Compromised security just for playing a CD

08.11.2005
If you need convincing that digital rights management (DRM) is a bad idea, look no further than the latest music CD you just bought from Sony-BMG. If you are running a Windows machine, and have been unlucky enough to try to play any title which has additional 'content protection', you are now running an almost invisible trojan horse on your box that allows virus writers to take over your machine.

Do not bother trying to uninstall it. If you do, it will render your CD drive completely inoperable. Even if you boot in Safe Mode, the trojan will still be there. Still worse, it hides all processes that start with a certain prefix, meaning malware writers can piggyback on top of this if they want.

This is not just theoretical. Fans of the multiplayer online game, World of Warcraft, have used the technique to successfully bypass cheat protection. Clearly Sony believes it can compromise the security of your computer without asking your permission.

The developers of this 'rootkit' are a small company in Banbury, UK. I have some developer friends in that town (yes it is the one of Banbury Cross fame) who I am tempted to ask to ride a cock horse down to their offices and epoxy a key in their front door. Just in case they use their computers for illegal stuff, you know. If you do not have friends in Banbury, you could always not buy from Sony, or not run Windows or both - but I know that is not an option for some.

In case you had not noticed, Internet performance and reliability overall in this country has been quite poor over the past few months. My own ISP (no names, no pack drill) has had its fair share of problems with international connectivity, which I have found crippling, because my mail and DNS servers sit in the US.

To her and the company's credit, my account manager has been completely honest about the reasons why, and has offered a refund for the downtime. But the local problems are not their fault. Whose problem is it? Take a wild guess.

A friend who happens to be an IS customer forwarded me an e-mail from the company last week that explains a lot. IS has been supplementing its peering link to SAIX with international bandwidth for over a year now. If the local peer at Jinx goes down or is overloaded (which has been happening with depressing regularity recently) then IS re-routes local SAIX-bound traffic via its international link.

It is slower, of course, but at least it guarantees that you can see local sites. Then Telkom rejected all inbound traffic to SAIX if it had an IS source address, effectively leaving IS at the mercy of the local peering link, which, as I said, is overloaded and sometimes down. A day later I received a report that customers of another major ISP were experiencing problems connecting to local Web sites because of the peering fiasco. Some local sites were available, some were not.

The knock-on effect was bad: many ISPs are now not switching traffic over to the IS backbone (if I remember correctly, SAIX was asked to upgrade the local peer but wanted a million rands a month for it). On the same day Telkom's share price hit an all-time high of R144. A day later the issue was resolved, but we are not really going to bridge the digital divide like this.

Roll on the redrafted bill, where infrastructure competition and forced leasing of the local loop will, hopefully, prod Telkom into acting more in the interests of all South Africans.

(Charl Bergkamp is an overworked, underpaid systems support engineer in the Lambda Bureau, the ICT department of the Ministry of Boards, Committees and Working Groups. He would love to hear from kindred spirits in the ICT corporate world. Send tip-offs, hints and blatant accusations to charl.bergkamp@gmail.com).