SONY DRM rootkit – the gift that keeps on giving



Well… I said, more legs than a centipede for this one…. It looks as though the uninstaller from Sony is an activex control that may have some SEVERE security implications. The ActiveX invokes a command to reboot the computer (RebootMachine). (Which is likely remotely exploitable). Also it appears to use an (InstallUpdate) download which could be exploitable AND if that’s not enough, a n ExecuteCode function which could crash the browser. It should be noted that the ActiveX uninstaller REMAINS ON THE SYSTEM after the SONY DRM ROOTKIT is removed, meaning that these functions would be available for remote exploit even after the XCP software is uninstalled.


Sunbelt blog had the link. Right now the author of the 1st link is looking for a link to the uninstaller so that the above can be verified. I suspect there’s still a bit more to come here as well…

Update 11-15

The securityfix has the story that today several groups of security and privacy experts are expected to announce findings of several serious security vulnerabilities in the XCP software, a search that has been going on in earnest since the rootkit was discovered.

From the article…

But wait, it gets … er … better. The researchers discovered a security flaw in XCP (which stands for “extended copyright protection”) that could afford attackers a window through which to break into computers running the software and install additional software or viruses.

There are some hints there about vulnerabilities with the uninstaller listed above, a link here gives the warning to not use Sony’s uninstaller.

Related Posts

Blog Traffic Exchange Related Posts
  • How to Remove ActiveSecurity | Active Security Removal Guide ActiveSecurity is a rogue antivirus application that uses graphics to indicate a similarity with Microsoft Security Center. It installs via malware including trojans and brings several files along with it when it installs that it then claims are viral and that in order to clean up the mess the user......
  • Windows RDP Denial of service vulnerability I just saw this article at zdnet news a few minutes ago. Basically a new security bulletin is out with regards to Windows Remote Desktop Server being vulnerable to a denial of service (DoS) attack. Essentially it affects Windows 2000, XP and Server 2003. It appears that under an overwhelming......
  • Network Security - Arp spoofing So.... what is arp spoofing (poisoning).... and what are it's implications? ARP spoofing involves tricking a machine into thinking that you're machine is, yet another. Let's put this in IP address terms. Let's say that 192.168.0.1 is the default gatway on the network and 192.168.0.150 is our target. We are......
Blog Traffic Exchange Related Websites
  • Find Out How To Get Free Site Visitors To Your Website Or Weblog - 3 Easy Methods Getting traffic to your web site is one challenge we as site owners face when we create our websites. Getting visitors there without spending a dime is among the best ways to get them there. Relying in your aims, if you create your website, it would be best to maximize......
  • free SANS webcasts powered by vLive! The SANS Institute <Webcast@sans.org wrote: Please join us in the upcoming weeks for the following informative, free SANS webcasts powered by vLive!, the SANS Institute's online learning platform: WEBCAST 1 Internet Storm Center: Threat Update WHEN: Wednesday, May 11, 2011 at 1:00 PM ET (1700 UTC/GMT) FEATURING: Johannes Ullrich https://www.sans.org/webcasts/isc-threat-update-20110511-94088......
  • How to Use Coin Collecting Software Finding the value of your coins is something which most people who have a coin collection are very concerned with. This is true whether you are buying a set of coins or you have had your collection for a long period of time. There have been books over the years......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site