Sony announced on Tuesday that a new risk had been found with a batch of 27 of its compact discs, which automatically install antipiracy software on hard drives when put into a computer's disc drive. Along with the Electronic Frontier Foundation, a digital rights group, the record label released a patch aimed at fixing that flaw.
However, Princeton computer science professor Ed Felten wrote in his blog on Wednesday that the patch itself could open computers to attack by hackers.
Sony executives said on Thursday that they are working as closely as possible with security professionals to address the issues identified by Felten, and would have a new patch available by midday that day.
"The security space is a dynamic one, as we have learned," said Thomas Hesse, president of Sony's global digital businesses. "Our goal is to be diligent and swift, and we have gone to experts to handle this issue."
Sony's ongoing troubles with copy protection software highlight the delicate line that record labels and other content companies are walking in trying to protect their products from widespread duplication.
On the one hand, labels have watched their revenues decrease over the past several years, as more people swap songs online and burn CDs for friends and acquaintances.
However, the labels' technological attempts to create a copy-protected CD that retains compatibility with millions of old CD players have opened them up to the unfamiliar hazards of software development. Several of Sony's attempts to patch security holes in its antipiracy software over the past weeks have turned out to raise their own new problems, instead of quelling concerns.
The current security flaw in Sony's discs is related to software produced by SunnComm Technologies and affects 27 titles that remain on the market.
It's separate from an earlier vulnerability that affected 52 other titles and that related to antipiracy software written by another company, First 4 Internet. Those titles have been recalled from store shelves.
The flaw found by Felten could allow Sony's original patch to trigger malicious software on a computer, if that software was already in place when the patch was installed.
Microsoft has indicated that it will release a 'fix' for the Sony XCP rootkit discovered last month in its regular monthly updates due Tuesday 13th December.
How may times does Sony have to attempt to foist even more unreliable software on us before people get the message: Avoid Sony products?
When is the product recall of infested CDs in Australia going to get underway? It's already a month late...
This is computer terrorism. If an individual was caught distributing a rootkit, then distributing two or more further exploits within a period of a few weeks, would they be spending Christmas in jail? How come a corporation can get away with it then?
Sony: Something stinks! The stench is not going away.