Computer Associates has
officially blacklisted the Sony BMG XCP Technology that
the record label bundles with several of its audio CDs.
CA's PestPatrol
anti-spyware application now offers users the ability to remove the
application, which it refers to as a Trojan horse.
The vendor justifies referring to the technology as a Trojan by pointing out
on its
spyware
information website that XCP "installs without user permission, presenting
only a vague and misleading end user licence agreement".
XCP also changes the system configuration without the user's permission and
silently modifies other program information or website content. CA has further
alleged that Sony has failed to allow users to remove the tool.
The application is also accused of shortening the life span of the user's
hard drive by performing a scan of system processes every 1.5 seconds.
Another widely publicised feature of the technology is a
rootkit that hides the digital rights management
technology from the system and the user.
The rootkit will actually hide any file, process or registry key that begins
with the characters '$sys$', making it extremely easy for virus authors and
hackers to hide malicious applications from virus and spyware scanners.
Sony has always denied that there are any security issues associated with the
software.
The technology was designed by
First 4
Internet, and is bundled with several of Sony's audio CDs. Roughly two
million of the CDs have been shipped.
The Electronic Frontier
Foundation has
compiled
a list of some of the offending CDs with instructions on how to prevent
getting infected.
Users who seek to play the CD on their computer CDRom drive on a Windows
machine are presented with a licence agreement.
While the licence discloses that software will be installed, it does not give
details and falsely suggests that it can be uninstalled. Upon agreement, the
rootkit and DRM technology is installed.
Sony has released a patch that removes the cloaking feature of the rootkit,
but CA pointed out that the patch failed to resolve all security concerns.
To obtain the Sony uninstaller, users are also required to give out personal
information that will be used by Sony BMG and undisclosed third parties.
Reader comments