A rootkit, as mentioned above, modifies the core of the operating system in order to hide programs, files and similar. Usually used as part of bad software like viruses and their ilk in order to hide their activities from anti-virus programs. A few anti-virus products use rootkit-like techniques in order to protect themselves from viruses that attempt to disable the anti-virus protection on your PC. But apart from that, I am not aware of any legitimate software that use this kind of technology. Until this story about the Sony DRM (called XCP), that is.

Modifying the operating system kernel is kind of a black art, and if you do so you have to be very careful because any bug can lead to the operating system crashing with a blue screen. Unfortunately, the rootkit part of the Sony XCP DRM is of low quality and is known to cause occational computer crashes, especially on Windows XP Media Center. If you ever see a bluescreen caused by ‘aries.sys’, XCP is to blame.

Even worse, the rootkit is not written to only hide the components of XCP, it will hide any file or directory that starts with the letters ‘$SYS$’. So if you have XCP installed on your system, any malware can easily use it to hide from your anti-virus. Anti-virus companies have already discovered malware in the wild that makes use of this.

This would be bad by itself, but there is more..

The EULA that pops up when you put the CD in your computer describes the software as a small application required to play the music on the disc. No mention is made of how intrusive it is, and you are given the impression that it should be easy to uninstall.

The software does not include any way of uninstalling itself. At the time of this writing, you have to go to the Sony website and go through a contorted process including giving them your name and email address in order to download an uninstall tool. The uninstall tool will be locked to the computer you downloaded the tool from, so if you are the administrator for 50 PCs you have to go through the entire process for each one.

Sony has been downplaying this entire issue in the media, stating that this is no big deal, that there are no security or stability risks, etc. One of the worst examples is that Thomas Hessa, President of Sony BMG’s Global Digital Business, went on National Public Radio and stated: “Most people, I think, do not even know what a Rootkit is, so why should they care about it?”.

There is even more, but I digress. For people that know a bit about operating systems and computer security this is like stepping through the looking glass, utterly unbelievable.

The XCP rootkit was discovered independently by Mark Russinovich of Sysinternals.com and the security software company F-secure. I recommend reading Mark’s blog if you are interested in knowing more. The story started on October 31