Chad's News

Sony BMG recently implemented a copy-protection scheme on some of its music CDs that has the tech community up in arms and has even managed to make the popular press. Here’s what you need to know about it.

The music CDs play without problem on standard CD players, but require special software to play on a computer. When you insert the disc into your CD drive, you get a license agreement. After clicking on the “Agree” button, DRM software is installed from the CD allowing you to play the music. So far, so good. Maybe a bit annoying, but not newsworthy.

The problem is that, on Windows systems, Sony utilizes a rootkit to help prevent people from disabling the DRM software. A rootkit is a set of programs and tools that enables a (typically malicious) program to hide its presence on a system. This fact was discovered by Mark Russinovich when he ran his Rootkit Revealer program and got an unexpected positive. (By the way, if you’ve never checked out the SysInternals web site, I heartily recommend it. They have some useful freeware utilities that you can’t find anywhere else.)

Mark posted the discovery on his blog, and it didn’t take very long for the tech community to go ballistic. They called it an infection, a trojan, spyware, etc. But the real problem was that the Sony rootkit hides “any file, directory, registry key, or process whose name begins with ‘$sys$’”. It was thus theoretically possible for malicious hackers, upon gaining access to a system, to utilize the rootkit for their own purposes. And it wasn’t long before that theoretical possibility became a reality.

Sony slowly began to realize they had a problem. First they gave difficult and convoluted instructions on how to remove the rootkit. After complaints from the tech community, they came up with a better method. As publicity mounted, Sony finally decided to recall the copy-protected CDs. Then the lawsuits began. The EFF filed a class-action lawsuit, and the state of Texas filed a civil lawsuit claiming the DRM software violated its spyware laws. Finally, as the tech community dug further into the DRM software, they discovered that Sony had illegally copied some LGPL-licensed software.

This was an expensive public-relations fiasco for Sony. The funniest part is that it’s possible to circumvent the copy protection using a piece of tape, holding the Shift key while the CD is loading, or disabling autoplay. (Note that the tape method is old news—it seems that sometimes they never learn.)

So that’s the whole thing in a nutshell. Here are some links with more details:

http://www.tgdaily.com/…

http://www.schneier.com/…

Every so often the tech news community lights up about a gaffe related to document metadata. Some years ago Apple was running a fairly successful switch campaign where people gave testimonials about why they switched to a Mac. Microsoft responded with its own anti-switch campaign. The name of the person in the Microsoft testimonial was not given but was included in the document’s metadata. An AP reporter was able to track her down and discovered that, much to Microsoft’s embarrassment, she worked for a PR firm employed by Microsoft. To add further damage, the picture in the testimonial was a fake, taken from stock footage. Microsoft quickly pulled the ad from its site and pretty much abandoned the anti-switch campaign.

More recently, the United Nations prepared a report on the murder of Rafik Hariri, the former Lebanese Prime Minister. Some of the more damaging allegations were removed just prior to the report’s release, but they remained in the document as metadata. These politically-sensitive deleted portions were quickly discovered and publicized, to the UN’s embarrassment.

For most practical purposes, “metadata” refers to hidden information kept by Microsoft Word as part of a saved *.doc file. The most common type of metadata is information on the people who created/edited the document. Just pull up a Word document and go to File | Properties. You should be able to quickly find the name and company of the author. This is the type of metadata that caught Microsoft.

The UN situation was a bit different. They had enabled Word’s abililty to track revisions, because the document was being edited by multiple people. The author forgot to accept the changes, thus making the original draft and the full revision history available to those “in the know.”

Anyone in a business or professional environment needs to be aware of document metadata—the potential for damage is just too high. The following are some ways to properly deal with metadata:

• Use the Office add-in provided by Microsoft, or (recommended) purchase a commercial “scrubber”. There is also a free utility, Doc Scrubber™, that works pretty well.
• Save the file in the RTF format and then convert it to PDF for distribution. (You should be doing this anyway—distributing non-draft versions of *.doc files can bite you.) Be aware that Adobe Acrobat also retains some metadata, so just converting to PDF may not be enough.
• Turning off the “track changes” feature and/or selecting “accept changes” are not sufficient to remove your metadata.

