Sony coughs up rootkit compensation

IN CALIFORNIA, Sony BMG paid a wee $750,000 fine and agreed to reimburse punters up to $175 towards the cost of repairs required to uninstall digital rights management software that the company bundled with several of its music CDs.

The settlement also bans Sony from distributing CDs with bundled DRM technology without alerting consumers.

The settlement stems from the firm's rootkit fiasco when Sony bundled anti-piracy software on several of its music CDs that installed automatically when a user inserted the CD in a computer. The software used rootkit technology to hide the files and the processes from the user and the system.

The rootkit was pretty rubbish, though, as worm authors could exploit it simply by placing the characters '$sys$' in front of a file name. An estimated 450,000 Californians purchased one or more of the malware infested CDs, but the state is not aware of how many tried playing the CDs on their computer and are therefore eligible for compensation.

The complaint accused Sony of 'false or misleading advertising', 'unfair and unlawful businesses practices', and 'unauthorised access to computers'. "Companies that want to load their CDs with software that limits the ability to copy music should fully inform consumers about it, not hide it, and make sure it does not inflict security vulnerabilities on computers," said California attorney general Bill Lockyer.

"To its credit, Sony BMG learned this lesson and has stopped the practices that led to this lawsuit, he said. "But the settlement further protects consumers by prohibiting similar conduct in the future and requiring Sony BMG to pay consumers back for out-of-pocket expenses they incurred to repair harm to computers caused by the software." µ