Microsoft Update Will Remove Sony DRM Rootkit
13th November, 2005
Upcoming releases of Microsoft's spyware removal tools will uninstall Sony copy-protection software that functions as a rootkit. "We have analyzed this software, and have determined that in order to help protect our customers we will add a detection and removal signature for the rootkit component of the XCP (Extended Copy Protection) software," Jason Garms of Microsoft announced on the Anti-Malware Engineering Team blog. "Rootkits have a clearly negative impact on not only the security, but also the reliability and performance of their systems." The detection of the Sony tool will be included in upcoming releases of the Malicious Software Removal Tool, which is updated through Windows Update, as well as the beta of Windows Antispyware.
Sony uses XCP software to restrict unauthorized copying of music CDs. The software's controversial operations were detailed by Mark Russinovich of SysInternals two weeks ago, prompting alarm among many security experts. "Although the software isn't itself malicious, the hiding techniques used are exactly the same that malicious software known as rootkits use to hide themselves," noted F-Secure, which soon discovered a trojan attempting to use the Sony XCP software to disguise its presence. Fortunately, the trojan had coding errors that prevented it from spreading widely.
On Friday Sony announced it would halt production of CDs including XCP technology. "We are aware that a computer virus is circulating that may affect computers with XCP content protection software," the record label said in a statement Friday. "We stand by content protection technology as an important tool to protect our intellectual property rights and those of our artists. Nonetheless, as a precautionary measure, Sony BMG is temporarily suspending the manufacture of CDs containing XCP technology."
Microsoft's decision to remove the Sony rootkit may have been influenced by concerns that the software could interfere with the stability of Windows. Russinovich told the Windows news site Bink.NU that a software patch Sony issued to limit XCP capabilities could cause crashes in Windows during installation. Microsoft and Sony are also ferocious competitors in the gaming market, where Sony's PlayStation 2 and Microsoft's Xbox are the leading gaming consoles.