Jeffrey Aho

A few updates first for friends. I’ll be in Waterloo this weekend, so contact me and we’ll get together. I have about a month and a half left of work, and will be home for Christmas Eve. (Passed 1000 unique visitors!)

I’ve found out something very distressing. I have a rootkit on my laptop. What’s a rootkit you ask? Let me explain…

I’ve been listening to podcasts on technology and security issues lately. My favourite is This Week In Tech (who’s Episode 29 talks about a specific rootkit), though Security Now is pretty good as well. A few weeks ago Security Now did an issue on rootkits (In the link you can get Episode 9 and 12, the relevant podcasts). Rootkits are programs that hide files and running processes from the operating system and run at kernel level. A rootkit can be used by spyware or viruses to make it harder to find and remove. Thus they are major security threats, and why I am so distressed over the fact I found one.

This particular rootkit is unique. It wasn’t put there by a hacker, but by a corporation: Sony. It has actually been known for quite a bit, but became well known when Sysinternal posted a blog about it after finding one on their machine. It’s a program that aids Digital Rights Management, for use in preventing piracy. It’s also been reported that the program reports back to Sony to say what people are listening to (something Slashdot has picked up on). Sounds like Spyware to me. Even worse (I invite you to listen to the podcasts, where lots of my info comes from, especially the Security Now one), is the fact the rootkit is poorly coded, and essentially just hides files beginning with $sys$ (read more at rookit.com), so that script kiddies could use the rootkit themselves to make viruses that could also not be detected. It’s a very dangerous rootkit!

Now that you know about rootkits, I’ll tell you how I found mine, how I got it, and what I’m going to do to remove it. And I suggest you all do the same. I used Sysinternal’s RootkitRevealer to scan my computer for it. Sony is installing this rootkit through Audio CDs that you play on your computer and require software to install to run. I believe it may have come from my Our Lady Peace album Healthy in Paranoid Times, which is the only Sony BMG CD I remember playing recently. I had already been distressed with the album because the protection software didn’t allow me to rip it to iTunes, thus I couldn’t get the music to my iPod. This software only encourages piracy! Makes it very hard for legitimate users to enjoy their music!

Sony, through the company that made the software, has the ability to remove the rootkit. If you try to remove the software with RootkitRevealer, you will lose your CD drive. There used to be a work around removing the rootkit, but Sony patched it! You have to now go to the site, allow an ActiveX control to run on your computer, which will ask if you want to update the software, say no, and it will give an option to delete it. Sony may change this soon as they are taking alot of heat in the media. Follow whatever instructions they have on their site. If rootkits are being used by one major company, there is no guarantee that others aren’t either. Terrifying.

***EDIT***

A virus is already out taking advantage of the rootkit. Also Sony’s fix is causing more damage and now Sony is recalling CDs.

I’m planning a new entry, but some more updates. Texas is sueing Sony, there is a way of cheating the DRM technology using tape, and Bruce Schneier (a famous cryptographer) weighs in on the events.

Random Wikipedia Article: Tonberry
Currently Listening to: The Scientist - Coldplay

I’ve been trying not to write blogs about news articles and instead just post them in my sidebar, but one today has me fuming.

Yesterday (article) the Pentagon charged Omar Khadr with a series of crimes relating to an incident in Afghanistan on July 27, 2002. That means it took the US almost 40 MONTHS to charge him! Where was he for this time? Being held at Guantanamo Bay.

Even worse is that Khadr, who was born in Canada (a full Canadian Citizen), was 14 at the time of the alleged crime. The Pentagon has replied to this by saying “He’s over 18 now”, charging him as an adult and leaving open the option of the death penalty. Holding a Canadian minor is a foreign prison known for torture, prisoner abuse, and human rights violations, without charging him with a crime for YEARS, until he is over 18 is not only illegal, but is repulsive and nauseating. The US continues to trample over international law and no international body will stand up to accuse them of crimes and punish them accordingly.

The media has twisted this story over the last several months and I’ve been following it closely. I’ve read articles that have claimed he had surrendered and then used the grenade killing a non-combatant. In fact while the soldier who died had medic training, he wasn’t a medic, and was in a soldier role at the time. The truth was twisted, and few reported that Khadr was shot and blinded. Bias has plagued this event. No matter how horrible the crime is, or who committed it, the individual deserves a fail trial, access to legal aid, and not be subjected to torture and the international crimes the US commits.

The history of the event and the characters behind it is very interesting as well. The Khadr family has been linked with Al-Qaeda and Osama bin Laden, and has been in the news more than once. Whatever the case, Omar Khadr has not been proved guilty, and despite his family’s past, he should be given all civil and legal rights that all Canadians deserve. I sincerely hope the Canadian government can ensure true justice takes place.

***EDIT***

US now says they won’t seek execution of Khadr.

Random Wikipedia Article: Trapped in the Closet
Currently Listening to: American Pie - Don McLean