Sony recalls copy-protected CDs

C-Mac · 11-16-2005, 07:27 AM

http://news.bbc.co.uk/1/hi/technology/4441928.stm

Sony BMG is recalling music CDs that use controversial anti-piracy software. The software was widely criticised because it used virus-like techniques to stop illegal copies being made.
Widespread pressure has made the music giant remove CDs bearing the software from stores. It will also swap bought CDs for copies free of the XCP anti-piracy software.
Sony is also providing software to make it easy to remove the controversial program from Windows computers.
Sony's music arm could be recalling millions of CDs because at least 20 discs are known to use XCP some by best-selling artists such as Celine Dion, Natasha Bedingfield, and Amerie.
One of the discs, Neil Diamond's 12 Songs, was the top seller on Amazon.com for several days.

XCP PROTECTED CDS
Trey Anastasio - Shine
Celine Dion - On ne Change Pas
Neil Diamond - 12 Songs
Our Lady Peace - Healthy in Paranoid Times
Chris Botti - To Love Again
Van Zant - Get Right with the Man
Switchfoot - Nothing is Sound
The Coral - The Invisible Invasion
Acceptance - Phantoms
Susie Suh - Susie Suh
Amerie - Touch
Life of Agony - Broken Valley
Horace Silver Quintet - Silver's Blue
Gerry Mulligan - Jeru
Dexter Gordon - Manhattan Symphonie
The Bad Plus - Suspicious Activity
The Dead 60s - The Dead 60s
Dion - The Essential Dion
Natasha Bedingfield - Unwritten
Ricky Martin - Life

No detailed figures have been given by Sony for how many CDs are protected with XCP or how many have been sold.
However, work by respected net expert Dan Kaminsky found that more than 500,000 networks have at least one machine on them using XCP.
Although the CDs containing XCP were only released in the US, Mr Kaminsky found that 44,000 copies were installed on machines in the UK.
In its statement announcing the recall Sony BMG said: "We deeply regret any inconvenience this may cause our customers and we are committed to making this situation right."
Security exploit
The alarm about XCP was raised by Windows programming expert Mark Russinovich who discovered that it used a "root kit" to install itself deep inside the operating system.
Subsequent to his discovery virus writers started exploiting XCP's stealthy abilities to hide their own creations.
In the same statement about the recall Sony BMG said it would make it much easier to uninstall the XCP system from Windows PCs on which is has been installed.
Before now any customer wanting to rid their PC of XCP had to go through a several stage process of telling Sony what they wanted to do and then waiting for it to respond. As well as being criticised for its inconvenience security researchers found that the uninstaller left Windows machines vulnerable to several exploits. The XCP copy protection system only installed on machines running Windows.
Writing on the Freedom to Tinker blog, researchers J Alex Halderman and Ed Felten found that cleverly written webpages could exploit the programming code used to remove XCP to install their own potentially malicious programs.
The pair also provided tools that help people work out if their Windows machines have been left vulnerable in this way.
The news about the uninstaller came as anti-virus firms and Microsoft announced tools to find and remove the "root kit".
The row about XCP has also led to Sony BMG facing several class-action lawsuits over the potential security problems that the software causes.

ChiefsFan4Life · 11-16-2005, 07:31 AM

Between this and the rumors of Sony making the PS3 games only being able to be played on one system, they are quickly rising up the ranks of assholes.

Microsoft owned them on this though, that was a nice move, lol.

C-Mac · 11-16-2005, 08:05 AM

Very few companies could get away with this and survive.
I just hope that too much info hasnt been already shared with the spyware folks.

htismaqe · 11-16-2005, 08:17 AM

For any of you that have purchased one of these Sony CD's and played it in your computer:

DO NOT INSTALL THE FIX!

http://www.msnbc.msn.com/id/10053831/

----------------------------------

But the uninstaller has created a new set of problems.

To get the uninstall program, users have to request it by filling out online forms. Once submitted, the forms themselves download and install a program designed to ready the PC for the fix. Essentially, it makes the PC open to downloading and installing code from the Internet.

According to the Princeton analysis, the program fails to make the computer confirm that such code should come only from Sony or First 4 Internet.

“The consequences of the flaw are severe,” Felten and Halderman wrote in a blog posting Tuesday. “It allows any Web page you visit to download, install, and run any code it likes on your computer. Any Web page can seize control of your computer; then it can do anything it likes. That’s about as serious as a security flaw can get.”

ChiefsFan4Life · 11-16-2005, 08:46 AM

Congrats to Sony for potentially driving EVEN MORE people to file sharing services. This goes completely against what they were trying to accomplish. They are essentially punishing people who actually BUY cd's.

shakesthecat · 11-16-2005, 08:53 AM

Good luck with your Blu-Ray HD DVD launch now Sony. I'm sure it'll be just as successful as Beta Max.

