Twenty-one years ago this Halloween, some computer users found they had acquired some tricks along with their treat of a new Céline Dion CD.
On Oct. 31, 2005, blogger Mark Russinovich published a post about discovering a rootkit — software that hides on a computer but allows unauthorized administrative access — on his computer. The story matched incidents reported by other bloggers and media outlets. Computer repair shops were discovering strangely named files in their customers’ Windows registries.
Despite no apparent malicious payload, the files resembled rootkits and were removed alongside spyware and viruses. But then the CD drive on the computer would stop working.
The rootkit trail leads back to Sony BMG
Russinovich and other bloggers retraced their computing steps and ultimately pinpointed the only possible source of the rootkit: new Sony BMG CDs. The CDs used digital rights management (DRM) software that required a Sony BMG media player to play the music. Windows Media Player and iTunes weren’t an option. The copy-protection features also secretly sent data back to Sony BMG about the user.
Public backlash turns into legal action
Public outcry was swift. Sony BMG’s initial reaction was not savvy, with an executive telling the press: “Most people don’t even know what a rootkit is, so why should they care about it?” Sony BMG recalled the CDs after its initial removal tool only exposed the rootkit instead of removing it.
The states of California and Texas sued Sony BMG, and in December 2006 a $1.5 million settlement was announced, with $750,000 going to each state in civil penalties and legal fees. Affected Texans and Californians had 180 days in which to file claims to receive up to $175 in damages — and Sony BMG agreed to stop distributing CDs with secretive copy protection software.
Did you enjoy this installation of SmarterMSP’s Tech Time Warp? Check out others here.
Photo: wk1003mike / Shutterstock
