Extended Copy Protection (XCP) is a software package developed by the British company First 4 Internet, (which on 20 November 2006, changed its name to Fortium Technologies Ltd - see links below), and sold as a copy protection or digital rights management (DRM) scheme for compact discs. Fortium Technologies is a British company based in Bridgend, South Wales that develops and licenses DRM technology for use on optical discs in Events 284 - Diocletian was chosen as Roman Emperor. 762 - Bögü Khan of the Uyghurs, Year 2006 ( MMVI) was a Common year starting on Sunday of the Gregorian calendar. Copy protection, also known as content protection, copy prevention, or copy restriction, is a technology for preventing the unauthorised reproduction Digital rights management ( DRM) is a generic term that refers to Access control technologies used by hardware manufacturers publishers and Copyright holders A Compact Disc (also known as a CD) is an Optical disc used to store digital data, originally developed for storing digital audio It was used on some CDs distributed by Sony BMG and sparked the 2005 Sony BMG CD copy protection scandal; in that context it is also known as the Sony rootkit. Sony BMG Music Entertainment is a diverse music and entertainment group The Sony BMG CD copy prevention scandal concerns the Copy prevention measures included by Sony BMG on Compact discs in 2005
Security researchers beginning with Mark Russinovich in October 2005 have described the program as functionally identical to a rootkit: a software program used by computer hackers to conceal unauthorised activities on a computer system. Mark Russinovich is a Software engineer and Author who works for Microsoft as a Technical fellow. A rootkit is a computer virus which consists of a program (or combination of several programs designed to take fundamental control (in Unix terms "root" Russinovich broke the story on his Sysinternals blog, where it gained attention from the media and other researchers. The publicity, which grew to include a civil lawsuit and criminal investigations, soon forced Sony to discontinue use of the system.
While Sony eventually recalled the CDs that contained the XCP system, the web-based uninstaller was investigated by noted security researchers Ed Felten and J. Edward William Felten (born March 25, 1963) is a professor of Computer science and public affairs at Princeton University. Alex Halderman, who discovered that the ActiveX component used for removing the software exposed users to far more significant security risks, including arbitrary code execution from any site on the internet. ActiveX is a Component object model (COM developed by Microsoft for Windows.
Contents |
The version of this software used in Sony CDs is the one marketed as "XCP-Aurora". The first time a user attempts to play such a CD on a Windows system, a program will be installed even before a dialog box prompts the user to accept a license agreement. Microsoft Windows is a series of Software Operating systems and Graphical user interfaces produced by Microsoft. [1] The EULA did not mention that it installed hidden software. The software will then remain resident in the user's system, intercepting all accesses of the CD drive to prevent any media player or ripper software other than the one included with XCP-Aurora from accessing the music tracks of the Sony CD. No obvious way to uninstall the program is provided. Attempting to remove the software by deleting the associated files manually will render the CD drive inoperable due to registry settings that the program has altered.
The included player software will play the songs and allow only a limited degree of other actions such as burning the music onto a certain number of other CDs or loading it onto certain DRM-protected devices such as a few portable music players. The popular iPod, sold by Sony competitor Apple Computer, does not support their DRM format and they could not use Apple's FairPlay. iPod is a popular brand of Portable media players designed and marketed by Apple Inc Apple Inc, ( formerly Apple Computer Inc, is an American Multinational corporation with a focus on designing and manufacturing Consumer electronics FairPlay is a Digital rights management (DRM technology created by Apple Inc
XCP conceals itself from the user by installing a patch to the Windows operating system. This patch stops ordinary system tools from displaying processes, registry entries, or files whose names begin with $sys$. Other XCP components include "Plug and Play Device Manager", which continuously monitors all other programs being run on the computer.
In the period that XCP has been publicly known, security researchers have been quick to analyze it and publish their findings. Many of these findings have been highly critical of Sony and First 4 Internet. Specifically, the software has been found to conceal its activity in the manner of a rootkit (a common computer criminal's toolkit for hiding evidence); and moreover has been found to expose users to follow-on harm from viruses and trojans. A rootkit is a computer virus which consists of a program (or combination of several programs designed to take fundamental control (in Unix terms "root"
XCP's cloaking technique, which makes all processes with names starting with $sys$ invisible, can be used by other malware "piggybacking" on it to ensure that it, too, is hidden from the user's view. The first malicious trojan to use this technique was discovered on 10 November 2005 according to a report by the BitDefender antivirus company. Events 1444 - Battle of Varna: The crusading forces of King Vladislaus III of Varna (aka Ulaszlo I of Hungary and Wladyslaw Year 2005 ( MMV) was a Common year starting on Saturday (link displays full calendar of the Gregorian calendar. BitDefender is an Antivirus software suite developed by Bucharest -based software company SOFTWIN.
