When Sony Hired a Rootkit to Protect Music and Accidentally Stole Pirate Code

Back in October 2005, Mark Russinovich, co-creator of Sysinternals, checked a fresh version of RootkitRevealer on his own machine and found a hidden driver. The culprit was an audio CD by the band Van Zant, released by Sony BMG, which deliberately installed the XCP copy protection to stop users from ripping MP3s. As it turned out, the protection came with a heavy side of hidden background processes that ate up CPU cycles and completely broke CD drives when removed manually.

Things escalated quickly when security researchers poked inside the driver and found it used a crude prefix-hiding trick, allowing any malicious actor to name a file with $sys$ and instantly vanish from antivirus scanners. Within weeks, the Stinx-E Trojan used this exact loophole to hide on hundreds of thousands of computers worldwide. Meanwhile, researchers discovered that the proprietary player software was quietly stuffed with chunks of open-source audio libraries like LAME and FAAC, completely ignoring their licenses. The absolute peak of irony was a function lifted directly from an iTunes DRM-stripping tool written by legendary hacker Jon Lech Johansen, embedded right inside a label's anti-piracy tool.

The fallout involved dozens of state lawsuits, millions in settlements, and a PR disaster so profound that even Microsoft decided to swoop in and buy Sysinternals shortly after. Corporations trying to police the internet by deploying malware to customer hardware remains an unmatched masterclass in corporate self-sabotage.

Source: SourceCraft