Sony's Digital Rights Mania finally lands them in court

[Christopher]

Slashdot reports that a class action suit against Sony in California alleges that Sony's copy-protected audio CDs violate several California statutes, including the "Consumer Legal Remedies Act" and the "Consumer Protection against Computer Spyware Act," which prohibits -- among other things -- software that takes control over the user's computer or misrepresents the user's ability or right to uninstall the program. Earlier, Mark Russinovich investigated Sony's self-installing CD protection software and found it to be akin to spyware, intentionally hiding itself and providing no means of removal. Sony later released an uninstaller, but Mark has has looked at it and finds "Without exaggeration I can say I've analyzed virulent forms of spyware/adware that provide more straightforward means of uninstall".

Attention Sony Electronics -- would anything bad actually happen if you just jettisoned Sony Entertainment?

Edited November 17, 2005 by Webmaster

[jadeclaw]

Well, it keeps up.

According to the BBC (at the bottom), there are now 6 (six!) class action lawsuits running.

According to TechTree, the first trojan has been debugged and is now fully operational.

And finally, ZoneAlarm 6.0 claims to detect and block the rootkit and associated trojans:

BusinessWire

Finally, Sony-BMG thinks, Europe should have some rootkit-fun as well.

German international broadcaster Deutsche Welle reports, that the XCP-copyprotection will be used in Europe from 2006 onwards.

That wraps up the newscast for today, for earlier news and links take a look here.

To discuss, come back here into this thread.

@kurisu: If I remember correctly(too lazy to look it up now), the musicbusiness adds only a small part to the revenue ( less than 10% ).

To be frank, Sony would be much better off, if the musicbusiness is sold or closed down.

I'm inclined to guess, that the financial damage, that Sony Electronics suffers from this brouhaha is bigger than the revenue gained from the musicbusiness.

[EDIT 3:30 PM ET] And Reuters reports now, that Sony temporaily stops manufacturing CDs with the controversial XCP-Technology (aka rootkit).

See: Sony BMG pulls CD software

Edited November 11, 2005 by jadeclaw

[dinkydexy]

Don't let's assume that Sony will lose any or all of these lawsuits.

[anont]

Sony Electronics does make up a big part of the revenue, but it's not nearly as profitable as Sony Entertainment - it only made a small profit last year and would have lost a very large amount of money had it not been for a huge one-time tax refund in its United States operations.

I think it's fair to say the Electronics division would be jetissoned far before the Entertainment division, which is why a guy from the American Entertainment division is now running the company.

[Syrius]

Don't let's assume that Sony will lose any or all of these lawsuits.

I want to know what kind of defense they can come up with in front of the judge.

Seriously. This is like me installing a camera in my neighbor's bedroom on the pretense that my wife might cheat on me with him. That doesn't justify my invasion of his privacy and his wife's.

If Sony wins and this crap is justified by the courts: People will distrust the corporations. Not buying their goods anymore, but a rise in pirated music. Remember the deal when the found out Tivo was watching you watch TV?

If Sony loses: Companies will think twice before going to such shameful lengths to alienate their customers in the name of copyright. I work in customer service, and I know it's better to waive a few dollars in fees in order to keep a customer so he can still buy my product later, than lose him and his business for some money I could have recovered anyway. Also, artists will think twice or ask in their contracts such stupid schemes are not put. Do you think the Van Zants are happy about this after people stay away from their "tainted" CDs?

Edited November 12, 2005 by Syrius

[viiv]

Get rid of *^$*&^ Sony Music/Pictures. If Sony never brought Columbia way back when they woukd be where Apple is now with the iPod. We know that Apple makes all there money off hardware and hardly any off the music store. Get rid of Sony Entertainment, please!!!

[SleepingInRlyeh]

You know, Sony entertainment isn't bad. I like a lot of their music and pictures. What they need to do is fire the people running it.

