You’d think Sony would’ve learned from all the trouble they got in with their anti-CD copying rootkit awhile back, but the problem with being a huge conglomerate is it’s often difficult for The Powers That Be to know everything every branch of the company is up to. This time around it’s not a CD copy protection causing the problem, but rather a biometric USB flash drive:
We received a report that our F-Secure DeepGuard HIPS system was warning about a USB stick software driver. The USB stick in question has a built-in fingerprint reader. The case seemed unusual so we ordered a couple of USB sticks with fingerprint authentication. We installed the software on a test machine and were quite surprised to see that after installation our F-Secure BlackLight rootkit detector was reporting hidden files on the system.
Many of our regular readers will remember the huge Sony BMG XCP DRM rootkit debacle of 2005. Back then malware with rootkits were not very common but since then a lot of malware families have adopted rootkit cloaking techniques. It is unclear if the “rise of the rootkit” would have happened in this magnitude without the publicity of the Sony BMG case. In any case, a lot more people now know what a “rootkit” is than back then.
This USB stick with rootkit-like behavior is closely related to the Sony BMG case. First of all, it is another case where rootkit-like cloaking is ill advisedly used in commercial software. Also, the USB sticks we ordered are products of the same company — Sony Corporation.
The Sony MicroVault USM-F fingerprint reader software that comes with the USB stick installs a driver that is hiding a directory under “c:\windows\”. So, when enumerating files and subdirectories in the Windows directory, the directory and files inside it are not visible through Windows API. If you know the name of the directory, it is e.g. possible to enter the hidden directory using Command Prompt and it is possible to create new hidden files. There are also ways to run files from this directory. Files in this directory are also hidden from some antivirus scanners (as with the Sony BMG DRM case) — depending on the techniques employed by the antivirus software. It is therefore technically possible for malware to use the hidden directory as a hiding place.
Oops. To their credit Sony does appear to have learned something from the previous debacle and they’re admitting right up front that it’s an issue:
Electronics giant Sony has confirmed a recently discovered security flaw in some of its products that could leave PCs vulnerable to attack by hackers.
The firm said that the fault, which affected software packaged with memory sticks, was developed by a third-party.
Sony said it was conducting an internal investigation into the problem and would offer a fix “by mid-September”.
That’s a big change from the last time when the president of Sony BMG, Thomas Hesse, made the mistake of railing against angry consumers by declaring “Most people, I think, don’t even know what a rootkit is, so why should they care about it?” That did little to cool heads at the time.
So if you happen to be an owner of one of these Sony USB drives you should be aware that your desire for extra security may have made you less secure, but Sony’s working on a fix for you.