60 replies to this topic

[Ronny83]

Quote

Sony sued over copy-protected CDs 

A CD by Celine Dion is protected with the anti-piracy system

Sony BMG is facing three lawsuits over its controversial anti-piracy software.
Revealed in late October by Windows expert Mark Russinovich, the software copy protection system hides using virus-like techniques.

One class-action lawsuit has already been filed in California and another is expected in New York.

Digital rights group, the Electronic Frontier Foundation (EFF), is also gathering information from users to see if a case can be brought.

Court claim

The row erupted following Mark Russinovich's discovery that Sony BMG in America was using a so-called "root kit" to conceal the program used to stop some of its CDs being copied.

"Root kits" are being increasingly used by virus makers to hide their malicious wares deep inside the Windows operating system.

Sony BMG used a program called XCP created by UK firm First 4 Internet that employed similar cloaking systems to hide the proprietary media player used to play tracks on 20 CDs made by the music giant and sold in the US.

But since Dr Russinovich wrote about his discovery the row has snowballed and now has led to lawsuits being filed against Sony BMG.

XCP PROTECTED CDS
Trey Anastasio - Shine
Celine Dion - On ne Change Pas
Neil Diamond - 12 Songs
Our Lady Peace - Healthy in Paranoid Times
Chris Botti - To Love Again
Van Zant - Get Right with the Man
Switchfoot - Nothing is Sound
The Coral - The Invisible Invasion
Acceptance - Phantoms
Susie Suh - Susie Suh
Amerie - Touch
Life of Agony - Broken Valley
Horace Silver Quintet - Silver's Blue
Gerry Mulligan - Jeru
Dexter Gordon - Manhattan Symphonie
The Bad Plus - Suspicious Activity
The Dead 60s - The Dead 60s
Dion - The Essential Dion
Natasha Bedingfield - Unwritten
Ricky Martin - Life 

One filed in Los Angeles by Californian attorney Alan Himmelfarb wants to stop Sony BMG selling more CDs protected by anti-copying software and seeks damages for Californians that have bought any albums protected this way.

According to a report in the Washington Post the lawsuit alleges that Sony BMG has broken three Californian laws. At the same time New York lawyer Scott Kamber is planning a class-action lawsuit for all Americans affected.

The EFF is also gathering stories from buyers of Sony BMG CDs protected with XCP. In a statement the organisation said: "We're considering whether the effect on the public, or on EFF members, is sufficiently serious to merit a lawsuit".

At the same time the Italian digital rights group, Electronic Frontiers Italy, has asked the nation's government to investigate Sony over its use of anti-piracy software.

A weblog documenting the unfolding controversy and calling for a boycott of Sony products has also been created.

When contacted a representative for Sony BMG in the UK referred all calls to its corporate headquarters in New York. A call to a spokesman in that office has yet to be returned.

Artist list

The EFF also released a partial list of all the CDs protected with XCP. The list includes popular artists such as Natasha Bedingfield, Celine Dion and Amerie. It also gave advice for ways to spot if a CD is XCP protected.

So far Sony BMG has not released a list of how many CDs are protected or how many have been sold. It has only said that "about 20" titles are protected with the controversial program.

However, the row does not appear to be denting interest in one of the CDs protected by XCP because at the time of writing Neil Diamond's 12 Songs album was the top seller on the Amazon.com website.

Anti-virus companies are starting to release software that can spot the XCP files. Symantec said it had made tools that can find the files but will not remove them.

Computer Associates said that it would be releasing a tool to completely uninstall the XCP program.

At the same time anti-virus firm Kaspersky Labs branded the XCP program spyware because it hides itself, could compromise security and can slow machines down.

Dr Russinovich has continued his investigation of the XCP software and has confirmed that when installed it can make a Windows computer more unreliable.

He also criticised Sony BMG for making it difficult to get hold of software that can uninstall XCP.

[AllCeline]

I don't get it... was Sony not supposed to copy-protect the albums?

[Johana]

what??? it's sooo silly

[Bellamy]

it's true.
for more info read here: http://www.celinedio...?showtopic=8917

[tativale]

It's weird.....
Shame on them!

