Onderwerp: Caveat Lector: Beastie Boys Evil

Well I truly regret actually purchasing a copy of the new Beastie Boys album
to support them.

It seems that Capitol Records has some sort of new copy protection system,
that automatically, silently, installs "helpful" copy protection software on
MacOS and Windows as soon as you insert the CD into default systems.
I'm not sure exactly what it does yet, but I am sure regreting actually
purchasing said media now... they don't deserve my money if they choose
to pull stupid stunts like this. Installing software without your permission
sounds like viral malware behaviour to me. I certainly hope the AV companies
put signatures into their products for this crap.

They include some sort of uninstaller buried on there for Windows, but
I see no such thing for MacOS. If anyone has disassembled the
aforementioned malware already and can save us some time with
instructions on how to remove it... thanks in advance.

caveat emptor,
--dr

--
World Security Pros. Cutting Edge Training, Tools, and Techniques
Tokyo, Japan Nov 11-12 2004 http://pacsec.jp
pgpkey http://dragos.com/ kyxpgp

FWIW, the Mike D said that he would have preferred that there were no DRM on
the album, but that it's a standard practice for all EMI releases. Check out
this post from BoingBoing:

http://www.boingboing.net/2004/06/11...s_disc_ha.html

(Besides, DRM is standard issue nowadays and quite easy to bypass for the
average bugtraq reader :-)

- Chris Merkel

-----Original Message-----
From: Dragos Ruiu [mailto:dr@kyx.net]
Sent: Wednesday, June 16, 2004 2:10 AM
To: bugtraq@securityfocus.com
Subject: Caveat Lector: Beastie Boys Evil

Well I truly regret actually purchasing a copy of the new Beastie Boys album
to support them.

It seems that Capitol Records has some sort of new copy protection system,
that automatically, silently, installs "helpful" copy protection software on
MacOS and Windows as soon as you insert the CD into default systems.
I'm not sure exactly what it does yet, but I am sure regreting actually
purchasing said media now... they don't deserve my money if they choose to
pull stupid stunts like this. Installing software without your permission
sounds like viral malware behaviour to me. I certainly hope the AV companies
put signatures into their products for this crap.

They include some sort of uninstaller buried on there for Windows, but I see
no such thing for MacOS. If anyone has disassembled the aforementioned
malware already and can save us some time with instructions on how to remove
it... thanks in advance.

caveat emptor,
--dr

--
World Security Pros. Cutting Edge Training, Tools, and Techniques
Tokyo, Japan Nov 11-12 2004 http://pacsec.jp
pgpkey http://dragos.com/ kyxpgp

In-Reply-To: <200406160110.23023.dr@kyx.net>

I had no problem ripping the new album with Exact Audio Copy to WAV files so I can encode it into MP3.

* Dragos Ruiu wrote:

> Well I truly regret actually purchasing a copy of the new Beastie Boys album
> to support them.
>
> It seems that Capitol Records has some sort of new copy protection system,
> that automatically, silently, installs "helpful" copy protection software on
> MacOS and Windows as soon as you insert the CD into default systems.
> I'm not sure exactly what it does yet, but I am sure regreting actually
> purchasing said media now... they don't deserve my money if they choose
> to pull stupid stunts like this. Installing software without your permission
> sounds like viral malware behaviour to me. I certainly hope the AV companies
> put signatures into their products for this crap.
>
> They include some sort of uninstaller buried on there for Windows, but
> I see no such thing for MacOS. If anyone has disassembled the
> aforementioned malware already and can save us some time with
> instructions on how to remove it... thanks in advance.

Did you hold the shift button down to cancel the Autoplay functionality
of Microsoft Windows?

--
(o_
(o_ (o_ //\
(/)_ (/)_ V_/_ shaun.lipscombe@gmsl.co.uk

That could be why it sounds like crap when my X-Box trys to play it...
the audio cuts in an out REAL bad...

