The 2005 Music CD That Hid Software on Your Computer

Mark Russinovich figured his own tool had a bug.

It was late October 2005, and he was testing a new version of RootkitRevealer, a program he had helped write to catch software that hides itself from Windows and from security scanners. He ran it on one of his own PCs. It reported a hidden folder, several hidden drivers and a hidden application. "Given the fact that I'm careful in my surfing habits and only install software from reputable sources I had no idea how I'd picked up a real rootkit," he wrote, and "if it were not for the suspicious names of the listed files I would have suspected RKR to have a bug."

A rootkit is a program built to be invisible. It hides its own files from the operating system, so ordinary tools, antivirus included, don't list them. Criminals love the trick, and a man who made his living finding it had just found it on his desk.

He tracked the cloaking to a driver named Aries.sys. Anything with a name that started with "$sys$" (a file, a folder, a Registry entry, a running program) vanished from view. To test it, he copied Notepad, renamed the copy $sys$notepad.exe, and watched it disappear.

The hidden files carried a label: "Essential System Tools," from a company called First 4 Internet. Its website had nothing on the product or the driver. But the company sold a copy-protection system called XCP, and a web search showed deals with several record labels, Sony among them. Then Russinovich remembered a CD he had bought, Get Right with the Man by the Van Zant brothers. It played only in a player bundled on the disc and allowed at most three copies. He had ordered it from Amazon.com.

"I hadn't noticed when I purchased the CD from Amazon.com that it's protected with DRM software," he wrote, "but if I had looked more closely at the text on the Amazon.com web page I would have known." DRM is short for digital rights management, the locks that record labels and studios put on music and video to limit copying.

Mark Russinovich keynoting Microsoft's PDC10 developer conference in October 2010. Photo: MicrosoftPDC, CC BY 2.0, via Wikimedia Commons.

The service with the friendly name

With the disc in the drive, Russinovich watched the hidden pieces work. A background program called $sys$DRMServer.exe ran as a Windows service named "Plug and Play Device Manager," a name that sits comfortably among the real ones and invites nobody to look closer. When he closed the player, it kept using one to two percent of the processor. Every two seconds it checked the programs running on his machine.

He looked for an uninstaller. Nothing in the Control Panel's Add or Remove Programs list. Nothing on the CD or on the company's website. The license agreement that came with the disc didn't mention software he couldn't remove. "Now I was mad," he wrote.

So he deleted the drivers and their Registry entries by hand and rebooted. His CD drive had vanished. One of the hidden drivers, Crater.sys, sat between Windows and the drive, and with it gone Windows couldn't start the drive at all. "Another ironic name," he wrote, "since it had 'cratered' my CD." Getting the drive back meant running the Registry Editor as the Windows system account and deleting two more entries, then another reboot.

He posted all of it on Monday, Oct 31, 2005. His verdict was short: "This is a clear case of Sony taking DRM too far." He also warned that most people who stumbled on the hidden files would cripple their own computer by deleting them, exactly as he had. The comments started arriving that afternoon. One of them read, "It's lawsuit time, guys."

Millions of discs

Two Princeton researchers, J. Alex Halderman and Edward Felten, took the software apart and published what they found. Sony BMG, then the second-largest record company in the world, had shipped XCP on 52 titles. A second system, MediaMax, made by a company called SunnComm, rode on 37 Sony titles and dozens from other labels.

Both leaned on Windows autorun. Mac and Linux machines had no autorun feature, XCP shipped only Windows code, and MediaMax's Mac version waited for the user to double-click an installer. On a Windows PC, putting in the disc made Windows hunt for a file called autorun.inf and run the commands inside, which was how an installer popped up on a music CD. Holding down Shift as the disc loaded blocked it. Turning autorun off did the same.

The installer asked you to accept a license agreement, and accepting installed the software. MediaMax was worse. Under some common circumstances it left its software on the computer even after the user clicked Decline.

The players also phoned home. Every time a protected disc went in, XCP's contacted a Sony web server, which could log the computer's address, the time and which album was playing. The researchers wrote that both systems seemed to meet the usual definition of spyware.

The cloak was the part that kept security people up at night. Because XCP hid everything starting with "$sys$," a virus writer didn't need to build a rootkit. Naming a file with that prefix was enough, and at least two Trojan horses in the wild did exactly that.

Under public pressure, Sony BMG agreed to recall the XCP discs and released uninstallers. The researchers found that the uninstallers created serious security holes of their own. Class-action lawsuits followed, and so did government investigations.

How it ended

On Jan 30, 2007, the Federal Trade Commission announced that Sony BMG had agreed to settle charges that it sold CDs without telling buyers they carried software that limited copying and playback, exposed their computers to security risks, and tracked their listening habits to send them marketing messages. The FTC also charged that the software hid itself and was unreasonably hard to uninstall.

"Consumers' computers belong to them," FTC Chairman Deborah Platt Majoras said in the announcement.

The settlement made Sony BMG label any copying or playback limits on the package, banned it from installing copy-protection software without permission, and barred it from hiding such software. For two years it had to offer a free uninstall tool and security patches. Buyers could swap affected CDs bought before Dec 31, 2006 for new ones without copy protection, and the company had to reimburse up to $150 for damage to a computer from trying to remove the software.

What it means for you

Software you didn't ask for, that you can't see and can't remove, is a problem no matter whose logo is on the box. It was a famous company's product, packaged with an album, and it behaved the way malware behaves.

Pay attention when something you bought wants to install its own player, launcher or "helper" before it will work. A music disc was the start. Today it can be a game launcher, a printer's setup tool, a free app that wants permission to do more than it needs. If a prompt asks to install something and you haven't done anything to cause it, choose No.

You can see what's on your computer in about two minutes. On Windows 11, go to Settings > Apps > Installed apps. On Windows 10, it's Settings > Apps > Apps & features. On a Mac, open Finder > Applications. Search the web for any name you don't recognize before you remove it, and leave drivers and system files alone. Russinovich's CD drive disappeared the moment he started deleting them by hand.

Illustration: Tech Cheat Codes.

If you help a parent or grandparent with their computer, run through that list together and put a note on the calendar to do it again in three months.

References

• Source: Mark Russinovich, "Sony, Rootkits and Digital Rights Management Gone Too Far," Oct 31, 2005 (Internet Archive copy of the original blog post)
• Source: J. Alex Halderman and Edward W. Felten, "Lessons from the Sony CD DRM Episode," Princeton University, extended version Feb 14, 2006 (Library of Congress copy)
• Source: Federal Trade Commission, "Sony BMG Settles FTC Charges," Jan 30, 2007 (Internet Archive copy)