Well,
actually..lol i didn't get the point here... lol

[Mozinha]

So the protected CDs have virus?

[Bellamy]

the software behaves like Trojan virus. but SONY claim it's not virus. so let's see who will win. maybe SONY will lose a lot money this time.

[Krys]

screw Sony...they deserved it...who asked them to be such a pain in the butt? its just silly to put those programs on...

[Celine's Wife]

Stupid pieces of crap!    There are enough virus problems to be dealt with without this kind of junk!

[Bellamy]

Quote

Microsoft to remove Sony BMG malware

Microsoft said it would remove controversial copy-protection software that CDs from music publisher Sony BMG install on personal computers, deeming it a security risk to PCs running on Windows.

The XCP program, developed by First4Internet in Britain and used on music CDs by Sony BMG to restrict copying and sharing, has generated concern amongst computer users, because it acts like virus software and hides deep inside a computer where it leaves the backdoor open for other viruses.

"We have analyzed this software and have determined that in order to help protect our customers, we will add a detection and removal signature for the rootkit component of the XCP software to the Windows AntiSpyware beta, which is currently used by millions of users," Jason Garms, group program manager of the Anti-Malware Technology Team, said on Microsoft's Technet blog. (http://blogs.technet.../12/414299.aspx)

Microsoft will also use it in other anti-virus software.

"Detection and removal of this rootkit component will also appear in Windows Defender when its first public beta is available. We also plan to include this signature in the December monthly update to the Malicious Software Removal Tool," Garms added.

Other computer virus fighters such as Sophos in Britain have offered a removal kit since Thursday but have stressed it was a tricky operation resembling open heart surgery.

Sony BMG last week provided a patch to make the program more visible after the discovery that hackers had taken advantage of the weakness to install viruses on PCs.

OUTCRY

Responding to public outcry, the music publishing venture of Japanese electronics conglomerate Sony Corp. and Germany's Bertelsmann AG also said on Friday it would temporarily suspend the manufacture of music CDs containing XCP technology.

Asked to comment, the music publisher referred to its Friday statement.

Last week, Sony BMG was targeted in a class action lawsuit complaining it had not disclosed the true nature of its copy-protection software. Sony BMG's patch does not remove the program, which installs itself on a Windows-operated personal computer when consumers want to play certain Sony BMG music CDs. According to programmers it still leaves a security hole.

That was after the U.S. government had weighed in.

A representative of the United States government last week warned entertainment publishers against using CD and DVD copy protection software that hides inside computers.

"It's very important to remember that it's your intellectual property; it's not your computer. And in the pursuit of protection of intellectual property, it's important not to defeat or undermine the security measures that people need to adopt in these days," said Stewart Baker, the assistant secretary the Department of Homeland Security, at a conference.

The Sony copy-protection software does not install itself on Macintosh computers or ordinary CD and DVD players.

Source: http://today.reuters...G-MICROSOFT.xml

I like the idea of microsoft plan to delete SONY.      

[nlgarrett78]

hey all
be careful when you use your celine dion albums there was a article on the news saying it helps hackers to hack in and steal your Identy. They said celine dion was apart of it and that sony is fixing it. if you need more in fo go to www.nbc5i.com or go to sony website.
nancy

[Bellamy]

Quote

sony bmg recall cd

Music company Sony BMG, yielding to consumer concern, said on Wednesday it was recalling music CDs containing copy-protection software that acts like virus software and hides deep inside a computer.

Sony BMG has used the XCP copy-protection software on 49 titles from artists such as Celine Dion and Sarah McLachlan and produced an estimated 4.7 million music CDs. Around 2.1 million units have been sold on to consumers.

The software, developed by British software makers First4Internet, installs itself on a personal computer used to play the CD in order to guard against copying, but it leaves the back door open for malicious hackers.

"We share the concerns of consumers regarding discs with XCP content-protected software, and, for this reason, we are instituting a consumer exchange program and removing all unsold CDs with this software from retail outlets," Sony BMG said in an statement.

