[infowarrior] - Not Again! Uninstaller for Other Sony DRM Also Opens Huge Security Hole

[Richard Forno]

Not Again! Uninstaller for Other Sony DRM Also Opens Huge Security Hole
Thursday November 17, 2005 by J. Alex Halderman
http://www.freedom-to-tinker.com/?p=931

I have good news and bad news about Sony¹s other CD DRM technology, the
SunnComm MediaMax system. (For those keeping score at home, Ed and I have
written a lot recently about Sony¹s XCP copy protection technology, but this
post is about a separate system that Sony ships on other CDs.)

I wrote last weekend about SunnComm¹s spyware-like behavior. Sony CDs
protected with their technology automatically install several megabytes of
files without any meaningful notice or consent, silently phone home every
time you play a protected album, and fail to include any uninstall option.

Here¹s the good news: As several readers have pointed out, SunnComm will
provide a tool to uninstall their software if users pester them enough.
Typically this requires at least two rounds of emails with the company¹s
support staff.

Now the bad news: It turns out that the web-based uninstaller SunnComm
provides opens up a major security hole very similar to the one created by
the web-based uninstaller for Sony¹s other DRM, XCP, that we announced a few
days ago. I have verified that it is possible for a malicious web site to
use the SunnComm hole to take control of PCs where the uninstaller has been
used. In fact, the the SunnComm problem is easier to exploit than the XCP
uninstaller flaw.

To be clear, the SunnComm security flaw does not apply to the software that
ships on CDs, but only to the uninstaller that SunnComm distributes
separately for removing the CD software. So if you haven¹t used the
uninstaller, you¹re not vulnerable to this flaw and you don¹t need to do
anything.

If you visit the SunnComm uninstaller web page, you are prompted to accept a
small software component‹an ActiveX control called AxWebRemoveCtrl created
by SunnComm. This control has a design flaw that allows any web site to
cause it to download and execute code from an arbitrary URL. If you¹ve used
the SunnComm uninstaller, the vulnerable AxWebRemoveCtrl component is still
on your computer, and if you later visit an evil web site, the site can use
the flawed control to silently download, install, and run any software code
it likes on your computer. The evil site could use this ability to cause
severe damage, such as adding your PC to a botnet or erasing your hard disk.

You can tell whether the vulnerable control is installed on your computer by
using our AxWebRemoveCtrl detector.

We have created a tool that will disable the control and/or block it from
being installed. To apply our tool, download this file to a temporary
location, then double click on the file¹s icon in Windows. (Windows may ask
you to confirm that you wish to add the information in the file to the
system registry­choose ³Yes.²) After the tool has been applied, you may
delete the file you downloaded. The tool will take effect as soon as you
close and restart Internet Explorer. We recommend that anyone who has used
the SunnComm uninstaller run our tool as soon as possible.

Unfortunately, if you use our tool to block the control, you won¹t be able
to use SunnComm¹s current uninstaller to remove their software. It¹s up to
them to replace the flawed uninstaller with a safe one as soon as possible,
and to contact those who have already used the vulnerable uninstaller with
instructions for closing the hole.

UPDATE (Nov. 18): We are currently helping SunnComm test a new version of
the uninstaller. 



You are a subscribed member of the infowarrior list. Visit
www.infowarrior.org for list information or to unsubscribe. This message
may be redistributed freely in its entirety. Any and all copyrights
appearing in list messages are maintained by their respective owners.

[infowarrior] - More on - DOD to hold security stand-down

[Richard Forno]

-- Forwarded Message
From: matthew 
Date: Sat, 19 Nov 2005 06:53:22 -0800 (PST)


> information. DOD officials are now considering new policy and
> acquisition initiatives to improve information assurance.

For the last time, Security is a PEOPLE problem!! I'm ready to scream.
When DoD civilians and in particular self-important political
appointees (and their sycophants) flout DoD/DISA/OSD/JTF security
policy because they are "too special" to be concerned with having to
have good (or any) passwords, refuse to use the provided secure access
mechanisms, or fly into a rage over having to even take Information
Assurance training (all of 45min long) or suffer the indignity and
inconvenience of a screensaver with a password then the problem has
NOTHING to do with acquisitions.

Revised acquisitions also does nothing to remedy the fact that large
sections of the Pentagon STILL run NT4, have been dragging their butts
for 5+ years about moving to 2K let alone newer stuff, and forcing the
rest of us who have already moved (albeit very belatedly) to maintain
holes because the parent org who controls mail are STILL on Exchange
5.5. Then there is that jewel of thought that goes something like "No,
all departments will no longer be permitted to have firewalls. Because
firewalls prevent us from scanning and rooting all your boxes. And no,
there will be but one forest and all you little people (who've been on
AD for years now whereas the parent still isn't) will be OU's. I guess
nobody bothered to read MS' handbook about forests being the only real
security boundary. The totally LAME justification for doing everything
wrong? "oh, we want to eliminate all departmental helpdesks. And deploy
all those enterprise applications." What supposed applications would
that be again? Yeah, thought so.

Sometimes I just want to yell "are you people freaking stupid?!" at the
top of my lungs. But I'll just wait for the revised acquisition
strategy  to save the day. Now where did I put my morphine drip.
Self-medication is a great thing.


-- End of Forwarded Message



You are a subscribed member of the infowarrior list. Visit 
www.infowarrior.org for list information or to unsubscribe. This message 
may be redistributed freely in its entirety. Any and all copyrights 
appearing in list messages are maintained by their respective owners.