Sony rootkit under fire in court

Lawsuits filed in California and Italy and more to follow

Tom Sanders in California, vnunet.com 11 Nov 2005

Several class action lawsuits are being filed against Sony BMG over its controversial XCP anti-piracy software.

One case was filed in early November in California in which consumer Alexander Guevara asked the judge to ban Sony from selling any additional music CDs protected by anti-piracy software such as the XCP technology.

XCP aims to regulate the number of copies that a consumer can make of a CD on his computer as well as limit the file formats in which the CD can be ripped.

To prevent the user from deleting the technology, it comes bundled with a so-called rootkit that hides the software from both the user and the system, including from antivirus software.

Security experts have said that the technology is poorly designed and can easily be exploited by worm authors to dodge detection by antivirus software. A first virus targeting the software was detected on Thursday.

Computer Associates has officially blacklisted the technology, which it defines as a Trojan horse.

Alan Himmelfarb filed another lawsuit on 1 November, one day after software developer Mark Russinovich, of Sysinternals, unveiled the technology's true nature on his blog.

The suit is seeking class action status, which would allow Himmelfarb to argue his case on behalf of all California residents who purchased an audio CD with the XCP technology.

An employee for Himmelfarb's law firm confirmed its involvement in the suit, but was unable to provide further details because Himmelfarb was travelling.

Sony BMG did not return phone calls seeking further information. The company has always maintained that its software is harmless and does not compromise computer security.

Himmelfarb's complaint alleges that Sony failed to disclose the true nature of the XCP software.

"These actions constitute fraud, false advertising, trespass and violation of State and Federal statutes prohibiting malware and unauthorised computer tampering," he wrote in his complaint.

A similar suit is being prepared in the State of New York and a consumer watchdog group from Italy has also taken legal action against the record label.