I assume you would want to take a peak at beastie.exe if you really
wanted to figure out what they are doing.
-KF


Dragos Ruiu wrote:

>Well I truly regret actually purchasing a copy of the new Beastie Boys album
>to support them.
>
>It seems that Capitol Records has some sort of new copy protection system,
>that automatically, silently, installs "helpful" copy protection software on
>MacOS and Windows as soon as you insert the CD into default systems.
>I'm not sure exactly what it does yet, but I am sure regreting actually
>purchasing said media now... they don't deserve my money if they choose
>to pull stupid stunts like this. Installing software without your permission
>sounds like viral malware behaviour to me. I certainly hope the AV companies
>put signatures into their products for this crap.
>
>They include some sort of uninstaller buried on there for Windows, but
>I see no such thing for MacOS. If anyone has disassembled the
>aforementioned malware already and can save us some time with
>instructions on how to remove it... thanks in advance.
>
>caveat emptor,
>--dr
>
>
>

If I recall, it is possible to disable the offending "bonus" data track by
writing over it with a black marker. This is all in theory, of course.

http://www.wired.com/news/technology...,52665,00.html

Glenn


-----Original Message-----
From: Dragos Ruiu [mailto:dr@kyx.net]
Sent: Wednesday, June 16, 2004 1:10 AM
To: bugtraq@securityfocus.com
Subject: Caveat Lector: Beastie Boys Evil

Well I truly regret actually purchasing a copy of the new Beastie Boys album
to support them.

It seems that Capitol Records has some sort of new copy protection system,
that automatically, silently, installs "helpful" copy protection software on

MacOS and Windows as soon as you insert the CD into default systems.
I'm not sure exactly what it does yet, but I am sure regreting actually
purchasing said media now... they don't deserve my money if they choose
to pull stupid stunts like this. Installing software without your permission
sounds like viral malware behaviour to me. I certainly hope the AV companies
put signatures into their products for this crap.

They include some sort of uninstaller buried on there for Windows, but
I see no such thing for MacOS. If anyone has disassembled the
aforementioned malware already and can save us some time with
instructions on how to remove it... thanks in advance.

caveat emptor,
--dr

--
World Security Pros. Cutting Edge Training, Tools, and Techniques
Tokyo, Japan Nov 11-12 2004 http://pacsec.jp
pgpkey http://dragos.com/ kyxpgp

Assumming we are on a XP Pro box, does anyone know if the exe has the same
effect on Admin, power user, and normal user accounts? or just more
privilaged accounts such as Power users and/or Administrators??

More to the point, does anyone know what it is exactly doing to prevent the
cd from being copyed (the actual exe, not the errors they put on the cd)?
or has anyone monitored any system calls, file access or registray access
the exe makes when it is executed?

I found a few messages with other peopels experiences:
"Some remark about my previous post:
It is actually tedious to specify the start time and the length for each
track, but it definitely works.
Note that before I deactivate the auto-run, Easy AC-DC did not recognise the
CD, it actually did not see there was a CD at all. After the desactivation,
it detects the CD with n + 1 tracks. This is maybe why some of you thought
it didnot work."

and

"Got into the same problem with RHCP Greatest Hits and it turns out that
Easy CD-DA is working well, but:
1) You have to desactivate the auto-start feature on the CD burner.
2) You will see that Easy CD-DA detects that all the tracks are aboiut 10
seconds and the last one is very long.
Ignore the last one, and modify the start date and length of each other
tracks to the proper timing.
Rip the tracks at a low speed (2x). It is long, but it is working."
from http://www.fedge.net/emi/gb.php?action=view

So, I guess it is looking for specific processes and messing with them?
Although I read somwhere last night that it didnt seem to effect copying
with a normal cd rom - only if the device was a burner, so could / is it
messing with atapi function calls?

Reguards,
Philip

----- Original Message -----
From: "KF (lists)" <kf_lists@secnetops.com>
To: "Dragos Ruiu" <dr@kyx.net>
Cc: <bugtraq@securityfocus.com>
Sent: Thursday, June 17, 2004 10:58 AM
Subject: Re: Caveat Lector: Beastie Boys Evil


> That could be why it sounds like crap when my X-Box trys to play it...
> the audio cuts in an out REAL bad...
>
> I assume you would want to take a peak at beastie.exe if you really
> wanted to figure out what they are doing.
> -KF
>
>
> Dragos Ruiu wrote:
>
> >Well I truly regret actually purchasing a copy of the new Beastie Boys
album
> >to support them.
> >
> >It seems that Capitol Records has some sort of new copy protection
system,
> >that automatically, silently, installs "helpful" copy protection software
on
> >MacOS and Windows as soon as you insert the CD into default systems.
> >I'm not sure exactly what it does yet, but I am sure regreting actually
> >purchasing said media now... they don't deserve my money if they choose
> >to pull stupid stunts like this. Installing software without your
permission
> >sounds like viral malware behaviour to me. I certainly hope the AV
companies
> >put signatures into their products for this crap.
> >
> >They include some sort of uninstaller buried on there for Windows, but
> >I see no such thing for MacOS. If anyone has disassembled the
> >aforementioned malware already and can save us some time with
> >instructions on how to remove it... thanks in advance.
> >
> >caveat emptor,
> >--dr
> >
> >
> >
>
>