Software has dealt with piracy for years without suing everyone who uses the internet and tanking people's machines. There's no reason that Sony couldn't do the same. You can still make a profit.

I submit Sony should hire a software exec to run Sony Entertainment. Look at what Jobs did with the iPod and iTunes. There is a way to make a boatload of money off of digital media without being a paranoid psychopath towards your customers. They just need a different business model.

[ozpeter]

"We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use," the company said in a statement."

Should we in the Minidisc Community be getting excited?

[jadeclaw]

Should we in the Minidisc Community be getting excited?

Better not.

There is a nice commentary on Groklaw about the issue and corporate ethics and bloggers in general.

Good read and it put things a bit in perspective.

Advice to Sony: Deliver quality and value for money, then you don't need any copyprotection on your CDs.

Edited November 12, 2005 by jadeclaw

[rirsa]

Sony Blinks: http://www.securityfocus.com/brief/45

"Beleaguered Sony BMG will temporarily suspend the manufacture of CDs protected with technology from First 4 Internet and re-examine its copy-protection strategy..."

Information on rootket CDs from EFF: http://www.eff.org/deeplinks/archives/004144.php

[jadeclaw]

I guess, they will wait until people forget,

then comes the next round.

Unless the lawsuits leave a nice dent in Sonys pocket.

Illiads take on this:

User Friendly

[big_raji]

Should we in the Minidisc Community be getting excited?

Quite the contrary.

I wonder what other surprises hide inside SonicStage and Sony Connect?

Edit:

Ugh, just did a quick reading of several of these articles...

For some reason, I never felt "offended" by Sony's DRM and their treatment of customers as "Potential Criminals" but after reading this, it's like a tidal wave of repressed emotions. Is it the power of suggestion? Jumping on the bandwagon? or merely a rude awakening? I'm suddenly pissed off at Sony for all the inconveniences I've gone through with minidiscs in the past.

I wonder if the feeling will pass. It's obviously a knee-jerk reaction, but I somehow doubt I'll be able to smile the next time someone asks if they can listen to a song from my minidisc player on their flash mp3 player.

Edited November 13, 2005 by big_raji

[rirsa]

Microsoft Zapping Sony DRM 'Rootkit'

http://www.eweek.com/article2/0,1895,1886122,00.asp

http://blogs.technet.com/antimalware/archi.../12/414299.aspx

[hobgoblin]

I guess, they will wait until people forget,

then comes the next round.

Unless the lawsuits leave a nice dent in Sonys pocket.

Illiads take on this:

User Friendly

ah, user friendly. if there is anything that can get me to see the absurdity of the it world, this is it

[jadeclaw]

We all know, on which side of the fence the bushies are normally standing,

but when a government official reacts critical towards RIAA/MPAA,

then you know, someone has gone too far:

DHS Official Weighs In on Sony.

Plus, The Inquirer has a nice commentary about Microsofts

and other security software vendors slow reaction:

Microsoft removes Sony malware with implications.

Yes, it was whimper...

But atleast, one rootkit is now off the list.

[rirsa]

There's a new post on Mark's Blog this morning including discussion of ant-virus software and the correct way to disable the rootkit.

http://www.sysinternals.com/Blog/

[jadeclaw]

Thanks Rirsa,

looks like Sony comes to its senses.

However, Sony seems to think, if the reputation is going down the drain,

why not speeding up the process.

This time it is Sony Pictures engaging in unethical behaviour.

They had the splendid idea to insert links to the website of the movie 'Emily Rose' into exorcism-articles at Wikipedia.

Add guestbook- and comment-spamming and you're set.

However, Sony underestimated the community again:

The Wikipedia-articles had been corrected in no time and the german blogger scene is buzzing with negative comments.

But it is possible, that Sony finds themselves back on the wrong bench in a courtroom.

Article 13 of the medialaw in germany requires, that any advertising has to be marked as such.

Neither the guestbook spam, nor the website for the movie has been marked as advertising.

