’re now invulnerable to rootkits?
ckastner 7y ago
Speaking as someone who actively boycotted Sony products for a decade because of this fiasco, I also think it's time to put this to rest.
- dingaling 7y ago
  I'm still boycotting Sony, for the rootkit and the PlayStation Linux switcheroo. They never actually apologised for either.
Kye 7y ago
Trust is hard to earn and easy to lose.

quickthrower2 7y ago

> It then released, for one of the programs, an "uninstaller" that only un-hid the program, installed additional software which could not be easily removed, collected an email address from the user, and introduced further security vulnerabilities.

dirkt 7y ago

To nitpick: Pure musics CD (CD-DA) can't contain any DRM or rootkits, because the format doesn't allow for data - it's all sound. Only combined CD-ROM/CD-R + CD-DA formats together with the unfortunate eagerness of Windows to auto-execute everything allows such rootkits. So if you feed a music CD to a real old CD player, or to (say) a properly configured Linux computer: No privacy terrors.

Moru 7y ago
Or a properly configured windows. Not even windows 95 would autorun a CD if you didn't tell it to.
- delinka 7y ago
  > ... if you told it not to. FTFY By default, Win96 would run that CD. You didn't tell it to. You had to go change the setting from the default. You had to tell Win95 to not autorun a CD.
  - xattt 7y ago
    Win96 = Win95OSR?
    - snazz 7y ago
      I think it’s a typo.
      - delinka 7y ago
        Indeed a typo that I didn't catch until after the edit window.
  - dijit 7y ago
    Autorunning CDs was the default until windows vista, which is how the u3 usb devices were used for “hacksaw”[0] and “switchblade”[1] attacks. More on u3: https://en.m.wikipedia.org/wiki/U3_(software)?wprov=sfti1 https://en.m.wikipedia.org/wiki/U3_(software)?wprov=sfti1 0: https://forums.hak5.org/topic/2843-usb-hacksaw-development/ https://forums.hak5.org/topic/2843-usb-hacksaw-development/ 1: https://forums.hak5.org/topic/2361-usb-switchblade-development/ https://forums.hak5.org/topic/2361-usb-switchblade-developme...

alias_neo 7y ago

I came here to mention exactly this and am glad to see it at the top. I, as a teenager bought a Sony BMG album with this rootkit. At the time I didn't own a standalone music player, just my PC. I had a nice Creative sound card and some decent speakers, and an appreciation for audio quality. To my surprise I found that the Sony album prevented you from playing back anything but some low-quality 128Kb MP3s stored in that data portion of the Disc if using a PC and there was zero chance I was allowing their crapware onto my machine. I contacted them and they sent me out a replacement disc without the root-kit data rubbish but only upon me first posting back my own disc, without its case no less.

rusk 7y ago
wasn't it a thing, that you could bypass this by holding shift (to disable autoplay) when inserting the disc?
- geggam 7y ago
  or use linux :)
  - alias_neo 7y ago
    I know this statement of yours is somewhat of a meme, and you may even be saying it tongue-in-cheek, but, this is one of many tiny cuts over the years that caused me to switch entirely to Linux. I don't run Windows at home or at work for the best part of a decade now. I run bleeding edge hardware, I have a high-end gaming PC, my laptop is a 2019 model that only works if I use Linux 5.0 and my wife complains that Open/Libre Office sucks on her laptop. Don't get me wrong, I have my issues, sometimes I have to fix things, but I would rather this any day than having to go back to using Windows.
    - rusk 7y ago
      > I have a high-end gaming PC Is gaming a thing on Linux now? I was given to thinking that if you're into PC gaming you're really stuck with Windows ...

segfaultbuserr 7y ago

A standard Red Book audio CD cannot install malware to your system. It was the data CD with music that Sony shipped made it possible. This is why, I, sometimes a CD buyer, believe all listeners of Audio CD should try maintaining the status quo of CD, as defined by the Red Book, and resist/boycott any attempt by the industry to "make a better CD" (e.g. SACD, Audio DVD, Audio Bluray), or "add more functionalities" to the existing CD standards. Technologically, I would be happy to see a Doubly 5.1 Bluray Audio CD playing at living room from my surrounding speakers (better channel separation allows improvements of sound reproduction even on speakers of moderate quality), or CDs with real filesystem and error correction (an Audio CD by its original design, only streams music in real time, as if it's a digital LP track. There is no way to even know if the data you've just read from the disc is correct or not [0]), or a FLAC-encoded stereo CD (it would allow 30% more songs to be recorded on a single CD). However, I'd better to live without them, as history has shown: all the newer standards would definitely be more "consumer-unfriendly" at best (go to any AV forum, and see the compatibility issues caused by HDCP [1] for example...), and malware at worst. The Audio CD, even with its historical limitations, is good enough, it plays lossless music with 44100 kHz sampling rate, and it did/does this job well. Also, you may have noticed the recent renaissance of LP discs, and some LP lovers' arguments of how analog has better sound quality. While I don't believe those arguments are persuasive, I'm highly supportive of the LP industry for the same reason - you cannot install malware on a LP disc. [0] Why I Ripped the Same CD 300 Times https://news.ycombinator.com/item?id=17649374 https://news.ycombinator.com/item?id=17649374 [1] https://news.ycombinator.com/item?id=1689823 https://news.ycombinator.com/item?id=1689823

pbhjpbhj 7y ago
>A standard Red Book audio CD cannot install malware to your system. // I don't think I'd ever be so confident as to say that given some of the incredible hacks I've seen ;o)
- segfaultbuserr 7y ago
  Well, theoretically, "an Audio CD that exploits a buffer overflow of your music player on your computer and installs malware" is always a possibility, and a good intellectual challenge. But doing it at an industrial scale and including an 0day exploit in all albums is a separate thing, I don't believe it would ever happen. On the other hand, creating an extension of the standard to "make a better CD" is a real threat, for example, a plausible example would be: "a CD-based service that connects to a server to obtain metadata and lyrics of your music, like a proprietary version of MusicBrainz, but with ads and tracking added."

snvzz 7y ago

Brutal, but only really affects people who should have no expectation of privacy to begin with, such as Windows users.

yjftsjthsd-h 7y ago
Everyone should have a reasonable expectation of privacy. That certain groups more frequently find this expectation violated does not mean that it is not a reasonable expectation.
- snvzz 7y ago
  I have no expectation of privacy when I use windows. You shouldn't, either. It simply got this bad.

astraltheman 7y ago

I guess I should've scrolled down more, I made a similar comment. How quickly people forget!