RIAA take copy protection to a new extreme

The Kernel · Post by **The Kernel** » 2004-06-23 06:06pm

The Register wrote:A new Beastie Boys' CD called "To the Five Boroughs" (Capitol Records), is raising hackles around the Web for reputedly infecting computers with a virus.

According to a recent thread at BugTraq, an executable file is automatically and silently installed on the user's machine when the CD is loaded. The file is said to be a driver that prevents users from ripping the CD (and perhaps others), and attacks both Windows boxen and Macs.

The infected CD is being distributed worldwide except in the USA and UK, which prevents us from giving a firsthand report. However, according to hearsay, we gather that the Windows version exploits the 'autorun' option, and that the Mac version affects the auto play option.

On Windows, when a CD is loaded, a text file called autorun.inf is read, and any instructions within it are executed. In this case, the machine is instructed to install some manner of DRM driver that prevents copying. We haven't seen either the .inf file or any of the executables, so we can't say how or at what level it accomplishes this - or if indeed it actually does accomplish this.

But assuming that the unconfirmed reports are accurate, we have here a media company infecting users' machines silently with a file that affects a computer's functionality, without first obtaining informed consent: a likely violation of pretty much every jurisdiction's anti-hacking laws. It's possible to foresee criminal charges being brought at some point: after all, having a good reason for spreading malware has never been much of a defence in court. And a file that alters a computer's functioning without the owner's informed consent is the very definition of malware. Because this malware can be transferred from machine to machine on a removable disk, and requires user interaction to spread, it is, quite simply, a computer virus. (A worm, on the other hand, is distinguished by its ability to spread without user interaction.)
CD virus protection

Let's look at the ways this autorun business can be defeated. It's quite easy to disable autorun in Windows by holding down the Shift key when loading a CD. Unfortunately, this has to be done each time the CD is played. However, it's easy to insert the CD once with the Shift key depressed, and then simply rip the tracks to the hard disk. You can then use the CD in other devices, and listen to your corresponding MP3s or whatever on your computer.

You can also disable the autorun "feature" on your Windows machine permanently so that this and other CDs infected with viruses won't affect you in the future.

To do this, go to the Start menu ==> Run, and type in the command regedit. Your registry editor will launch. Navigate to the following key, and edit as shown:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CDRom and set Autorun DWORD=0

It might be necessary to create the value, thus: Data Type: DWORD Value Name: Autorun Value: 0

As usual, you must reboot your Windows box for the changes to take effect.
Disinfection

The above procedure assumes that you haven't previously installed the suspected Capitol Records virus, or a similar one from another fine entertainment conglomerate. But if you have, you will need to find and uninstall the malware first. The autorun.inf file on the CD will likely indicate the name of the relevant file(s), the locations where they're installed, and any registry changes made.

Armed with that information, go to the Windows 'uninstall' utility:

Start menu ==> Settings ==> Control Panel ==> Add or Remove Programs ==> Change/Remove.

Look for any program files referenced in the autorun.inf file and uninstall them. If no related programs are listed, you will need to launch the Windows Search Companion and search for any files named in the autorun.inf file and delete them manually. Be sure to activate the options in the "more advanced features" dialog allowing you to search the entire disk (search system folders, search hidden folders, and search subfolders).

Now, a word of caution: if the Capitol Records virus has updated a library file or driver, deleting it might affect your system's functioning, and you might need to re-install Windows to put things right again. (Carefully log the time needed to do this and include it in your criminal complaint.) However, deleting a foreign executable file is safe, so long as it's not one you actually need. So be careful about file name spellings so that you don't accidentally delete an important file that's spelt similar to the one you wish to be rid of. ®

Howedar · Post by **Howedar** » 2004-06-23 06:16pm

Glad I have autorun turned off.

Mad · Post by **Mad** » 2004-06-23 06:18pm

The Register wrote:Because this malware can be transferred from machine to machine on a removable disk, and requires user interaction to spread, it is, quite simply, a computer virus.

Incorrect. A computer virus does not require user interaction to spread, nor does it have to be on a removable disk. A computer virus is code that attaches itself to other computer programs to spread.

(A worm, on the other hand, is distinguished by its ability to spread without user interaction.)

Also incorrect. A worm eats resources, typically by eating up system RAM or spreading rapidly over a network and bogging it down. The difference between a worm and a virus is that a worm doesn't alter the code of other programs to attach themselves to the infected programs.

That said, this form of copy protection is nothing new. But it's certainly a problem since it alters the operation of the computer without consent. And if different implementations of this method were to be used by different companies, a computer that plays lots of music off of legitimate CDs will run into the problem of having lots of uneccessary drivers loaded into memory, eating up system resources. (The same way many computers are infected with loads of spyware and bogged down.)

MKSheppard · Post by **MKSheppard** » 2004-06-23 06:22pm

I'm deaf so no problem there.......I however, hope the anti virus companies
stop this one cold

DPDarkPrimus · Post by **DPDarkPrimus** » 2004-06-23 06:57pm

I find that a bit doubtful.

Solauren · Post by **Solauren** » 2004-06-23 07:04pm

Since writing computer programs like that get you arrested, I really hope the RIAA did do this.

Imagine the massive class action lawsuit

Durandal · Post by **Durandal** » 2004-06-23 07:42pm

Mac OS X has no auto-run feature for removable media precisely for this reason: it's a security risk. In order to install a new driver on an OS X box, the CD would have to execute the program without the user knowing (impossible to do upon mount in OS X), unload the old kernel extension, remove it, install the new one and then load it, all without once requesting administrator privileges. Not gonna happen.