Oh, and do I have to mention IP-violations too?

Wikipedia-articles had been used on the movie-website without proper attribution.

Article on Telepolis (German)

Edited November 14, 2005 by jadeclaw

[rirsa]

Yeah, "It just keeps getting worse":

http://www.security.ithub.com/article/Sony...e/165201_1.aspx

This story examines issues with Sony's other DRM software, SunnComm's MediaMax.

"Though it displays a EULA, all the files the DRM needs are inserted on the hard drive ... before the EULA appears....The DRM files remain installed on the hard disk even if the EULA is declined....Like a virus, there is no meaningful uninstaller available." And it phones home.

Also some bright person took a look at the XCP rootkit and found that parts appear to use the LAME mp3 encoder and do so in a way that violates the GPL. Sony may be guilty of -- wait for it -- copyright infringement.

As the author writes this will "serve MBAs of the future as a textbook example of how not to do things."

Edited November 15, 2005 by rirsa

[big_raji]

Yeah, "It just keeps getting worse":

http://www.security.ithub.com/article/Sony...e/165201_1.aspx

I just read the last line of that article, and it talked about Sony applying for a patent for a method of restricting their game software to "One Game, One Unit".

Yowza.

So basically, Sony wants to lock their games to a single solitary console? If in the near future, I have two consoles, I can't share the same disc between the two, but instead have to buy two copies of the same game?

Was Minidisc ever like this? I seem to remember someone mentioning a long time ago that an original minidisc album release would lock itself to the first player it was played in. Is that right? Or am I remembering it incorrectly?

[jadeclaw]

I just read the last line of that article, and it talked about Sony applying for a patent for a method of restricting their game software to "One Game, One Unit".

Yowza.

So basically, Sony wants to lock their games to a single solitary console? If in the near future, I have two consoles, I can't share the same disc between the two, but instead have to buy two copies of the same game?

Customers won't put up with that, to be frank, that will be a gigantic failure,

just like DivX. (Not the codec, the pay per view limited DVD that was)

Was Minidisc ever like this? I seem to remember someone mentioning a long time ago that an original minidisc album release would lock itself to the first player it was played in. Is that right? Or am I remembering it incorrectly?

No, prerecorded Minidiscs were made like prerecorded CDs. They had no writable area, so they could not locked onto one unit.

One thing is sure, the longer this affair is cooking, the more damaging it will be for the music industry.

Expect a serious drop in sales of protected CDs.

Sony will have a lot of explaining to do in the months to come.

[dex Otaku]

More news on this subject:

http://www.freedom-to-tinker.com/?p=926

Apparently, Sony's XCP uninstaller can actually cause more problems than it's supposed to fix.

[jadeclaw]

Mark Russinovich already pointed to the fact, that the ActiveX-Control used has more properties and functions than necessary.

Looks like the F4I-programmers just took an off-the-shelf control without checking first.

And the fact, that the rootkit and this control possibly too on half a million networks as pointed out here, operators of botnets will have a field day infecting machines by the thousands.

Plus, SonyBMG was definitely illegally distributing LGPL-code along with the rootkit.

First, Muzzy found a bunch of LGPLed libraries on the CD in one of the install packages, then Sebastian Porst found LAME-Code inside an ActiveX-control used by the player application.

Atleast, SonyBMG starts recalling and exchanging the CDs

Oh, and Suncomm-protected CDs are dangerous as well. Even if you decline the EULA, your machine is infected.

And finally on a different front, Sony faces trouble from the Office of Fair Trading (OFT) and the European Commission:

Sony in internet 'price-rigging' rumpus.

So, that's it from todays tour of the wibbly wobbly web.

My advice to Mr. Stringer: Get a real big broom and clean out middle and upper management levels.

Something up there really stinks.

