Sony rootkit victims in every state, researcher says

Iria · Jan 18, 2006, 07:44 PM

A security researcher has claimed that computers in every U.S. state have been affected by copy-restriction software from Sony BMG.

Dan Kaminsky released the information at the Shmoocon 2006 hacker conference in Washington last week. Florida seems to have the highest number, with 12,588 networks detected that are hosting computers with the digital rights management software installed, according to his research. California and Massachusetts also exhibit high rates of infection, although the numbers are only an estimate, as each network could host any number of computers with the Sony software installed.

The DRM software is automatically installed by some Sony BMG music CDs and is hidden using a rootkit, which can be exploited by a particular type of Trojan horse and hence constitutes a significant security risk.

Kaminsky worked out the locations of machines with the rootkit installed by collating information on communication between the rootkit and Sony--the software contacts Sony each time the CD is played.

"Sony has a rootkit. The rootkit phones home. Phoning home requires a DNS query. DNS queries are cached. Caches are externally testable provided you have a list of all the name servers out there," Kaminsky said in a November blog posting.
____________
Read More / Source: ZDNet

Jan 18, 2006, 07:44 PM	#1
Iria DriverHeaven Extreme Member Join Date: Apr 2004 Posts: 7,275 Rep Power: 89	Sony rootkit victims in every state, researcher says A security researcher has claimed that computers in every U.S. state have been affected by copy-restriction software from Sony BMG. Dan Kaminsky released the information at the Shmoocon 2006 hacker conference in Washington last week. Florida seems to have the highest number, with 12,588 networks detected that are hosting computers with the digital rights management software installed, according to his research. California and Massachusetts also exhibit high rates of infection, although the numbers are only an estimate, as each network could host any number of computers with the Sony software installed. The DRM software is automatically installed by some Sony BMG music CDs and is hidden using a rootkit, which can be exploited by a particular type of Trojan horse and hence constitutes a significant security risk. Kaminsky worked out the locations of machines with the rootkit installed by collating information on communication between the rootkit and Sony--the software contacts Sony each time the CD is played. "Sony has a rootkit. The rootkit phones home. Phoning home requires a DNS query. DNS queries are cached. Caches are externally testable provided you have a list of all the name servers out there," Kaminsky said in a November blog posting. ____________ Read More / Source: ZDNet