Hackers hijack Sony DRM technology
Kaspersky Labs has warned the first malicious program to use Sony rootkit technology to hide its presence has been detected.
In a move that has angered many people, and which is already being legally challenged in the US, Sony BMG put digital rights management (DRM) technology on to a large number of music CDs. The aim was to prevent disks from being copied. However Sony decided to use rootkit technology which automatically installs itself when a consumer inserted the CD in their computers.
This technology is not picked up by conventional anti-spyware or anti-virus software unless they use rootkit detectors, because it hides itself deep inside the Windows operating system and mimics legitimate files.
This means rootkit attacks are increasingly being used by hackers and virus writers as a way of infecting PCs. One highly unfortunate effect of Sony's decision to use this rootkit was the possibility that malicious programs would implement the same technology.
Kaspersky Lab virus analysts confirm that this has now happened and said the backdoor program which utilizes Sony's rootkit program is already being spammed to victims.
Attached to the email is a message which uses classic social engineering techniques to entice the recipient into launching the attachment. The attachment allegedly contains a photograph. Once the user launches the attached file, the backdoor code, which Kaspersky has called Backdoor.Win32.Breplibot.b will infect the victim's PC.
It copies itself to the Windows system directory as an executable file. If the victim has unwittingly downloaded Sony's DRM technology the name used by the Trojan means it can use the Sony rootkit technology to hide its presence.
David Emm, Senior Technology Consultant of Kaspersky Lab said: "The development we feared most from Sony's inclusion of rootkit technology to conceal its DRM software was its use to conceal malicious code. Unfortunately, it seems our fears were well-grounded."
http://www.torrentspy.com/article.asp?id=3851