Edited November 15, 2005 by jadeclaw

[bogon07]

Sony recalls risky "rootkit" CDs

From CNET news

"Record label Sony BMG said Tuesday that it will recall millions of CDs that, if played in a consumer's PC disc drive, will expose the computer to serious security risks.

Anyone who has purchased one of the CDs, which include southern rockers Van Zant, Neil Diamond's latest album, and more than 18 others, can exchange the purchase, Sony said. The company added that it would release details of its CD exchange program "shortly."

Sony reported that over the past eight months it shipped more than 4.7 million CDs with the so-called XCP copy protection. More than 2.1 million of those discs have been sold. "

http://news.com.com/Sony+recalls+risky+roo...ml?tag=nefd.top

[rirsa]

Welcome To Planet Sony

http://www.doxpara.com/?q=sony

Nice maps of infection using cached DNS queries.

[hobgoblin]

now thats a interesting european map.

denmark and southern sweden is lit up, same with GB and what is often called the low contrys. on and dont forget the swiss.

the rest have spots but nothing big

interesting that oslo and the surrounding citys are very bright to

[rirsa]

I thought the most interesting anomaly was South Korea. It is completely dark but there's hardly a shortage of music, computers, broadband, etc. in Seoul.

Also, for entertainment some of this is hard to beat:

http://www.xcp-aurora.com/press_related.aspx

Edited November 16, 2005 by rirsa

[Ascariss]

Although old:

http://www.xcp-aurora.com/press_article.aspx?art=jun_05_art2

A UK firm called First4Internet, which created the technology, said the primary goal is not to prevent copies of the songs from ending up on illicit, peer-to-peer file-trading networks, which the industry blames for million of dollars in lost sales.

Instead, it aims to dissuade people from burning unlimited CD copies in what is sometimes called "schoolyard piracy."

"This technology is a speed bump. It's trying to dissuade the average consumer from making as many copies as they like," said First4Internet Chief Executive Mathew Gilliat-Smith.

"You're not going to stop tracks getting on P2P sites," he added. "It's designed to stop casual piracy ... It's not saying you'll stop people from doing it, but it makes people stop and think."

Schoolyard piracy? I may have finished highschool back in 2001, but as far as I know, not many people were swapping CDs between friends back then, and sadly, I don't see it anymore at Uni either. So I am puzzled to why sony even has this copy barrier when they provde a back door to it as well.

2 outcomes, sony wins or loses. If they win, the case could serve as a precident for future cases if such porblems arise again. If they lose, well then, it will hurt sony financially, which it already has, they are recalling all the cds, stopping production and replacing the protected cds with normal ones for users.

as for the lawsuit aspect, I am not sure if the people bringing the case against sony will seek damages, I assume they will, but I haven't heard any figures, granted i didn't read the latest info.

We'll see how this all ends eventualy.

[dex Otaku]

2 outcomes, sony wins or loses. If they win, the case could serve as a precident for future cases if such porblems arise again. If they lose, well then, it will hurt sony financially, which it already has, they are recalling all the cds, stopping production and replacing the protected cds with normal ones for users.

I'm willing to bet that the replacement CDs will have a different form of copy protection on them.

[Deanage]

I'm willing to bet that the replacement CDs will have a different form of copy protection on them.

I'll give it a week before it's cracked.

[atrain]

autoplay disabled + eac

[rirsa]

Bruce Schneier: "That all the big security companies, with over a year's lead time, would fail to notice or do anything about this Sony rootkit demonstrates incompetence at best, and lousy ethics at worst."

http://www.schneier.com/blog/

http://www.wired.com/news/privacy/0,1848,69601,00.html

[jadeclaw]

autoplay disabled + eac

Yup.

And if all fails, there is still the CD-player with digital out.

But it looks like, that F4I and SonyBMG are steering rapidly into very hot legal waters:

Muzzy's page about the whole thing

( Look under: ECDPlayerControl.ocx (violates LGPL, GPL, DMCA, EUCD) )

The gory details:

Proof, that F4I violates the GPL

Yes, we have a full blown GPL-violation here.

