Sony's Rootkit a Blessing for Spammers and Hackers

A rootkit is a piece of software used by hackers to cover their tracks. Common rootkit functionality includes:

- Cleaning security logs of any evidence of intrusion
- Disabling anti-virus / anti-spyware utilities
- Hiding running processes
- Preventing detection and / or deletion of files left behind

Sony's latest copy protection scheme makes modifies Windows to provides at least the last item on the list and possibly others. The intent is to prevent the copy protection software's removal. If a user tries to tamper with it, it can leave their CD-ROM drive non-functional.

One Wired editor is calling for a Boycott of Sony.

While this is clearly concerning, what's more alarming is that the rootkit can be exploited by anyone or any software. If a piece of malicious code simply creates or renames a file using a certain convention, it will subsequently be invisible to users, the operating system and any anti-virus or security software they may be running.

All a user needs to do to install Sony's rootkit is to try playing their favorite Sony music CD in their computer. There is a brief notice regarding terms of use, but nothing notifying the user that Sony is about to hack their system.

This presents a ripe opportunity for hackers, spammers and other internet misfits. If nothing changes, over a short period of time a reasonable percentage of all systems will have Sony's rootkit installed. On those systems, it will be possible readily deploy viruses, spam zombies and spyware, which cannot be detected by any conventional means.

Spam zombies are systems compromised by malicious code for the purpose of sending spam email. By using zombies, spammers are often able to bypass certain techniques to filter email. Spam is often blocked by using DNS blacklists which indicate what networks are most likely to be sending spam. Zombies evade this technique for filtering spam by spreading the distribution of spam over thousands of systems.

Fortunately, Microsoft is taking a stance against this problem by announcing plans to detect and remove Sony's rootkit in an upcoming release of its anti-spyware utility. The program is currently in beta, and will be released as part of Windows Vista.

Thank you Sony.

Back