Sony rootkit: A black eye for security vendors?
Dec 6th, 2005 Posted in technology | no comment »Sony BMG Music Entertainment has been lambasted for shipping its spyware-like XCP software on music CDs over the past year, but an important question has gone largely unanswered throughout the controversy: Why didn’t security vendors catch the problem sooner?
Though one security vendor, Finland’s F-Secure Corp., was aware of XCP’s (extended copy protection’s) problems before blogger Mark Russinovich went public with the issue, none of the major antispyware or antivirus vendors had any idea that something was amiss, according to representatives from Symantec Corp., McAfee Inc., and CA Inc.
Sony has sold an estimated 2 million CDs containing the copy protection software, which used special “rootkit” techniques to hide itself on the PC. Rootkit software runs at a very low level of the operating system and is designed to be extremely difficult to detect. Ultimately XCP’s cloaking ability was used by hackers to write malicious software, a development that prompted Sony to recall its XCP CDs.
Shortly after its discovery XCP was classified as dangerous software by most security vendors, but Princeton University computer science professor Edward Felten was disturbed it took so long for such a widespread problem to be exposed.
“This malware had been on the market for months and presumably had been installed on hundreds of thousands of computers, but still none of the anti-malware vendors had discovered it,” Felten wrote in a blog posting (http://www.freedom-to-tinker.com/?p=937) earlier this week. “It’s not a good sign that all of the major anti-malware vendors missed it for so long.”
