Sony Hacks Your PC. What is Wrong With This Picture?

Today I read an article about Sony's brilliant copy protection scheme. Protected CD?s required the installation of a program that secretly installed a small program in the OS internals. This program took over your system when you tried to copy something that Sony does not want you to copy.

What is wrong with this picture?

Not just Sony desperately resorting to a hackers toolbox to do copy protection. It is the fact that Sony can do such a hack on an operation system that runs 90% of the world?s computers, without any warning to the end user. Worse, it is very difficult to diagnose and even harder to remove. Once you give a program the authority to install, you are fully dependent on what the developer decides to do with your PC. Wipe your hard disk, no problem. Log your keystrokes, of course! Mine the registry for interesting information, send it home! Windows security is based on a guard at the front door and no checks once you are inside.

The basic problem is architectural. There are many valid use cases for inserting application programs into the Operating System internals. However, the only way this can work securely is if this happens through well defined mechanisms in the operating system. And more important, it should be easy to see who is doing what at any moment in time. And if I do not want it, it should be trivial to retract by the end user. None of this is true for windows. Once an application is inside, it can register at a myriad of places to receive important callbacks, or it can just change crucial DLLs. Though there is the concept of applications packages in windows, it is based on a voluntary support of the installers. If the installers do not cooperate, then there is no record of the installation and uninstallation is impossible.

In a perfect world, the operating system would leave the user in charge. Applications would run in a restricted container, it would be easy to see what they were doing and it would be trivial to remove a bad application. Hmm, this reminds me of some OSGi service platform I heard about ?

   Peter Kriens

posted by Peter @ Thursday, November 03, 2005