Follow-up research by Edward Felten and J. Edward William Felten (born March 25, 1963) is a professor of Computer science and public affairs at Princeton University. Alex Halderman has shown that the Web-based uninstaller Sony later offered for the software contains its own critical security problems. A uninstaller or deinstaller is a Computer program which is designed to remove all or parts of a specific other program or application. [2] The software installs an ActiveX component which allows any Web site to run software on the user's computer without restriction. ActiveX is a Component object model (COM developed by Microsoft for Windows. This component is used by First 4 Internet's Web site to download and run the uninstaller, but it remains active afterward -- allowing any Web site the user visits to take over the computer.
Since it is specific to Microsoft Windows, XCP has no effect on all other operating systems such as Linux, BSD, Solaris, or Mac OS X, meaning that users of those systems do not suffer the potential harm of this software, and they also are not impeded from "ripping" (or copying) the normal music tracks on the CD. Linux (commonly pronounced ˈlɪnəks Solaris is a Unix -based Operating system introduced by Sun Microsystems in 1992 as the successor to SunOS. Mac OS X (mæk oʊ ɛs tɛn is a line of computer Operating systems developed marketed and sold by Apple Inc, the latest of which is pre-loaded on all currently Ripping is the process of copying audio or video content to a Hard disk, typically from Removable media or media streams. (Some discs involved in the Sony scandal contained a competing technology, MediaMax from SunnComm, which attempts to install a kernel extension on Mac OS X. MediaMax CD-3 is a software package created by SunnComm and sold as a form of Copy protection for Compact discs It is used by the Record SunnComm International Inc was the company that developed and owned the MediaMax technology software package which was sold as a form of Copy protection for In Computer science, the kernel is the central component of most computer Operating systems (OS However, due to the permissions of Mac OS X, there were no widespread infections among Mac users. Most modern File systems have methods of administering permissions or access rights to specific users and groups of users )
Shortly after independent researchers broke the story, security software vendors followed up, releasing detailed descriptions of the components of XCP — as well as software to remove the $sys$* cloaking component of it. On the other hand, no software has yet been released to remove the CD-ROM filter driver component. Computer Associates, makers of the PestPatrol anti-spyware software, characterize the XCP software as both a trojan horse and a root kit[3]:
XCP. CA Inc &mdash formerly Computer Associates Inc &mdash is a multinational Computer software corporation headquartered in Islandia New York. CA Anti-Spyware is a Spyware detection program distributed by CA Inc This article refers to a form of Malware in computing terminology A rootkit is a computer virus which consists of a program (or combination of several programs designed to take fundamental control (in Unix terms "root" Sony. Rootkit installs a DRM executable as a Windows service, but misleadingly names this service "Plug and Play Device Manager", employing a technique commonly used by malware authors to fool everyday users into believing this is a part of Windows. Approximately every 1. 5 seconds this service queries the primary executables associated with all processes running on the machine, resulting in nearly continuous read attempts on the hard drive. This has been shown to shorten the drive's lifespan.
Furthermore, XCP. Sony. Rootkit installs a device driver, specifically a CD-ROM filter driver, which intercepts calls to the CD-ROM drive. If any process other than the included Music Player (player. exe) attempts to read the audio section of the CD, the filter driver inserts seemingly random noise into the returned data making the music unlistenable.