**Lzen** · 11-16-2005, 08:56 AM

Lovely. So, I wonder how much this stupid anti-piracy software has helped the bad guys out there. Perhaps they learned enough from Sony's software to now make their viruses and trojans invisible to normal anitvirus and antispyware.

StcChief · 11-16-2005, 09:07 AM

I didn't see anything on this list I would ever own.

beavis · 11-16-2005, 09:28 AM

Given that list of cds, I think they should leave the protection on.

KcKing · 11-16-2005, 09:47 AM

^^ Most Def...

Anyone attempting to share these...

Celine Dion - On ne Change Pas
Neil Diamond - 12 Songs

SHOULD have a computer destroying virus destroy their respective systems before the evil is spread.

htismaqe · 11-16-2005, 09:55 AM

Quote:

Originally Posted by shakesthecat

Good luck with your Blu-Ray HD DVD launch now Sony. I'm sure it'll be just as successful as Beta Max.

It will be interesting to see if this has any effect on the Sony vs. Toshiba battle surrounding HD-DVD...

**Lzen** · 11-16-2005, 10:00 AM

Quote:

Originally Posted by nm_dbf

I didn't see anything on this list I would ever own.

Me, either. But you know it was only gonna be a matter of time before they started putting that crap on all cds.

teedubya · 11-16-2005, 10:09 AM

to any of you who still purchase CDs... period... Bwha haha ha

Lbedrock1 · 11-16-2005, 10:10 AM

Quote:

Originally Posted by ChiefsFan4Life

Congrats to Sony for potentially driving EVEN MORE people to file sharing services. This goes completely against what they were trying to accomplish. They are essentially punishing people who actually BUY cd's.

All of the distributors of CD's need to give up on trying to stop pirating and starts selling their music as downloads over the internet for very reasonable price so that they can save money on the research they spend on trying to stop it. For every smart person that can make up something to stop it they have a counter person who will find a way around it.

Extra Point · 11-16-2005, 10:14 AM

Looking at the list, other than Van Zant, Mulligan, and Gordon, what's there to protect?

11-16-2005, 07:27 AM
C-Mac Lurker Extraordinaire Join Date: Oct 2000 Location: Wally World Casino cash: $2083699	Sony recalls copy-protected CDs http://news.bbc.co.uk/1/hi/technology/4441928.stm Sony BMG is recalling music CDs that use controversial anti-piracy software. The software was widely criticised because it used virus-like techniques to stop illegal copies being made. Widespread pressure has made the music giant remove CDs bearing the software from stores. It will also swap bought CDs for copies free of the XCP anti-piracy software. Sony is also providing software to make it easy to remove the controversial program from Windows computers. Sony's music arm could be recalling millions of CDs because at least 20 discs are known to use XCP some by best-selling artists such as Celine Dion, Natasha Bedingfield, and Amerie. One of the discs, Neil Diamond's 12 Songs, was the top seller on Amazon.com for several days. XCP PROTECTED CDS Trey Anastasio - Shine Celine Dion - On ne Change Pas Neil Diamond - 12 Songs Our Lady Peace - Healthy in Paranoid Times Chris Botti - To Love Again Van Zant - Get Right with the Man Switchfoot - Nothing is Sound The Coral - The Invisible Invasion Acceptance - Phantoms Susie Suh - Susie Suh Amerie - Touch Life of Agony - Broken Valley Horace Silver Quintet - Silver's Blue Gerry Mulligan - Jeru Dexter Gordon - Manhattan Symphonie The Bad Plus - Suspicious Activity The Dead 60s - The Dead 60s Dion - The Essential Dion Natasha Bedingfield - Unwritten Ricky Martin - Life No detailed figures have been given by Sony for how many CDs are protected with XCP or how many have been sold. However, work by respected net expert Dan Kaminsky found that more than 500,000 networks have at least one machine on them using XCP. Although the CDs containing XCP were only released in the US, Mr Kaminsky found that 44,000 copies were installed on machines in the UK. In its statement announcing the recall Sony BMG said: "We deeply regret any inconvenience this may cause our customers and we are committed to making this situation right." Security exploit The alarm about XCP was raised by Windows programming expert Mark Russinovich who discovered that it used a "root kit" to install itself deep inside the operating system. Subsequent to his discovery virus writers started exploiting XCP's stealthy abilities to hide their own creations. In the same statement about the recall Sony BMG said it would make it much easier to uninstall the XCP system from Windows PCs on which is has been installed. Before now any customer wanting to rid their PC of XCP had to go through a several stage process of telling Sony what they wanted to do and then waiting for it to respond. As well as being criticised for its inconvenience security researchers found that the uninstaller left Windows machines vulnerable to several exploits. The XCP copy protection system only installed on machines running Windows. Writing on the Freedom to Tinker blog, researchers J Alex Halderman and Ed Felten found that cleverly written webpages could exploit the programming code used to remove XCP to install their own potentially malicious programs. The pair also provided tools that help people work out if their Windows machines have been left vulnerable in this way. The news about the uninstaller came as anti-virus firms and Microsoft announced tools to find and remove the "root kit". The row about XCP has also led to Sony BMG facing several class-action lawsuits over the potential security problems that the software causes.
Posts: 5,636