There is an auto-play feature for QuickTime, but there's no way in Hell that it allows for a program to launch, much less one that will install a new driver without requesting administrator privileges first. There is also no way this feature could be exploited to prevent iTunes from ripping a CD. This sounds like bullshit to me. Besides, this new copy protection, heralded as "unbeatable", (the kind which can be overcome by holding down the Shift key on Windows) was reported and laughed at months ago.

Mac OS 9 has an auto-run feature for CDs, but in order for such copy-protection to work (by installing a new CD-ROM driver), the user would have to reboot to activate the extension for the driver.

Post by **Gandalf** » 2004-06-23 08:38pm

At first glance this is quite clever.

As soon as people wake up to the fact they can turn auto-run off this will end.

Are the Beastie Boys legally responsible for this?

SPOOFE · Post by **SPOOFE** » 2004-06-23 08:44pm

Imagine the massive class action lawsuit

Where? Not the US, certainly.

Solauren · Post by **Solauren** » 2004-06-23 09:21pm

As a Canadian, I'd sue there assess off, and then take the Beastie Boys to court for not keeping an eye on it.

Pu-239 · Post by **Pu-239** » 2004-06-23 11:45pm

[Linux User][Nelson]HaHa![/Nelson][/Linux User]

Post by **The Wookiee** » 2004-06-24 06:39am

No link?

The Kernel · Post by **The Kernel** » 2004-06-24 07:05am

The Wookiee wrote:No link?

Link for Wookie

Happy?

phongn · Post by **phongn** » 2004-06-24 10:16am

Durandal wrote:Mac OS X has no auto-run feature for removable media precisely for this reason: it's a security risk. In order to install a new driver on an OS X box, the CD would have to execute the program without the user knowing (impossible to do upon mount in OS X), unload the old kernel extension, remove it, install the new one and then load it, all without once requesting administrator privileges. Not gonna happen.

Driver install on Windows requires administrative rights, but most people run with Administrator rights anyways. Also, normally I get a prompt warning me about if I'm about to install a driver -- signed or unsigned. I suspect that this might not be a true driver.

Vertigo1 · Post by **Vertigo1** » 2004-06-24 03:38pm

And they wonder why people aren't buying CDs.....

General Zod · Post by **General Zod** » 2004-06-24 03:50pm

The RIAA really needs to take a tip from the pr0n industry. You don't see them bitching about people sharing their material over the internet. Not only that, but they're just as successful business wise as ever really. Maybe the RIAA should take a hint and start adapting its business to internet distribution rather than wasting time fighting something that has so much momentum behind it it'll be nigh impossible to stop. . .

Faqa · Post by **Faqa** » 2004-06-29 10:09am

Am I the only one to take umbrage at the fact that you need to edit the registry and lose MS product support in order to TURN OFF AUTORUN!!!!!????

Seriously, I'm not a rabid MS-hater(just a non-rabid one...). But this is ridiculous.

Soontir C'boath · Post by **Soontir C'boath** » 2004-06-29 10:37am

Faqa wrote:Am I the only one to take umbrage at the fact that you need to edit the registry and lose MS product support in order to TURN OFF AUTORUN!!!!!???? Seriously, I'm not a rabid MS-hater(just a non-rabid one...). But this is ridiculous.

What OS are you using?

Faqa · Post by **Faqa** » 2004-06-29 11:33am

Win XP. When I have:

A) My own computer.

B) Working knowledge of Linux OS.

I plan to change over to a Linux/Windows dual-boot. Specially if the Longhorn rumors are true(that Microsoft will work with Intel and AMD to make sure non-Microsoft approved programs WON'T WORK on Longhorn. It is, of course, just a rumor).

Is there a difference? I vaguely remember turning of autorun for PQ6:SWAT on Win98, so possibly there is.

phongn · Post by **phongn** » 2004-06-29 12:07pm

Faqa wrote:Am I the only one to take umbrage at the fact that you need to edit the registry and lose MS product support in order to TURN OFF AUTORUN!!!!!????

No, and no.

Xon · Post by **Xon** » 2004-06-29 12:40pm

Hold down the fucking shift key, to disable autorun when you insert a CD!

Yes, the company who makes this 'copy protection' knows this and still went and released the stupid thing.

Ace Pace · Post by **Ace Pace** » 2004-06-29 12:43pm

Uh, you CAN configure auto-play to not automaticly play everything, right click your CD drive in my computers, properities, auto-play.

Faqa · Post by **Faqa** » 2004-06-29 12:59pm

OOOOOPS....

Yes, you can do this through the properties menu. No need for a registry hack....

Oh, well, still plenty of reasons to hate MS....

Ace Pace · Post by **Ace Pace** » 2004-06-29 01:02pm

I don't understand why people religously hate Microsoft, yes its a shitty company that makes sub-standerd software (except games), and has an illegal monopoly, is that a reason to proclaim them the second coming of hitler's empire?!

Faqa · Post by **Faqa** » 2004-06-29 01:53pm

Immoral.

Controlling.

Customers are de-facto criminals.

Monopolizing.

Same reasons people hate the RIAA, really.

StarDestroyer.Net BBS

RIAA take copy protection to a new extreme

RIAA take copy protection to a new extreme

Re: RIAA take copy protection to a new extreme