Mark Russinovich Scanned His Own PC in 2005. The Rootkit He Found Came From a Sony BMG Music CD.

Mark Russinovich had co-written RootkitRevealer to expose software that hides inside Windows. While testing its latest version, he scanned one of his own computers. In a blog post on October 31, 2005, he wrote that he “was shocked to see evidence of a rootkit.” The hidden software had come from a Sony BMG music CD.

A rootkit is software that hides files, processes or settings from diagnostic and security software. This one was a kernel-level driver named $sys$aries, set to load early in the boot process. It hid any file, process or registry key with “$sys$” at the start of its name.

Russinovich traced the hidden files to First4Internet — a company that Sony BMG had hired to build its copy protection — and to a Van Zant CD he had bought. The software was XCP, short for Extended Copy Protection. The Baltimore Sun reported that when he uncloaked the files and removed them, his CD player was “completely disabled” and he “couldn’t play anybody’s music, let alone copy it.”

As the Sun summed up his complaint, Sony BMG had protected its music “by installing the same kind of rootkit that virus and worm writers use.” Within three weeks of his post, malware was hiding inside that cloak, Sony BMG’s removal tool had opened a new hole, and Texas had sued.

How XCP hid itself inside Windows

XCP’s installer started automatically when a protected CD was first inserted into a Windows PC. The rootkit driver then changed the behavior of four Windows system calls: NtQueryDirectoryFile, NtCreateFile, NtQuerySystemInformation and NtEnumerateKey. Programs use these low-level functions, respectively, to list directories, open files, list running processes and enumerate registry keys. The driver filtered names starting with “$sys$” out of what those calls returned, unless the calling program’s own name also had the “$sys$” prefix. That exception gave XCP’s own processes an accurate view of the system.

A filter like that leaves gaps, and RootkitRevealer looks for them. The tool compares the answers Windows gives programs with a raw scan of the file system and the registry, and lists the differences. On Russinovich’s PC, the list included a hidden directory in the Windows system folder, $sys$filesystem. He then tested the naming rule himself: he made a copy of Notepad named $sys$notepad.exe, and it disappeared from view.

The player program on XCP discs also contacted a Sony server, connected.sonymusic.com, when a disc was inserted, and sent a code that identified the album. J. Alex Halderman and Edward Felten, two Princeton computer scientists who later dissected the software, note that the contact let the server log “the user’s IP address, the date and time, and the identity of the album.” Citing a class-action complaint, they also report that Sony BMG deployed XCP on 52 titles, representing more than 4.7 million CDs.

Sony BMG’s response and an uninstaller that made things worse

On November 4, Thomas Hesse, president of Sony BMG’s global digital business division, spoke to NPR, the US public radio network. “Most people, I think, don’t even know what a rootkit is, so why should they care about it?” he said.

Six days later, Kaspersky Lab reported a backdoor Trojan, Backdoor.Win32.Breplibot.b, mass-mailed as an attachment disguised as a photograph. When launched, it copied itself into the Windows system folder as $SYS$DRV.EXE. On a PC running XCP, that name was enough for the rootkit to hide the Trojan. In a 2006 paper, Halderman and Felten report that at least two Trojan horses seen in the wild exploited the cloak.

Removing XCP carried its own risk. To get Sony BMG’s uninstaller, customers filled out a web form, and the form installed CodeSupport, an ActiveX control from First4Internet. ActiveX controls were plug-ins that Internet Explorer could download and run. CodeSupport stayed on the PC, and it was marked “safe for scripting,” which meant any web page could send it commands. On November 15, Halderman and Felten warned that the control “allows any web page you visit to download, install, and run any code it likes on your computer.”

In mid-November, Sony BMG said that discs still in the supply chain would not be sold and that buyers could exchange the ones they had. On November 21, Texas sued Sony BMG under the state’s new Consumer Protection Against Computer Spyware Act. On January 30, 2007, Sony BMG settled charges brought by the Federal Trade Commission. It agreed to let consumers exchange the CDs, to reimburse them up to $150 for repairing damage caused by their attempts to remove the software, and to stop installing content protection software without consumers’ authorization.

How many computers the Sony BMG rootkit reached

The numbers are easy to stretch. One online retelling says the software “installed itself silently without informed consent on over 22 million machines.” The same article also says Sony BMG “shipped approximately 22 million music CDs,” so one number serves as both a count of discs and a count of computers.

Most of those discs did not carry the rootkit. Wikipedia’s article on the scandal splits the roughly 22 million into about 2 million CDs with XCP and about 20 million with MediaMax, a different copy-protection program made by SunnComm. The class-action figures that Halderman and Felten cite put XCP higher, at more than 4.7 million CDs. MediaMax had problems of its own — it installed, and at least temporarily activated, before showing its license agreement — but it was not the rootkit Russinovich found.

The security researcher Dan Kaminsky tried to measure the rootkit’s spread by looking at the Domain Name System (DNS), the internet’s address book. Infected PCs looked up Sony’s and First4Internet’s servers, and those lookups left traces in nameservers’ caches. Using a technique called DNS cache snooping, he found that “at least 568,200 nameservers have witnessed DNS queries related to the rootkit.” That counts nameservers, not PCs. The Electronic Frontier Foundation, a digital-rights group, noted that many computers can share one nameserver, while a single lookup can be cached by more than one nameserver, so the figure is hard to convert into a number of machines.

What the Sony BMG rootkit shows about hiding software

XCP’s cloak did not check what it was hiding. It hid every name with the “$sys$” prefix, so it hid a Trojan as faithfully as it hid XCP’s own files. A mechanism that conceals things on a machine works for anyone who learns its rule.

The uninstaller showed a second pattern: a fix is software too, with its own attack surface. The tool meant to remove XCP left behind a control that let web pages run code.

The discovery itself came from someone who was not looking for copy protection. Russinovich, who had co-founded Winternals and Sysinternals with Bryce Cogswell in 1996, was testing his own software. Microsoft bought both companies in July 2006, and he later became chief technology officer of Azure, Microsoft’s cloud platform.

Software that hides from its own user also hides from that user’s defenses.

RootkitRevealer was built to catch what virus writers conceal. On one of Russinovich’s own computers, in the autumn of 2005, it caught a Van Zant album.