Post AzlR7UpbftO7m80p3w by isotopp@infosec.exchange
 (DIR) More posts by isotopp@infosec.exchange
 (DIR) Post #AzlR7UpbftO7m80p3w by isotopp@infosec.exchange
       2025-10-31T06:52:58Z
       
       0 likes, 0 repeats
       
       Today is 31 October 2025.Twenty years ago today, on 31 October 2005, https://en.wikipedia.org/wiki/Mark_Russinovich published a detailed description and technical analysis of First 4 Internet’s (F4I) XCP software, which he discovered had been secretly installed on his computer by a Sony BMG music CD.The software was part of the CD’s digital component and automatically installed itself on Windows computers when the disc was inserted into a CD-ROM drive. A similar component for MacOS was blocked from automatic installation with Operating System confirmation prompts. The driver interfered with any attempt to rip audio CDs on that system and actively concealed itself to prevent detection or removal.Russinovich compared XCP to a rootkit because of its covert installation and use of stealth techniques to hide its presence. He pointed out that the EULA made no mention of the software and argued that its behavior was illegitimate.The security firm F-Secure agreed, stating: "Although the software isn't directly malicious, the rootkit hiding techniques it uses are exactly the same as those used by malicious software." Following public backlash, Symantec and other antivirus vendors added detection and removal for the rootkit, and Microsoft announced that it would include protection against it in its security updates.XCP operated with high system privileges and contained numerous exploitable vulnerabilities, creating a serious security risk. That risk quickly became real: within weeks, several trojans and worms appeared that exploited flaws in the XCP software.As the result of government investigations and class-action lawsuits, Sony BMG partially addressed the scandal with consumer settlements and a recall that affected about 10% of the affected CDs. It ceased the copy-protection efforts in 2007.The Sony rootkit scandal only affected users that bought legitimate copies of music. Everybody who used Napster or Donkey to grab the MP3 was of course unaffected.Sony has never apologized to its customers.Timeline, in German:https://netzpolitik.org/2005/rookit-sonys-digitaler-hausfriedensbruch/Sony also produced, only one year later, thehttps://www.engadget.com/2006-01-05-sony-vaio-xl2-digital-living-system.htmlLike the XL1, the XL2 sports an HDMI video out, operation via wireless keyboard and remote, and an optional 200 CD/DVD changer for library management. Running Windows MCE 2005, the XL2 is harboring Intel Viiv insideSony also turned off the DRM-Servers for the Conect-Online Musicshop in March 2008, again fucking over all customers that paid for their content.https://www.golem.de/0804/59229.htmlIn an interview 2012, Sony Music boss Edgar Berger saidhttps://www.welt.de/wirtschaft/webwelt/article13881492/Musikindustrie-Das-Internet-muss-frei-sein-nicht-umsonst.htmlDas Internet ist für die Musikindustrie ein großer Glücksfall, oder besser gesagt: Das Internet ist für uns ein Segen. "The Internet for us is a boon."Whatever companies think, even today the only way to actually purchase content on the internet is to buy content without DRM, or buy content with removable DRM, downloiad and deDRM it immediately.Have a media library. Make sure your stuff can use this media library. Back up your media library.
       
 (DIR) Post #AzlR7VzDNefTMDW0g4 by raymaccarthy@mastodon.ie
       2025-10-31T09:01:01Z
       
       0 likes, 0 repeats
       
       @isotopp I'd been telling people since 1995 to disable Autorun.It only worked due to Autorun?
       
 (DIR) Post #AzlR7Wtvym2QC83J5M by wolf480pl@mstdn.io
       2025-10-31T09:36:09Z
       
       0 likes, 0 repeats
       
       @raymaccarthyAutorun was a feature from more optimistic times...@isotopp
       
 (DIR) Post #AzlTvx7Iz4Dtt9TgHo by raymaccarthy@mastodon.ie
       2025-10-31T10:07:44Z
       
       0 likes, 0 repeats
       
       @wolf480pl @isotopp There was already the Amiga malware infecting by autorun floppies.Viruses and Malware well known on DOS long before Windows.MS was malicious and stupid adding Autorun as a feature for CDs on Win95.Later had to be disabled on NT4.Later had to be disabled for USB sticks and network shares.See also stupidity of remote content in Outlook, OCX in Internet Explorer, DCOM and hiding file endings.A stupid feature Linux later copied, though much easier to disable on Linux.