SONY DRM rootkit – the gift that keeps on giving



Well… I said, more legs than a centipede for this one…. It looks as though the uninstaller from Sony is an activex control that may have some SEVERE security implications. The ActiveX invokes a command to reboot the computer (RebootMachine). (Which is likely remotely exploitable). Also it appears to use an (InstallUpdate) download which could be exploitable AND if that’s not enough, a n ExecuteCode function which could crash the browser. It should be noted that the ActiveX uninstaller REMAINS ON THE SYSTEM after the SONY DRM ROOTKIT is removed, meaning that these functions would be available for remote exploit even after the XCP software is uninstalled.


Sunbelt blog had the link. Right now the author of the 1st link is looking for a link to the uninstaller so that the above can be verified. I suspect there’s still a bit more to come here as well…

Update 11-15

The securityfix has the story that today several groups of security and privacy experts are expected to announce findings of several serious security vulnerabilities in the XCP software, a search that has been going on in earnest since the rootkit was discovered.

From the article…

But wait, it gets … er … better. The researchers discovered a security flaw in XCP (which stands for “extended copyright protection”) that could afford attackers a window through which to break into computers running the software and install additional software or viruses.

There are some hints there about vulnerabilities with the uninstaller listed above, a link here gives the warning to not use Sony’s uninstaller.

Related Posts

Blog Traffic Exchange Related Posts
  • Some Sony news You had to know we couldn't make it to the end of the year without another story about the Sony DRM rootkit.... I noticed last night that the sunbelt blog had mention of a proposed settlement in their legal troubles in the wake of the XCP copy protection DRM rootkit......
  • How to Remove ActiveSecurity | Active Security Removal Guide ActiveSecurity is a rogue antivirus application that uses graphics to indicate a similarity with Microsoft Security Center. It installs via malware including trojans and brings several files along with it when it installs that it then claims are viral and that in order to clean up the mess the user......
  • Network Security - Arp spoofing So.... what is arp spoofing (poisoning).... and what are it's implications? ARP spoofing involves tricking a machine into thinking that you're machine is, yet another. Let's put this in IP address terms. Let's say that 192.168.0.1 is the default gatway on the network and 192.168.0.150 is our target. We are......
Blog Traffic Exchange Related Websites
  • Search History - Today And Tomorrow It could sound a bit scary but every single stroke of my keyboard is recorded by the laptop or computer memory. You had been looking for particular info on the web. In several days whenever you required to check out the similar pages again, to your utter dismay, you......
  • How to Use Coin Collecting Software Finding the value of your coins is something which most people who have a coin collection are very concerned with. This is true whether you are buying a set of coins or you have had your collection for a long period of time. There have been books over the years......
  • free SANS webcasts powered by vLive! The SANS Institute <Webcast@sans.org wrote: Please join us in the upcoming weeks for the following informative, free SANS webcasts powered by vLive!, the SANS Institute's online learning platform: WEBCAST 1 Internet Storm Center: Threat Update WHEN: Wednesday, May 11, 2011 at 1:00 PM ET (1700 UTC/GMT) FEATURING: Johannes Ullrich https://www.sans.org/webcasts/isc-threat-update-20110511-94088......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site