OTHER Sony DRM software has security flaws too.



You almost want to bury your head in the sand at this point if you’re Sony…. Freedom-to-tinker has some details. The last couple weeks the XCP copy protection that Sony uses has been the center of a Firestorm for rootkit capabilities and massive security problems. Well, it seems the OTHER Digital Rights Management (DRM) software they use ( SunnComm MediaMax ) has some serious flaws too.


The SecurityFix is on this too..

The big security flaw is in the ActiveX uninstaller component, much like the security flaws in the XCP uninstaller….

From Felten’s post: “When you visit the SunnComm uninstaller web page, you are prompted to accept a small software component — an ActiveX control called AxWebRemoveCtrl created by SunnComm. This control has a design flaw that allows any Web site to cause it to download and execute code from an arbitrary URL.

“If you’ve used the SunnComm uninstaller, the vulnerable AxWebRemoveCtrl component is still on your computer, and if you later visit an evil Web site, the site can use the flawed control to silently download, install and run any software code it likes on your computer. The evil site could use this ability to cause severe damage, such as adding your PC to a botnet or erasing your hard disk.”

Also, there is a tool to block this component at the Freedom-to-tinker link above and it comes with this warning.

“Unfortunately, if you use our tool to block the control, you won’t be able to use SunnComm’s current uninstaller to remove their software. It’s up to them to replace the flawed uninstaller with a safe one as soon as possible, and to contact those who have already used the vulnerable uninstaller with instructions for closing the hole.”

The flaw in this uninstaller is easier to exploit than that of the previous according to freedom-to-tinker.com and they EMPHASIZE that the problem (security flaw) is with the UNINSTALLER for the SunnComm MediaMax software. To get the uninstaller link required a couple of emails to support “pestering” for a way to get rid of the software. So if you have the MediaMax software installed and have never uninstalled it previously you should be safe (as far as is known. In other words, there are no other KNOWN problems with the MediaMax DRM.)

So, the world now waits for Sony and SunnComm’s reactions to this and hopefully a fix that can clear up the MASSIVE security holes they’ve left on machines around the world. Once again… thanks Sony.

Brian Krebs at the SecurityFix is also soliciting for a list of CDs protected by THIS DRM management software (the SunnComm MediaMax tool.) And says that he was skeptical at the beginning that this would be a deathknell for DRM software, but he’s starting to wonder.

Personally, in a time when computer security is such an issue, having unknown software from multiple sources can really raise a machines risk. It really makes me wonder what liabity these companies could find themselves in for poorly designed software. (And how enforcable a EULA is if there isn’t a reasonably easy way to decline.)

Beyond that it’s a reminder that should be WELL known by now. ActiveX controls can be VERY unsafe.

–update 11/17 – 8PM EST –
The Electronic Freedom Foundation has lists of titles affected by either DRM software. Also, it seems that some titles may be on the list and NOT have copy protection, you essentially need to use the “spotting guide” at the EFF link above to determine if you have a DRM’ed disc or not.

Related Posts

Blog Traffic Exchange Related Posts
  • How to Remove Guard Pro | Guard Pro Removal Guide Guard Pro is a rogue antivirus application that is promoted through the use of malware and trojan horses. Once it is installed on a system it will run at startup and will scan the computer claiming to find files infected with viruses and finding security problems with your system. It......
  • Windows more secure than Linux? For the last week, I've seen various headlines referring to a report from US-CERT that indicated 2005 had 5,198 security flaws reported. Out of those 2,328 were reported for Linux/Unix, 812 for Windows and 2,058 affecting more than one operating system. Now, I'm seeing all sorts of headlines about how......
  • So who is behind Windows Police Pro Virus / Rogue Security Software? As I've seen the continuing FLOOD of searches for some way to Remove Windows Police Pro, I've been starting to wonder at the who is behind this particular piece of junk software. These programs aren't written by your average ordinary virus writer, there is really too much spit and polish......
Blog Traffic Exchange Related Websites
  • World Wide Web Security Essentials Is Not A Real Spyware Remover. It Resembles The Functions And Looks World wide web Security Essentials is not a real spyware remover. It resembles the functions and looks of genuine spyware removal software but has no capacity to eliminate any virus, trojan or malware. Web Security Essentials is the newest addition to the growing list of rogue Antivirus programs. Internet Security......
  • Get Updated to Stay Ahead by Reading an SEO Software Review SEO software review looks at software and tools that website owners may use to boost their sites serps by growing link popularity and overall visibility all through the World wide web. It consists of submitting to web directories, setup link exchanges, building backlinks, tracking rankings and keyword research just to......
  • Must Have Blogging Tools Blogging has developed a serious place for itself in the internet community for many different purposes including personal use and business uses. As a result, it has evolved into becoming a truly essential tool for people who want to build communications, deliver up to date news and information and otherwise......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site