XCP. Sony. Rootkit loads a system filter driver which intercepts all calls for process, directory or registry listings, even those unrelated to the Sony BMG application. This rootkit driver modifies what information is visible to the operating system in order to cloak the Sony BMG software. This is commonly referred to as rootkit technology. Furthermore, the rootkit does not only affect XCP. Sony. Rootkit's files. This rootkit hides every file, process, or registry key beginning with
$sys$. This represents a vulnerability, which has already been exploited to hide World of Warcraft RING0 hacks as of the time of this writing, and could potentially hide an attacker's files and processes once access to an infected system had been gained. World of Warcraft (commonly acronymed as WoW) is a Massively multiplayer online role-playing game (MMORPG
Computer Associates announced, on November 2005, that its anti-spyware product, PestPatrol, would be able to remove Sony's software. CA Inc &mdash formerly Computer Associates Inc &mdash is a multinational Computer software corporation headquartered in Islandia New York. CA Anti-Spyware is a Spyware detection program distributed by CA Inc [4] [5] One month later Microsoft released an update for its Windows Malicious Software Removal Tool which could clean the F4IRootkit malware. Microsoft Corporation is an American multinational Computer technology Corporation, which rose to dominate the Home computer The Windows Malicious Software Removal Tool is freely-distributed software developed by Microsoft for its Windows operating system [6]
The somewhat slow and incomplete response of some antivirus companies has, however, been questioned by Bruce Schneier "information security expert" at Counterpane and author of security bible Secrets and Lies. Bruce Schneier (born 15 January 1963) is an American Cryptographer, Computer security specialist and Writer. Bruce Schneier (born 15 January 1963) is an American Cryptographer, Computer security specialist and Writer. In an article for Wired News, Mr. Wired News is an online technology news Website, formerly known as HotWired, that split off from Wired magazine when the Schneier asks, "What happens when the creators of malware collude with the very companies we hire to protect us from that malware?" His answer is that "users lose. . . A dangerous and damaging rootkit gets introduced into the wild, and half a million computers get infected before anyone does anything. "[7]
Beginning as early as August 2005, Windows users reported crashes related to a program called aries. sys, while inexplicably being unable to find the file on their computers. [8] This file is now known to be part of XCP. Call for Help host Leo Laporte said that he had experienced a rise in reports of "missing" CD-ROM drives, a symptom of unsuccessful attempts to remove XCP. Leo Gordon Laporte (born November 29, 1956 in New York City, New York) is an American Technology broadcaster and [9]
Security researcher Dan Kaminsky used DNS cache analysis to determine that 568,000 networks worldwide may contain at least one XCP-infected computer. Dan Kaminsky is a security researcher and Director of Penetration Testing for IOActive who used to work for Cisco and Avaya. The Domain Name System (DNS is a hierarchical naming system for computers services or any resource participating in the Internet. Kaminsky's technique uses the fact that DNS nameservers cache recently-fetched results, and that XCP phones home to a specific hostname. Phoning home is unsually surreptitious communication between applications or hardware installed at end-user sites and their manufacturers or developers A hostname (occasionally also a sitename) is the unique name by which a network-attached device (which could consist of a computer file server network storage device fax By finding DNS servers that carry that hostname in cache, Kaminsky was able to approximate the number of networks affected. [10] After the release of the data, Kaminsky learned that an as-yet undetermined number of "Enhanced CDs" without the rootkit also phone home to the same address that rootkit-affected discs use, so infection rates are still under active investigation.
According to analyst firm Gartner, XCP suffers from the same flaw in implementing DRM as any DRM technology current or future that tries to apply DRM to audio CDs designed to be played on stand-alone CD players. Gartner, Inc ( is an information technology research and advisory firm headquartered in Stamford, Connecticut. According to Gartner, because the installation of XCP or any DRM software relies on the CD being multi-session, the application of a piece of opaque tape to the outer edge of the disk renders the data track of the CD unreadable, causing the PC to treat the disc as an ordinary single-session music CD.
Slysoft's AnyDVD program, which removes copy protections from both standard and hi-definition video discs, also defeats DRM on audio CDs. SlySoft Inc is a Software company located in the capital city St AnyDVD is a Microsoft Windows driver allowing decryption of DVDs On-the-fly, as well as targeted removal of copy preventions and UOPs When active and an audio CD is inserted, AnyDVD blocks the PC from accessing any session but the audio; rendering data sessions unreadable and preventing the installation of malware such as XCP. AnyDVD is a Microsoft Windows driver allowing decryption of DVDs On-the-fly, as well as targeted removal of copy preventions and UOPs [1]
There is much speculation to what extent the actions taken by this software are a violation of various laws against unauthorized tampering with computers, or laws regarding invasion of privacy by "spyware", and how they subject Sony and First 4 Internet to legal liability. Such content will be deleted Specific software is to be mentioned in this article only The States of California, New York, and Texas, as well as Italy, have already taken legal action against both companies and more class action lawsuits are likely. However, the mere act of attempting to view or remove this software in order to determine or prevent its alteration of Windows would theoretically constitute a civil or criminal offense under certain anti-circumvention legislation such as the controversial Digital Millennium Copyright Act in the USA. The Digital Millennium Copyright Act (DMCA is a United States Copyright Law which implements two 1996 treaties of the World Intellectual Property The United States of America —commonly referred to as the
The Electronic Frontier Foundation's Fred von Lohmann also heavily criticised [11] the XCP EULA, shown for acceptance before the software installation, naming it the legalese rootkit. The Electronic Frontier Foundation ( EFF) is an international non-profit advocacy and legal organization based in the United States with the stated purpose of being dedicated
One of the primary reasons for the XCP experiment lies in the issue of adding on DRM to a legacy standard. These problems are explored by Professor Randal Picker, Professor of Law for the University of Chicago School of Law, in his article, "Mistrust-Based Digital Rights Management", published in Volume 5 of the Journal of Telecommunications and High Technology Law. The University of Chicago is a Private university located principally in the Hyde Park neighborhood of Chicago. CDs by themselves are incapable of updating legacy hardware such as stand-alone CD players, and lack the ability to change or upgrade the firmware in order to read DRM. Thus the DRM must be added on so as not to interfere with the function of the legacy players but still work when the same CD is placed in a computer. Professor Picker analyzes the four main issues with add-on DRM.
