Sony BMG recalls millions of XCP rootkit CDs

Sony BMG backtracking fast over anti-piracy music CDs

16 November 2005 10:29 GMT / By Stuart Miles

Following the backlash from all sectors of the industry Sony BMG has announced that it will recall millions of CDs containing it XCP copy protection software which exposes computers to hackers and viruses.

In a statement on the Sony BMG website the company said:

"You may be aware of the recent attention given to the XCP content protection software included on some SONY BMG CDs. This software was provided to us by a third-party vendor, First4Internet. Discussion has centered on security concerns raised about the use of CDs containing this software.

"We share the concerns of consumers regarding these discs, and we are instituting a program that will allow consumers to exchange any CD with XCP software for the same CD without copy protection. We also have asked our retail partners to remove all unsold CDs with XCP software from their store shelves and inventory. We will make further details of this program available shortly.

"We deeply regret any inconvenience this may cause our customers and we are committed to making this situation right. It is important to note that the issues regarding these discs exist only when they are played on computers, not on conventional, non-computer-based CD and/or DVD players.

"Ultimately, the experience of consumers is our primary concern, and our goal is to help bring our artists' music to as broad an audience as possible. Going forward, we will continue to identify new ways to meet demands for flexibility in how you and other consumers listen to music”.

The XCP software is included on about 50 CDs including artists such The Coral, Celine Dion and Natasha Bedingfield.

Sony maintains that over the past 8 months, it has shipped more than 4.7 million CDs with the XCP software, and over 2.1 million of these have been sold.

The move is expected to cost Sony BMG tens of millions of dollars.

Meanwhile, independent security researcher - Dan Kaminsky, has said that according to his estimates, at least 500,000 computers have installed the Sony BMG software so far.

Sony BMG will also provide software and anti-virus companies with a software update as part of measures to fix the security hole in the software. In addition the company said it will shortly provide a simplified and secure procedure to uninstall the XCP software if it resides on your computer.

Full tags

Software, PC software, Security software, Sony, Audio