Sony BMG announced in a separate statement it would distribute a program to remove the software from a PC where it jeopardizes security.

"We deeply regret any inconvenience this may cause our customers. Details of this (recall) program will be announced shortly," Sony BMG said.

Sony reiterated that the copy-protection software installs itself only on personal computers and not on ordinary CD and DVD players. Market research group NPD Group found in a recent survey that around 36 percent of consumers listen to their CDs on a personal computer.

OUTCRY

Problems with the copy-protection software became acute last week, when the first computer viruses emerged that took advantage of security holes left by the program.

Responding to public outcry over the software, Sony BMG, the music venture of Japanese electronics conglomerate Sony Corp. and Germany's Bertelsmann AG had said on Friday it would temporarily suspend the manufacture of music CDs containing XCP technology.

It then provided a patch to make the hidden program more visible. At the time it did not recall the CDs or offer a program to remove it from computers. Sony BMG's patch and the removal software still left PCs vulnerable, according to software engineers.

The anti-virus team at Microsoft Corp. said on Tuesday it would independently add a detection and removal mechanism to rid a personal computer of the Sony's DRM copy-protection software. It should have a deeper understanding of its own operating system, and how to remove software safely.

The software installs itself only on PCs running Microsoft's Windows operating system.

Sony BMG has positioned itself as a defender of artists' rights. It had re-emphasized on Friday that copy-protection software is "an important tool to protect our intellectual property rights and those of our artists."

Sony BMG last week was targeted in a class action lawsuit complaining that it had not disclosed the true nature of its copy-protection software.

Source: http://news.yahoo.co...bmg_recall_dc_5

so if you had bought ONCP North America version. ask SONY to give you a virus free version.

[celinefanonline]

you know i have got this version...............

[Bellamy]

Symantec(Norton Antivirus) had a removal tools already. check here: http://securityrespo...valinstructions

Mircosoft will remove it in it's next security tool update.

and SONYBMG is forced to release an uninstall tool too.

so if you really can't exchange your copy. you can try uninstall it by removal tools, or don't use it on PC at all.

Quote

Sony BMG to revise XCP uninstaller procedure, claims DNS propagation estimates "flawed"

New York (NY) - Responding to a deluge of reports in TG Daily and elsewhere, regarding estimates of the damage caused by its XCP copy protection software, a spokesperson for music publisher Sony BMG told us today that the company will be revising the procedure it currently offers customers for disconnecting its stealth techniques, and for uninstalling the software. In the meantime, the existing uninstallation tool has been taken offline.

In a report published yesterday in BusinessWeek online, Princeton University computer science professor Ed Felten remarked that his investigation of Sony BMG's uninstallation procedure could actually leave customers more vulnerable than they were. The procedure collected personal information from the customer via a Web page, but through an insecure channel. By not using Secure Sockets Layer or a more recent transport layer security measure, communication of personal information could conceivably be intercepted. Furthermore, Felten's investigation revealed, by not certifying the download of the tool using a digital certificate, an undesired third party, having intercepted the Web page form contents, could transfer a malicious package to the customer instead.


John McKay, Sony BMG's spokesperson, told TG Daily that stress tests are being performed now for the replacement procedure, which the company hopes to make available in the immediate future. An open letter to customers issued this morning on Sony BMG's Web site states, "We will shortly provide a simplified and secure procedure to uninstall the XCP software if it resides on your computer.

"Ultimately, the experience of consumers is our primary concern," the letter goes on to state, "and our goal is to help bring our artists' music to as broad an audience as possible. Going forward, we will continue to identify new ways to meet demands for flexibility in how you and other consumers listen to music."

Last weekend, Felten's colleague, J. Alex Halderman, published to his personal blog, Freedom to Tinker, a renewed examination of a completely different copy protection scheme used in other Sony BMG audio CDs. There, Halderman stated that MediaMax protection software used by the company since 2003 has installed drivers on users' systems without their consent, transferred personal information to MediaMax's servers, and has not included a complete uninstallation procedure. Those CDs that do include an uninstaller, he notes, fail to remove the key drivers. However, he pointed out, MediaMax does not resort to using stealth to hide its drivers and deflect attempts at identification or uninstallation, as does First 4 Internet's XCP.