The first problem, as demonstrated in the XCP example, is that capable consumers can simply by-pass the DRM. Turning off autorun prevented the rootkit installation and thus invalidated the DRM scheme.
The second problem is consumer reaction. Adding DRM to a legacy product like music CDs, which traditionally had no rights management scheme, will infuriate consumers. Professor Picker points out that in the wake of the negative publicity surrounding the Sony add-on DRM, Amazon.com began alerting customers as to which Sony CDs contained XCP. Amazoncom Inc ( is an American electronic commerce ( E-commerce) company in Seattle Washington. Customers could avoid the DRM entirely, negating the effectiveness.
The third problem lies in the legal response. The EFF, as well as state attorneys general, investigated and brought suit against Sony for the XCP program. Professor Picker does not analyze the legal merits of such suits, but the cost of litigation potentially outweighs the benefit of attempting to add-on DRM.
The fourth and final problem lies in the End User License Agreement attempted to be enforced by the add-on DRM. The ability to actually enforce these agreements on add-on DRM is limited by the mere fact that without active registration and tracking of the CDs, the company will have no one to enforce against. Thus, the benefit, enforcing the EULA against violators, is non-existent; the costs, however, of implementing the add-on DRM scheme, in the form of state and federal investigations, private lawsuits, negative publicity, consumer backlash and the technical limitations, far outweighs the benefits.
Researcher Sebastian Porst[2], Matti Nikki[3] and a number of software experts have published evidence that the XCP software infringes on the copyright of the LAME mp3 encoder, mpglib[4], FAAC[5] id3lib[6] (ID3 tag reading and writing), mpg123 and the VLC media player[7]. LAME is an Open source application used to encode audio into the MP3 file format MPEG-1 Audio Layer 3, more commonly referred to as MP3, is a Digital audio encoding format using a form of Lossy data compression mpg123 is a fast free, minimalist, console MPEG audio player software program for UNIX and Linux Operating systems Advanced Audio Coding ( AAC) is a standardized lossy compression and encoding scheme for Digital audio. ID3 is a Metadata container most often used in conjunction with the MP3 Audio file format. mpg123 is a fast free, minimalist, console MPEG audio player software program for UNIX and Linux Operating systems
Princeton researcher Alex Halderman discovered[12] that on nearly every XCP CD, code which uses a modified version from Jon Johansen's DRMS software which allows to open Apple Computer's FairPlay DRM is included. Jon Lech Johansen (born November 18, 1983 in Harstad, Norway) also known as DVD Jon, is a Norwegian (his father is A job scheduler is an enterprise software application that is in charge of unattended background executions commonly known for historical reasons as Batch processing. Apple Inc, ( formerly Apple Computer Inc, is an American Multinational corporation with a focus on designing and manufacturing Consumer electronics FairPlay is a Digital rights management (DRM technology created by Apple Inc He found the code to be inactive, but fully functional as he could use it to insert songs into Fairplay. DRMS, mpg123 and VLC are licensed under the GNU General Public License (GPL). The other software found, like LAME is licensed under the terms of the GNU Lesser General Public License (LGPL), also as free software. The GNU Lesser General Public License (formerly the GNU Library General Public License) or LGPL is a Free software license published by the Free Software Free software or software libre is Software that can be used studied and modified without restriction and which can be copied and redistributed in modified or unmodified If the claims are correct, then Sony/BMG was distributing copyrighted material illegally. Sony BMG Music Entertainment is a diverse music and entertainment group
Jon Johansen wrote in his blog[13] that after talking with a lawyer, he thinks that he cannot sue; however, there are opinions that the advice he was given is wrong[14]. The LAME developers have put an open letter[15] to Sony/BMG online.
Copyright violations which Sony could be accused[16] of include:
Sony already provides[17] a version of id3lib's source code on its web site, but unrelated to XCP.
