Rootkits: Sony does it again

I would have never thought that a company like Sony would not learn from its mistakes especially after the first rootkit debacle which was a major public relations fiasco for Sony. The first rootkit was placed on several audio CDs that were distributed in 2005 and led to a $6 million settle case in the United States. While the rootkit was intended to make it impossible (albeit ineffectively) to copy music from the CDs it was effectively used by producers of malware, trojans and spyware to hide their code from antivirus software.

The sentenced that always reminds me of how amateurish Sony handled the whole affair went something in the line of “People who don’t know what rootkits do should not care about them”.

It seems Sony did it again. F-Secure is reporting that Sony is now selling a USB stick - the Sony MicroVault - which installs a hidden folder in c:\windows when installing the USB fingerprint software.

So, when enumerating files and subdirectories in the Windows directory, the directory and files inside it are not visible through Windows API. If you know the name of the directory, it is e.g. possible to enter the hidden directory using Command Prompt and it is possible to create new hidden files. There are also ways to run files from this directory. Files in this directory are also hidden from some antivirus scanners (as with the Sony BMG DRM case) — depending on the techniques employed by the antivirus software. It is therefore technically possible for malware to use the hidden directory as a hiding place.

F-Secure suspects that the hidden folder is used to protect the fingerprint authentication and strongly disagrees that this is the correct way to achieve a protection.

I think that Sony made a big mistake in using such a technology again even if it was intended to be of good use for the owner.

Read More:

F-Secure Blog