Sony BMG's McKay had no immediate comment on Halderman's claims, and indicated that this may be the first significant complaint the company has seen regarding MediaMax.

Yesterday, TG Daily reported on a different set of claims by security expert Dan Kaminsky that over half a million DNS servers on the Internet may have cached the XCP software's IP address within a given eight-hour period of time. Kaminsky believes this may be an indication that millions of Windows computers could contain the XCP stealth software. Today, Sophos Labs senior technology consultant Graham Cluley told us Kaminsky's claims may be difficult to verify. "I'm afraid we can't confirm Dan Kaminsky's 'guesstimate' on how many computers may have run the offending code," said Cluley, adding, "It would seem to me to be a very difficult thing to quantify in a meaningful way."

Later today, Sony BMG's McKay stated that his company's technical team looked into Kaminsky's claims, and reported to him that they believe his numbers would be "significantly exaggerated," and that his methodology for determining the contents of over half a million DNS server caches across the world is, in their opinion, flawed.

Finally, The Washington Post's security columnist, Brian Krebs, this morning quoted the assistant secretary for policy at the US Department of Homeland Security, Stewart Baker, as having admonished Sony BMG (though not by name) during a speech at a function produced by the US Commerce Dept. "In the pursuit of protection of intellectual property," stated Baker, "it's important not to defeat or undermine the security measures that people need to adopt in these days."

Sony BMG's spokesperson had no immediate comment to Krebs' column.

Commenting this afternoon on Sony BMG's actions, Sophos' Graham Cluley told us, "I'm delighted to hear that Sony is now seeing sense and is actively working to withdraw versions of their CDs out in the shops which still contain this controversial code. Of course, that's not much help to those poor souls who have already bought the CDs and may have unknowingly opened up their home PCs and company computers to potential attack."

Source: http://www.tgdaily.c...ller/index.html

[Krys]

damn...lucky Sony BMG Malaysia imported the UK version...phew...

[DjCeline]

    the album didn't reach Romania yet

[winforlife]

That really stinks because I just received my copy of ONCP.  I can't get a refund since this was a present from a friend in Canada

To be safe for now I will only play it on my stereo,but I like listening to Céline on my pc while surfing the net or having fun here.

I have spoken to people who are boycotting any cds on the list-what a shame. Sony really did an injust to many artist including Céline.

Does anyone know if the patch truly works? I will try downloading the patch. If someone could post any comments if he/she have used the patch and if it fixed the problem, I would appreciate the input.

Thanks, Win

[Bellamy]

maybe you can try the Symantec(Norton Antivirus) removal tools I posted above. I trust Symantec much more than SONY. They're the biggest security(antivirus) company in the world.
As I posted above the latest patch from SONY just left a bigger security hole to hackers, and they're working on another one.

[Krys]

good luck to y'all who got the US version!

[Bellamy]

Quote

CD’s Containing XCP Content Protection Technology

Note:  We will shortly be releasing new versions of these titles without the XCP software.  You therefore need to check this list for both the name of the album and the item number (which can be found on the spine of the CD).  If the item number is not listed below, your CD does not contain XCP content protection.


ARTIST
ALBUM
ITEM NUMBER(S)
UPC(S)