On a National Public Radio program, Thomas Hesse, President of Sony BMG's global digital business division asked "Most people, I think, don't even know what a rootkit is, so why should they care about it?"[18] He explained that "The software is designed to protect our CDs from unauthorized copying and ripping and Rootkit technology is one of the best ways to do just that. Thomas Hesse is President of Sony BMG Music Entertainment 's Global Digital Business and US Sales Ripping is the process of copying audio or video content to a Hard disk, typically from Removable media or media streams. "
Sony also contends that the "component is not malicious and does not compromise security," but "to alleviate any concerns that users may have about the program posing potential security vulnerabilities, this update has been released to enable users to remove [the root kit] component from their computers. "
A patch [19] to remove the cloaking of the software has been released; this patch does not completely remove XCP, but disables its technique of hiding itself from view.
An uninstaller for XCP-Aurora is now available from the Sony-BMG web site [20]. An analysis of this uninstaller has been published by Mark Russinovich — who initially uncovered XCP — entitled "More on Sony: Dangerous Decloaking Patch, EULAs and Phoning Home" [21]. Obtaining the uninstaller requires one to use a specific browser (Microsoft Internet Explorer) and to fill out an online form with their email address, receive an email, install the patch, fill out a second online form, and then they will receive a link to the uninstaller. Windows Internet Explorer (formerly Microsoft Internet Explorer abbreviated MSIE) commonly abbreviated to IE, is a series of graphical The link is personalized, and will not work for multiple uninstalls. Furthermore, Sony's Privacy Policy[22] states that this address can be used for promotions, or given to affiliates or "reputable third-parties who may contact you directly".
It has also been reported that the uninstaller might have security problems which would allow remote code execution[23]. Sony's uninstall page will attempt to install an ActiveX control when it is displayed in Internet Explorer. This ActiveX control is marked "Safe for scripting," which means that any web page can utilize the control and its methods. Some of the methods provided by this control are dangerous, as they may allow an attacker to download and execute arbitrary code.
On 11 November 2005, Sony announced they would suspend manufacturing CDs using the XCP system:
"As a precautionary measure, Sony BMG is temporarily suspending the manufacture of CDs containing XCP technology," it said in a statement. Events 308 - The Congress of Carnuntum: Attempting to keep peace within the Roman Empire, the leaders of the Tetrarchy declare Year 2005 ( MMV) was a Common year starting on Saturday (link displays full calendar of the Gregorian calendar.
"We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use," Sony BMG added.
This followed comments by Stewart Baker, the Department of Homeland Security's assistant secretary for policy, in which he took DRM manufacturers to task, as reported in the Washington Post:
In a remark clearly aimed directly at Sony and other labels, Stewart continued: "It's very important to remember that it's your intellectual property — it's not your computer. Stewart Abercrombie Baker (born July 17, 1947) is the Assistant Secretary (acting as Under Secretary-equivalent for Policy for the United States Department And in the pursuit of protection of intellectual property, it's important not to defeat or undermine the security measures that people need to adopt in these days. "
According to the New York Times[24], Sony BMG said "about 4. 7 million CDs containing the software had been shipped, and about 2. 1 million had been sold. " 52 albums were distributed by Sony-BMG that contained XCP. [25]
On 14 November 2005, Sony announced it was recalling the affected CDs and plans to offer exchanges to consumers who purchased the discs. Events 1533 - Conquistadors from Spain under the leadership of Francisco Pizarro arrive in Cajamarca, Inca Year 2005 ( MMV) was a Common year starting on Saturday (link displays full calendar of the Gregorian calendar. [26]
Exchange your XCP CDs free of charge
SonyBMG is providing a free UPS service[27] for consumers who have XCP titles to return the CDs to SonyBMG in exchange for a new CD that is DRM-free and does not contain XCP.
The Electronic Freedom Foundation published its original list of 19 titles on 9 November 2005[28]. Main article Extended Copy Protection The following Compact discs sold by Sony BMG were shipped with the Computer software The Electronic Frontier Foundation ( EFF) is an international non-profit advocacy and legal organization based in the United States with the stated purpose of being dedicated Events 694 - Egica, a king of the Visigoths of Hispania, accuses Jews of aiding Muslims sentencing all Year 2005 ( MMV) was a Common year starting on Saturday (link displays full calendar of the Gregorian calendar. On 15 November 2005 The Register published an article saying there may be as many as 47 titles. Events 655 - Battle of Winwaed: Penda of Mercia is defeated by Oswiu of Northumbria. Year 2005 ( MMV) was a Common year starting on Saturday (link displays full calendar of the Gregorian calendar. The Register (" El Reg " to its staff and readers is a British technology news and opinion website Sony BMG says there are 52 XCP CDs. [29]
Amazon says it's treating the XCP CDs as defective merchandise and will offer a refund with shipping, as long as the customer specifies the request. [30]