MS update disables Sony Rootkit
December 13, 2005 by TomAs promised a few weeks ago, Microsoft included patches in its monthly patch batch that disable the cloaking abilities of the Sony Rootkit. They have included definitions in its Malicious Software Removal Tool, which runs automatically when users download updates from either Windows Update or Microsoft Update, and can also be run manually from its website. The tool identifies it as F4IRootkit, and they have a fairly comprehensive description of what it does and how it does it. The cumulative update for Internet Explorer also sets the “kill bit” for the original ActiveX-based uninstaller for the DRM software, which itself suffered from security problems. The kill bit effectively disables it so that other malicious websites can’t use the control for malicious purposes.
In related news, Sony BMG has been nominated (along with the European Commission (EC) and Russia) for this year’s “Internet Villain” award for “compromising the security of its customers’ PCs with its copyright-protecting rootkit technology.”
Sony BMG shortlisted for ‘internet villain’ gong
Hope to see everyone at our last meeting of the semester, tonight (Dec. 13) at 7:00pm on the 7th floor of Kimmel!
-Tom