1.
A Static Lullaby
Faso Latido
CK92772
827969277225

2.
Acceptance
Phantoms
CK89016
696998901629

3.
Amerie
Touch
CK90763
827969076323

4.
Art Blakey
Drum Suit
CK93637
827969363720

5.
The Bad Plus
Suspicious Activity?
CK94740
827969474020

6.
Bette Midler
Sings the Peggy Lee Songbook
CK95107              CK74815
827969510728     828767481524

7.
Billy Holiday
The Great American Songbook
CK94294
827969429426

8.
Bob Brookmeyer
Bob Brookmeyer & Friends
CK94292
827969429228

9.
Buddy Jewell
Times Like These
CK92873
827969287323

10.
Burt Bacharach
At This Time
CK97734
827969773420

11.
Celine Dion
On Ne Change Pas
E2K97736
827969773628

12.
Chayanne
Cautivo
LAK96819      LAK96818         LAK95886
037629681921   037629681822   037629588626

13.
Chris Botti
To Love Again
CK94823
827969482322

14.
The Coral
The Invisible Invasion
CK94747
827969474723

15.
Cyndi Lauper
The Body Acoustic
EK94569
827969456927

16.
The Dead 60's
The Dead 60's
EK94453
827969445327

17.
Deniece Williams
This Is Niecy
CK93814
827969381427

18.
Dextor Gordon
Manhattan Symphonie
CK93581
827969358122

19.
Dion
The Essential Dion
CK92670
827969267028

20.
Earl Scruggs
I Saw The Light With Some Help From My Friends
CK92793
827969279328

21.
Elkland
Golden
CK92036
827969203620

22.
Emma Roberts
Unfabulous And More: Emma Roberts
CK93950        CK97684
827969395028         827969768426

23.
Flatt & Scruggs
Foggy Mountain Jamboree
CK92801
827969280126

24.
Frank Sinatra
The Great American Songbook
CK94291
827969429129

25.
G3
Live In Tokyo
E2K97685
827969768525

26.
George Jones
My Very Special Guests
E2K92562
827969256220

27.
Gerry Mulligan
Jeru
CK65498
074646549827

28.
Horace Silver
Silver's Blue
CK93856
827969385623

29.
Jane Monheit
The Season
EK97721
827969772126

30.
Jon Randall
Walking Among The Living
EK92083
827969208328

31.
Life Of Agony
Broken Valley
EK93515
827969351529

32.
Louis Armstrong
The Great American Songbook
CK94295
827969429525

33.
Mary Mary
Mary Mary
CK94812            CK92948
000768353721             827969294826

34.
Montgomery Gentry
Something To Be Proud Of: The Best of 1999-2005
CK75324               CK94982
828767532424        827969498224

35.
Natasha Bedingfield
Unwritten
EK93988
827969398821

36.
Neil Diamond
12 Songs
CK94776            CK97811
827969477625        827969781128

37.
Nivea
Complicated
82876671562
828766715620

38.
Our Lady Peace
Healthy In Paranoid Times
CK94777
827969477724

39.
Patty Loveless
Dreamin' My Dreams
EK94481
827969448120

40.
Pete Seeger
The Essential Pete Seeger
CK92835
827969283523

41.
Ray Charles
Friendship
CK94564
827969456422

42.
Rosanne Cash
Interiors   
CK93655
827969365526

43.
Rosanne Cash
King's Record Shop
CK86994
696998699427

44.
Rosanne Cash
Seven Year Ache
CK86997
696998699724

45.
Shel Silverstein
The Best Of Shel Silverstein
CK94722
827969472224

46.
Shelly Fairchild
Ride
CK90355
827969035528

47.
Susie Suh
Susie Suh
EK92443
827969244326

48.
Switchfoot
Nothing Is Sound
CK96534          CK96437              CK94581
827969653425          827969643723           827969458129

49.
Teena Marie
Robbery
EK93817
827969381724

50.
Trey Anastasio
Shine
CK96428
827969642825

51.
Van Zant
Get Right With The Man
CK93500
827969350027

52.
Vivian Green
Vivian
CK90761
827969076125


Note:  Two titles, Ricky Martin’s "Life" and Peter Gallagher’s "7 Days in Memphis" were released with a content protection grid on the back of the CD packaging but XCP content protection software was not actually included on the albums.

Source: http://cp.sonybmg.co...ish/titles.html

[Krys]

wow...so many?i thought there were around 20? whoa...this time Sony really made a big bummer...

[winforlife]

Thanks Bellamy for the input.

