On
October 31,
2005,
Mark Russinovich posted to his
blog a detailed description and technical analysis of the characteristics of the software contained on Sony BMG music CDs. Called
Sony, Rootkits and Digital Rights Management Gone Too Far, the article asserts vocally that the software is illegitimate and that
digital rights management had "gone too far."
Russinovich stated that there were shortcomings in the software design that manifest themselves as security holes that can be exploited by malicious software such as
worms or
viruses. He also mentioned that the XCP software installed silently before the
EULA appeared, that the EULA does not mention the XCP software, and that there was no uninstaller, all of which are illegal in various ways in various jurisdictions.
The article also asserts that the software runs in the background and consumes system resources, slowing down the user's computer, regardless of whether there is a protected CD playing or not.
Russinovich presented evidence that the software employs unsafe procedures to start/stop the
rootkit, which could lead to system crashes (the famous
BSoD) and that inexpert attempts to deinstall the software can lead to the
Windows operating system failing to recognize existing drive(s). The Sony rootkit is designed to hide any files, registry keys and processes starting with the string $sys$, making it very easy for writers of worms and other malware to also hide their files by simply using the same name. Within weeks there were several trojans and worms taking advantage of this functionality in machines already compromised by the Sony rootkit.