What does that mean: Since neither F4I nor SonyBMG had followed the obligations of the GPL,

they had no licence to distribute.

In other words: It is the same like selling pirated music or software - a full violation of copyright law.

Yes, a criminal offence.

Let's see, how the management explains that away.

Oh, and before the 'The GPL hasn't been tested in court'-Trolls descend down here, this is not necessary:

The GPL is a licence, not a contract. If you don't follow the rules laid out in it, the licence is simply invalid.

For you and you alone. And if you don't have a licence, what is in effect? The copyright law.

And we all know, what that allows, if it's not your own stuff.

@rirsa: As usual, Bruce Schneier hits the nail on the head.

Can we really trust the vendors of security software?

[EDIT]:

There are now websites online, that use the Rootkit-uninstaller-control to infect a computer with malware:

http://www.websensesecuritylabs.com/alerts...php?AlertID=340

Edited November 17, 2005 by jadeclaw

[rirsa]

@rirsa: As usual, Bruce Schneier hits the nail on the head.

Can we really trust the vendors of security software?

I think anti-virus software from the big vendors is for the birds. I used to use Norton but I don't think Symantec updates signatures fast enough and have you noticed the yearly renewal fee keeps going through the roof? At my work they use McAfee which screws up my system so I exterminated it. At home I use one of the free anti-virus solutions. This episode just adds to the feeling that anti-virus software is a lot of cash for not very much protection. For people who have no idea about computer security and don't want to learn, I say, by all means throw your money at the them and pray.

[DJ_THE_CROW]

those Sony stupid bosses...

is that virus also in Sonic Stage ? Is every ones computer hooked up by that XPC Virus after Sonic Stage installation ?

we are really poor customers...

[jadeclaw]

No, SonicStage has nothing to do with that.

[rirsa]

Going back to the Schneier story referenced above. in which he states: "The story to pay attention to here is the collusion between big media companies who try to control what we do on our computers and computer-security companies who are supposed to be protecting us."

Someone posted a response on his blog page asking what happend to the quote on a CNet story that goes like this in the original:

"The creator of the copy-protection software, a British company called First 4 Internet, said the cloaking mechanism was not a risk, and that its team worked closely with big antivirus companies such as Symantec to ensure that was the case."

If you go to the CNet site the story now reads:

"The creator of the copy-protection software, a British company called First 4 Internet, said the cloaking mechanism was not a risk. The company's team has worked regularly with big antivirus companies to ensure the safety of its software, and to make sure it is not picked up as a virus, he said"

Search for the story on Google and you can see the original version is still in the Google cache. They are all in bed with each other and guess who is getting #$%^*!?

[KrazyIvan]

I am seeing Slashdot has a post that the DRM used by F4I possibly has stolen code in it too. :eek:

Edited November 17, 2005 by KrazyIvan

[Syrius]

what a bunch of hypocrites and digital sinners. "Let's use someone else's copyrighted code without permission to make sure people don't go making copies without permission of our copyrighted works!"

DIGITAL FATWA ON THEM! FATWA! DEATH TO ALL WHO OPPOSE THE CAUSE!

Erm.. sorry. I gotta lay off the caffeine.

[Bananatree]

It makes sense to me, and record companies do this all the time:

Steal something that isn't actually for sale, and claim you made it. Thus putting a copy-right on it yourself. Companies have been doing this for years.

[bogon07]

Yup.

And if all fails, there is still the CD-player with digital out.

I haven't tried the Sony CDs but other copy protected CDs seem to be detected as protected via the digital out on my CD players and playstation and prevent digital recording to an Minidisc recorder.

That was a year ago using an N505 which displayed a message indicating that it could not copy a protected CD.

I did manage to record to MD using the normal RCA out sockets of a CD deck before I found I could copy the CD with no problems with CDEX from the DVD computer drive or use iTunes.