The list you posted was large,so many artists affected by Sony's stupidity  

[Bellamy]

Link to exchange your copy-protected CDs:
http://www.upsrow.com/sonybmg/

Quote

In the page that follows, you will be asked to provide the shipping information in the United States to which you would like to have the replacement CD sent. In addition, you will have the option of selecting whether you would like to receive MP3 files of the title(s) in addition to your replacement CD(s).

      so ironic to the copy-protected CDs.      
stupid SONYBMG.  

Quote

Once you have provided your shipping information, the site will prepare a confirmation receipt and a pre-paid UPS shipping label that you should print. You will have the option to send your package with your XCP content protected CD(s) from one of more than 4,000 UPS Stores, or arrange for a UPS pick-up. Once SONY BMG receives your XCP content protected CD(s), we will process your exchange. Please allow 3-6 weeks for delivery of the replacement(s). Consumers who choose to receive MP3 files in addition to replacement CD(s) will receive an e-mail with a link to the MP3 downloads upon our receipt and verification of your XCP CD(s).

[AllCeline]

Ya know, it's a real shame. Besides Celine, there're a lot of CD's by some great artists. I wanted to get the Switchfoot CD too. I guess now I have an excuse to get the DualDisc version.

[Kay]

Is this only on the US version? Because I have played my version from Canada on my computer several times and there is no problem with it, also the number on the spine is different from the number Sony released...

By the way...if it's copy-protected it has this on the CD somewhere:

Edited by Kay, 24 November 2005 - 10:09 PM.

[winforlife]

Kay, on Nov 25 2005, 12:07 AM, said:

Is this only on the US version? Because I have played my version from Canada on my computer several times and there is no problem with it, also the number on the spine is different from the number Sony released...

By the way...if it's copy-protected it has this on the CD somewhere:

<{POST_SNAPBACK}>

Hmmm, going to check my copy since it's from Canada. Thanks, Kay

[Bellamy]

Kay, on Nov 25 2005, 12:07 PM, said:

Is this only on the US version? Because I have played my version from Canada on my computer several times and there is no problem with it, also the number on the spine is different from the number Sony released...

By the way...if it's copy-protected it has this on the CD somewhere:

<{POST_SNAPBACK}>

US verstion only. check catalogue number to make sure.
and the logo you posted is not the same technology as what we discuss here. the copy-protected logo CD exists for a very ong time, and has no rookit ware. the infected CDs use XCP technology should have XCP on back cover. not the logo you posted.

[Bellamy]

You can get XCP uninstaller from SONY here:
http://cp.sonybmg.co...sh/updates.html

[nlgarrett78]

It did have a virus and spyware cause it got into my computer I had to start over again and almost had to buy a new computer.but its fixed now lol
nancy

[Bellamy]

Quote

Sony's DRM fix hits hitch 4:33PM
The US computer scientists who discovered a significant security flaw in one of Sony BMG's CD copy protection systems have discovered that the flaw is still present in the patch released by the record company yesterday.  

Professor Ed Felten and Alex Halderman of Princeton University, New Jersey, report that the patch for the SunnComm MediaMax DRM software and previously released uninstaller do not prevent the booby-trapping of the files that MediaMax places on a PC in order to automatically run hostile software when you insert a 'protected' CD.

They recommend that you do not use the patch, do not use the uninstaller and do not insert a MediaMax-bearing CD into a PC.

Although they agree that Sony's efforts to fix the vulnerability and publicise theproblem are a positive step, they believe that the record company should now recall all the CDs - as it has with its CDs that use XCP copy protection - and press SunnComm to release a new installer that safely and permanently removes all MediaMax files.

'It is impossible to patch the millions of MediaMax-bearing CDs that are already out there,' Felden writes. 'Every disc sitting on somebody's shelf, or in a record-store bin, is just waiting to install the vulnerable software on the next PC it is inserted into. The only sure way to address this risk is take the discs out of circulation.'

The affected CDs - listed here - have only been released in the US and Canada, thought that won't stop them making their way across the Atlantic as unhappy customers attempt to offload them via eBay. SunnComm's FAQ notes that each CD is labelled on the reverse, though p2pnet reports that at least one does not have the SunnCom 'Compatible With' label.

Source: http://www.pcpro.co....hits-hitch.html