Typically, when an application is being installed in Mac OS X (assuming
X?), if it requires system file modification it will require an
administrative level password to continue. While it is true that I
haven't purchased said malware, this is the usual case. If this
'helpful drm software' is being installed AND does modify system files
w/o requiring administrative level authorization this would smack of an
exploit against OS X and perhaps should be outed to Apple? Remember the
media that would break CDROM units that Mac users suffered through in
recent memory? DRM, while it's the buzzword du jour, should not
supplant content creators and suppliers due diligence when implementing
their policies. I am, for one, appalled by the manner in which Capitol
has reportedly acted in this respect. Thank-you for bringing this to my
attention.

Regards,

Sean Swayze
swayze AT pcsage DOT biz
On 16-Jun-04, at 4:10 AM, Dragos Ruiu wrote:

> Well I truly regret actually purchasing a copy of the new Beastie Boys
> album
> to support them.
>
> It seems that Capitol Records has some sort of new copy protection
> system,
> that automatically, silently, installs "helpful" copy protection
> software on
> MacOS and Windows as soon as you insert the CD into default systems.
> I'm not sure exactly what it does yet, but I am sure regreting actually
> purchasing said media now... they don't deserve my money if they choose
> to pull stupid stunts like this. Installing software without your
> permission
> sounds like viral malware behaviour to me. I certainly hope the AV
> companies
> put signatures into their products for this crap.
>
> They include some sort of uninstaller buried on there for Windows, but
> I see no such thing for MacOS. If anyone has disassembled the
> aforementioned malware already and can save us some time with
> instructions on how to remove it... thanks in advance.
>
> caveat emptor,
> --dr
>
> --
> World Security Pros. Cutting Edge Training, Tools, and Techniques
> Tokyo, Japan Nov 11-12 2004 http://pacsec.jp
> pgpkey http://dragos.com/ kyxpgp
>
>

Chris Merkel wrote:

> FWIW, the Mike D said that he would have preferred that there were no DRM on
> the album, but that it's a standard practice for all EMI releases. Check out
> this post from BoingBoing:
>
> http://www.boingboing.net/2004/06/11...s_disc_ha.html

An unsubstantiated comment indicates that the DRM is _not_ present in
the US and UK versions of this release.

Does anyone know if the DRM malware used in this case is of the
driver-installer type that can be defeated by holding down the Shift key
when loading a CD into the drive?

I don't know if this applies in this particular case, but I have heard
reports that Philips will not allow DRM-choked releases that don't
comply with the CD standard to display the 'Compact Disc Digital Audio'
logo. This is no guarantee, but a disc with the logo should be less
likely to be hobbled in this way than one without.

A good means to express consumer power is to ask your retailer about
their returns policy in these cases, and to make a return if you
encounter one of these discs.

--rt

> An unsubstantiated comment indicates that the DRM is _not_ present in
> the US and UK versions of this release.
>
> Does anyone know if the DRM malware used in this case is of the
> driver-installer type that can be defeated by holding down the Shift key
> when loading a CD into the drive?
>
> I don't know if this applies in this particular case, but I have heard
> reports that Philips will not allow DRM-choked releases that don't
> comply with the CD standard to display the 'Compact Disc Digital Audio'
> logo. This is no guarantee, but a disc with the logo should be less
> likely to be hobbled in this way than one without.
>
> A good means to express consumer power is to ask your retailer about
> their returns policy in these cases, and to make a return if you
> encounter one of these discs.

I recently bought the new album with Kraftwerk and found (after I recieved
the cd) that it was copyprotected. I couldn't copy it to my MD-player
(digital that is, analog shouldn't be any problem) nor use it in my
computer. I wasn't able to rip it to my harddrive, and the player that is
embedded on the CD didn't work either.

The intresting thing is that this CD didn't carried the 'Compact disc
digital audio'-logo anywhere. And the medium for the audio wasn't called CD
anywhere, not on the disc itself and not in the booklet.

I contacted EMI/Virgin about this and their Swedish department actually
recommended me to return the disc and order it from the UK or USA!
The representative kindly wrote in his e-mail to me that the DRM wasn't in
use in UK or US yet and that I could order it over the Internet...
I returned the CD to the Swedish store I bought it from with a reference to
my e-mail from EMI.

Best regards, Jonas Mixter