It hides its presence, it can't be removed without damage … and it's legal. (eWEEK.com)New digital rights management technology shipping on music CDs by Sony Corp. of America/Bertelsmann AG artists employs stealthy, rootkit-style techniques to hide from users, according to a security expert.
The new technology, which Sony has dubbed "sterile burning," manipulates the Windows core processing center, or "kernel," to make the DRM almost totally undetectable on Windows systems.
These DRM files are almost impossible to remove without fouling Windows systems and could be used by malicious hackers to hide their own programs, according to Mark Russinovich, chief software architect at Winternals Software Inc., a company that makes administrative software tools.
Sony BMG acknowledged that the rootkit-style features are part of DRM technology that began shipping with CDs in 2005, but referred technical questions about the technology to First 4 Internet Ltd., the Banbury, England, firm that developed it.
Russinovich said he discovered the Sony rootkit technology after scanning his own computer with a tool called RootkitRevealer that he developed.
Russinovich, who is an authority on rootkits, said he was shocked by the discovery.
"Given the fact that I'm careful in my surfing habits and only install software from reputable sources, I had no idea how I'd picked up a real rootkit," he wrote on his blog.
Click here to read about the progress of DRM in the United Kingdom.
After discovering the program, Russinovich began a detailed analysis of it that turned up the name of First 4 Internet, a UK firm that developed the software for Sony.
Russinovich said he believes that the software was installed on his system by a copy-protected CD of music by Sony BMG artists The Van Zant Brothers that he recently purchased from Amazon.com.
Through a detailed analysis of communication between the media player installed from the Sony CD and the rootkit files, Russinovich was able to determine that the rootkit files were installed with the media player and communicated with it.
Russinovich was reluctant to discuss the details of how the DRM software works, citing fear of prosecution under the DMCA (Digital Millennium Copyright Act). However, he said the rootkit features help enforce the sterile burning limits on copying Sony music files.
A Sony BMG spokesperson said the sterile burning and rootkit technology is intended to act as a "fence" or "speed bump" for users who want to try to go beyond the limit of three copies on the company's DRM-protected music.
Read the full story on eWEEK.com: Sony DRM Uses Rootkit Techniques
Web Design 
