Ed Felten has been doing a great job of tracking the unfoling Sony BMG DRM/rootkit fiasco... and there's now some evidence that this rootkit can seriously comprmise system security. Prof. Felten pointed out that the company has claimed that their product is safe:
No doubt they’ll ask us to just trust them. I wouldn’t. The companies still assert — falsely — that the original rootkit-like software “does not compromise security” and “[t]here should be no concern” about it.
However, it turns out that this rootkit can be used to completely cloak the presence of programs. For example, World of Warcraft hackers are already using it to make cheating programs completely undetectable.
(And I thought "fight fire with fire" was just the name of a song from when Metallica was cool.)
And, so it seems, you too can cloak the presence of files and data by adding $sys$ to the front of any file's name. In the World of Warcraft example, at least it's being used positively to escape the prying eyes of Blizzard Entertainment. However, I wonder how long it will take for a malicious virus or worm to take advantage of this. Predictions, anyone?
Prof. Felten's posts:
Comment feed for this post
