Well, true to their word … and it’s sad information really for the frustrated and vulnerable users of Sony’s XCP ‘protected’ CDs.
Earlier today Ed Felten and I reported a serious security hole opened by the uninstaller that Sony provides to users who want to remove the First4Internet copy protection software. Further testing has confirmed that computers remain vulnerable even after the uninstall process is complete.
And the reason? The Sony uninstaller leaves CodeSupport component on the computer and it’s not picky who it allows to install code through Internet Explorer!
Due to a serious design flaw, the CodeSupport component allows any web site you visit to download and run software on your computer. A malicious web site author can write an evil program, package up that program appropriately, put the packaged code at some URL, and then write a web page that causes CodeSupport to download and run code from that URL. If you visit that web page with Internet Explorer, and you have previously performed at least step 2 of Sonyâ€™s uninstall process, then the evil program will be downloaded, installed, and run on your computer, immediately and automatically. Your goose will be cooked.
Oh, by the way Sony has not only recalled the CDs and is offering a swap on CDs already purchased, but they have also temporarily removed the vulnerable uninstaller too. More information in the article above.
Hopefully this will be over soon (if/when they remove the danger to their customer’s computers) and Sony, if they have to use ‘copy protection’ will use it only on CDs where the artists specifically has granted permission to do so, and find another company that knows how to code to do the work so consumers will not be put at risk like this again.