Sony uses blackhat style rootkit in its DRM

[TankGirl]

PCWorld takes a similar stand on it:

The bigger question people have got to ask is, does Sony not respect the integrity of the computers of its customers? This cavalier act of sneaking software onto PCs not only violates our own Prime Directive -- it's our PC, dammit -- but threatens the entire music industry.

After all, if you suspect that a commercial CD will install software secretly, which you won't be able to remove and which, itself, may increase the already-great security problems of your Windows PC, would you continue to buy CDs?

I'll tell you right now, I won't. I'd much rather buy an unrestricted copy of a song electronically, using iTunes, or Rhapsody, or one of the other music services that offer this feature, than take a chance that some music disc will stick some hidden files in my Windows folder, which I can't see or remove.

Sony has dealt itself a serious blow, and the best thing it -- and the rest of the music publishers -- can do right now is condemn this practice, apologize to the customers that were affected, provide a method to get this junk off affected PCs, and make declarations that they will never, ever do this again.

I don't think they will. And if they don't, I simply won't buy CDs anymore. Period. From any publisher. And I recommend that you don't, either. As a fan of music who respects the need for artists to make a living, and a security-savvy PC user, I'm incensed that Sony -- any company -- would think it's OK to do this. It's not. But the only way (I can see) to send that message effectively to Sony BMG executives is to vote against CDs with my wallet.

Sony was crucial in creating the CD format more than 25 years ago. In this age where every purchasing choice we make affects the level of control we have over our PCs, they seem to be committed to killing it.

Here is an update from F-Secure regarding the situation. Sony is now distributing the promised software update (available from here). The update removes a rootkit driver and makes the previously cloaked files visible but unfortunately still does not help the consumer to uninstall the product in any automatic way. Therefore F-Secure has to conclude:

Automatic uninstallation of the software is still not possible without additional tools, and removing it manually is difficult. If you want to remove the software from your computer, we still recommend that you contact Sony BMG using their web form and ask for permission to uninstall it.

"Dear Sony, can you please give me a permission to remove your DRM from my PC?" Great added value to what the vanilla CDs used to be, eh?

- a van Zant album from Amazon: $ 14.99
- spending 2 hours of your time trying to figure out how to get the music into your iPod: $ 100.00
- spending 3 hours of your time trying to figure out the new security risks of music CDs: $ 150.00
- having your CD drive rendered useless while trying to get rid of Sony's rootkit: priceless