11-16-2005, 07:31 AM	#2
ChiefsFan4Life DT: HOF Class of 2009 Join Date: Sep 2005 Location: House Springs, MO Casino cash: $10004900	Between this and the rumors of Sony making the PS3 games only being able to be played on one system, they are quickly rising up the ranks of assholes. Microsoft owned them on this though, that was a nice move, lol.
Posts: 2,031

11-16-2005, 08:05 AM	#3
C-Mac Lurker Extraordinaire Join Date: Oct 2000 Location: Wally World Casino cash: $2083699	Very few companies could get away with this and survive. I just hope that too much info hasnt been already shared with the spyware folks.
Posts: 5,636

11-16-2005, 08:17 AM	#4
htismaqe 'Tis my eye! Join Date: Aug 2000 Location: Chiefsplanet Casino cash: $10269900	For any of you that have purchased one of these Sony CD's and played it in your computer: DO NOT INSTALL THE FIX! http://www.msnbc.msn.com/id/10053831/ ---------------------------------- But the uninstaller has created a new set of problems. To get the uninstall program, users have to request it by filling out online forms. Once submitted, the forms themselves download and install a program designed to ready the PC for the fix. Essentially, it makes the PC open to downloading and installing code from the Internet. According to the Princeton analysis, the program fails to make the computer confirm that such code should come only from Sony or First 4 Internet. “The consequences of the flaw are severe,” Felten and Halderman wrote in a blog posting Tuesday. “It allows any Web page you visit to download, install, and run any code it likes on your computer. Any Web page can seize control of your computer; then it can do anything it likes. That’s about as serious as a security flaw can get.”
Posts: 100,022

11-16-2005, 08:46 AM	#5
ChiefsFan4Life DT: HOF Class of 2009 Join Date: Sep 2005 Location: House Springs, MO Casino cash: $10004900	Congrats to Sony for potentially driving EVEN MORE people to file sharing services. This goes completely against what they were trying to accomplish. They are essentially punishing people who actually BUY cd's.
Posts: 2,031

11-16-2005, 08:53 AM	#6
shakesthecat Veteran Join Date: Aug 2000 Location: IA Casino cash: $4093833	Good luck with your Blu-Ray HD DVD launch now Sony. I'm sure it'll be just as successful as Beta Max.
Posts: 3,354

11-16-2005, 08:56 AM	#7
Lzen Supporter Join Date: Feb 2001 Location: Jan Quadrant Vincent 16 Casino cash: $2040692	Lovely. So, I wonder how much this stupid anti-piracy software has helped the bad guys out there. Perhaps they learned enough from Sony's software to now make their viruses and trojans invisible to normal anitvirus and antispyware. __________________ If at first you don't succeed ...skydiving is not for you.
Posts: 41,431

11-16-2005, 09:07 AM	#8
StcChief Playing for #1 Draft Pick Join Date: Oct 2003 Location: Just West of Lambs land Casino cash: $10004900	I didn't see anything on this list I would ever own. __________________ sig test for this screwy schema
Posts: 25,901

11-16-2005, 09:28 AM	#9
beavis Free Born Man of the USA Join Date: May 2003 Casino cash: $9954900	Given that list of cds, I think they should leave the protection on.
Posts: 7,588

11-16-2005, 09:47 AM	#10
KcKing Starter Join Date: Sep 2005 Location: Olathe KS Casino cash: $10004900	^^ Most Def... Anyone attempting to share these... Celine Dion - On ne Change Pas Neil Diamond - 12 Songs SHOULD have a computer destroying virus destroy their respective systems before the evil is spread.
Posts: 686

11-16-2005, 10:09 AM	#13
teedubya Most Valuable Poster Join Date: Oct 2003 Casino cash: $9470002	to any of you who still purchase CDs... period... Bwha haha ha
Posts: 36,659

11-16-2005, 10:14 AM	#15
Extra Point MVP Join Date: Sep 2005 Location: Prairie Village, KS Casino cash: $10004900	Looking at the list, other than Van Zant, Mulligan, and Gordon, what's there to protect? __________________ "Sometimes I sits and thinks, and sometimes I just sits." --Satchel Paige
Posts: 7,845