This past week the internet was abuzz with the news that Sony BMG (under their Sony, Columbia, Epic, Arista, Jive and other labels) has been protecting some of their CDs, possibly since March of 2005, using a method that previously only scum-of-the-earth virus writers used. The method involves "rootkit" technology which hides software from the user and from security software such as your virus scanner. The problem is that once installed, and invisible on your system, there is no mechanism to stop anyone from accessing the rootkit and hiding and running malicious files on your computer!!!

Uninstalling the rootkit yourself is all but impossible and would likely result in rendering your computer's CD player inoperable. Once caught, Sony lied about the risks their rootkit causes, and then issued a software update that it says, "removes the cloaking technology component that has been recently discussed in a number of articles." But, this appears to be a lie too. And, you can't download the "removal" program without giving Sony a ton of personal information.

It all starts when you put the CD in your computer, a EULA (End User License Agreement) pops up. I highly suggest NOT agreeing to it. Although I've never tried it, apparently Sony's copy protection scheme can be thwarted by merely holding down the shift-key when loading a contaminated CD. Also, the Sony malware only affects PCs and does not affect Apple computers. As a general rule, you should never have to install anything on your computer just to listen to a CD you have legally purchased.

I've never been an advocate of illegally downloading music, but given this latest incident and the music industry's history of illegal price fixing, payola scandals, suing innocent people, and generally being a paleolithic purveyor of cultural crap, I'm beginning to become sympathetic to the downloaders.

Watch for lawsuits against Sony to follow in 3...2...1...

[Update 1: List of infected CDs provided by EFF.]

[Update 2: The lawsuits have begun.]

[Update 3: Sony BMG pulls CD copy-protection software.]

[Update 4: Sony to pull controversial CDs, offer swap.]

[Update 5: Sony rootkit removal tool worse than original infection.]