Additional/Reference Links:

• http://www.denniskennedy.com/…
• http://www.lifehacker.com/…
• http://www.corante.com/…

Need a good, random password? Steve Gibson has created a password generator that does the trick. His site, www.grc.com is a good resource for the computer user interested in privacy and security. It’s also the home of the free ShieldsUp! utility, which scans common TCP ports on your computer to see if they’re open to attacks (or just visible).

https://www.grc.com/…

This is just amazing. A “botnet” of 50,000 zombie PCs is considered a very large number, and is more than enough to bring down nearly any site via a distributed denial-of-service (DDOS) attack. The goal is to extort sites for money by threatening to take them down. There are firms that specialize in helping you survive a DDOS attack, but these guys had 1.5 million zombies. I’m not anyone could weather something like that (except perhaps sites like Windows Update).

http://www.vnunet.com/…

Microsoft released another round of Windows security updates on Tuesday, and within hours a security company developed a workable exploit. I doubt it’ll be long before hackers do the same. Time to update if you haven’t already done so.

http://www.computerworld.com/…

A new type of denial-of-service attack. It’s still conceptual, but probably not for long.

http://www.iht.com/…

I’ve been seeing a bunch of articles on a new type of spyware: keystroke loggers. A keystroke logging program will keep track of everything you type and then forward it to someone who will look for account numbers and passwords. This can be very bad when the information is for banking, credit cards, and such. A recent study found that 15% of all spyware is of the keystroke logging type.

Most of you reading this are quite tech savvy and know all about not opening attachments on incoming emails and not clicking through to web addresses given in emails (especially those purporting to be from eBay, your bank, or PayPal). But there are other ways to install malicious keystroke logging programs with which you may not be familiar.

Security Holes: Computer systems that don’t have the latest security updates are vulnerable for as long as they are connected to the internet. Malicious programs continuously scan the internet for computers with open ports to unpatched programs. Tests were run with a fresh installation of WinXP SP1, and it took approximately 4 minutes before the computer was compromised. The best way to protect against this type of attack is two-pronged: 1) Apply all patches and updates as soon as they are available, and 2) use a firewall.

Browser Vulnerabilities: Carefully crafted web pages or even web addresses can attain the ability to execute programs on your system. The best way to protect against this type of attack is to not use Internet Explorer. If you must, ensure that all of the latest patches are applied.

DNS Cache Poisoning: This is one of those cases where even if you do everything “right”, you can still be compromised. Essentially, a system that you use for DNS is given false DNS information and stores the data in its DNS cache. So when you type in www.paypal.com, for instance, you are redirected to a spoof site which gets your login/password information (and may also attempt to exploit browser vulnerabilities). The best way to protect against this type of attack is to minimize financial transactions online. In reality, you just have to trust that your ISP and upstream providers don’t let their systems get compromised—it’s really quite simple and comes down to having their DNS system correctly configured.

Internationalized Domain Names (IDN): IDN is a fairly new standard whereby non-Latin (non-English) character sets can be used in domain names. This is of greatest concern for Asian-language domains, but it was expanded to include all languages. It turns out that some languages have characters that are identical to the English language, but which are treated as different under IDN. This only works when you click through to a spoofed web site, via email or a link on another site. The best defense against an IDN attack is to use Internet Explorer 6, as it does not support the IDN standard. Other browsers, such as Firefox, have implemented security procedures to ensure the user is aware of IDN site names, but older versions do not have these measures in place and are vulnerable. More recently, researchers have found another IDN exploit in Mozilla/Firefox, and it seems like the best thing to do for now is to simply disable IDN.