Sony can't seem to keep its hands off its customers' hard drives. Earlier this week, two security companies found that fingerprint-scanning USB drives sold by the company install hidden software on users' computers, just two years after a similar tactic led to mass recalls of another Sony product and a string of lawsuits.
In this case, the hidden program, known as a "rootkit," was used to enable a security feature on Sony's (nyse: SNE - news - people ) Microvault USB drives, which verify the identity of the user by reading his or her fingerprint. Paradoxically, security researchers say, it instead creates a gaping security vulnerability; the rootkit creates an invisible folder that allows cybercriminals to install their own malicious software where it can operate undetected, potentially stealing passwords or sending spam e-mail.
Sony spokesman Tom Di Nome points out that the three Microvault models that employ the fingerprint-scanning technology are no longer being manufactured. He also says the company is currently investigating the source of the problem and "taking the issue very seriously," though no security problems have yet been reported by the USB drives' users.
The rootkit's discovery, originally made by the Finnish company F-Secure and later verified by McAfee (nyse: MFE - news - people ), opens a barely healed wound for Sony. In 2005, digital rights management software on Sony BMG music CDs, designed to control users' attempts to distribute and copy music, was found to install an invisible rootkit folder when customers played the CDs on their computers.
Consumers soon protested Sony's aggressive restrictions on copying music and disregard for security. Sony's executives were initially unresponsive; the company's global digital business president Thomas Hesse infamously told NPR's Morning Edition in November 2005 that "most customers don't even know what a rootkit is. So why should they worry about it?"
But as viruses and malicious software exploiting the rootkit began to surface, Sony issued a recall of all affected CDs later that month. Not soon enough, however, to avoid lawsuits from the Federal Trade Commission, multiple state attorney generals, and several class actions, alleging that Sony's CDs violated state laws defining fair business practice and prohibiting spyware. The company eventually paid around $6 million in settlements; the negative publicity surrounding one of the country's first commercial spyware scandals likely cost Sony much more.
Given that history, it's hard to imagine why the company would repeat its careless coding, says Ari Schwartz, deputy director of the Center for Democracy and Technology. "I can't see why any company would use this kind of software after the legal action taken against Sony," he says. "The fact that this is actually another Sony subsidiary is especially shocking."
In fact, the timing of the discovery is especially ironic, given that Sony just last month filed a lawsuit against one of the developers of DRM software that led to the company's 2005 blowup. Sony is demanding $12 million in damages, arguing that The Amergence Group breached the terms of its licensing agreement by delivering software that was negligently designed.
Sony's newest instance of the rootkit coding, which again invites exploitation from malicious software writers, is a symptom of the software industry's general inattention to security issues, says Dave Marcus, a spokesman for McAfee. "It's a huge problem," he says. "This is reflective of the fact that software vendors simply aren't thinking from the perspective of malicious coders."
0 comments:
Post a Comment