Sony caught playing with rootkits again

The Sony devices feature an integrated fingerprint reader that allows the user to securely store information. Unlocking the information however requires the installation of special software on a Windows computer.

Among things, the application creates a hidden directory on the user's hard drive. At least some anti virus applications will be unable to access and scan the contents of this directory, claimed F-Secure researcher Mika Tolvanen. This potentially allows malware authors to hide their creations from security software.

The technology offers rootkit-like, a term that is used for applications designed to hide files and processes from the end user as well as the system.

Rootkits are best known for their use by malware authors, who use it to prevent detection and removal of their creations by security applications. The term originally referred to tools that allow attackers to gain root access to Unix systems without the owner's knowledge, but has since taken on the meaning of cloaking technologies.

The Microvault case closely resembles a highly publicised security scandal from 2005. Sony at the time used rootkit technology to hide digital rights management software from end users when they tried to play certain audio CDs on a Windows computer. The XCP software, developed by First 4 Internet, was generally considered to be clumsily architected.

Sony initially denied that its technology comprised any security risk, but quickly subsided when malware emerged that exploited the flaw. The firm paid several millions settling lawsuits.

Sony's entertainment division at the time deployed the rootkit technology to prevent users from uninstalling the digital rights management technology, an action that critics charge to be at odds with fair use.

In the case of the Microvault memory keys, F-Secure suggested that the file could be hidden to ensure the accuracy of the data signatures, thereby protecting the data stored on the device.

"We feel that rootkit-like cloaking techniques are not the right way to go here," Tolvanen commented.

F-Secure said that it was unsuccessful in contacting Sony.

Sony didn't immediately respond to request for comment.