In the fall of 2005, one of the world’s foremost experts on the inner workings of Windows put a store-bought music CD into his drive — and discovered that the disc had installed spyware on his computer, hiding itself the same way viruses do.
Mark Russinovich was an almost legendary figure in the Windows world. Co-founder of Winternals, creator of the Sysinternals utilities that system administrators around the globe used (and still use) for diagnostics. A man who knew Windows architecture down to the kernel. While testing his own utility, RootkitRevealer — a tool designed to detect hidden components in a system — he saw something unexpected. A driver was hiding on his home computer, intercepting system calls and concealing from the user any files and processes whose names began with the “$sys$” prefix. A classic rootkit technique — malware that disguises its presence by burrowing deep into the operating system.
Russinovich began pulling at the thread. The driver had appeared after he listened to a music CD on his computer, one bought in an ordinary store. The disc had been released by Sony BMG. When it was inserted into the drive, Windows automatically launched an installer — thanks to the autorun mechanism, which in those days was enabled by default and triggered without explicit user consent. The program asked the user to accept a license agreement (EULA), whose text mentioned neither rootkit-like behavior nor the installation of kernel-level drivers. A user who clicked “Agree” received a component running at Windows’ deepest privilege level — and had no standard way to remove it.
Russinovich did not wait around: on October 31, 2005, he published a detailed analysis on his blog. The post became one of the year’s most widely read technical texts. I am still struck by the precision of his work: he did not merely spot an anomaly, but described step by step which system calls the driver intercepted, exactly how filename filtering was implemented at the kernel level, and why attempting to remove the component manually caused the CD drive to fail. That last point deserves its own mention: the driver embedded itself in the drive’s device stack, and removing it broke the request-processing chain.
The technology was called Extended Copy Protection (XCP), and it had been developed by the British company First 4 Internet. Sony BMG licensed it to protect music discs from copying. The basic idea was this: when the CD was inserted into a computer, it installed a special media player that allowed the user to listen to the music but restricted the number of copies they could make — usually to three. To prevent users from bypassing the restriction, the software installed a driver operating in kernel mode — and that driver hid the protection components from the user and from antivirus software.
Technically, XCP intercepted several key Windows system calls responsible for enumerating files and processes. Any object whose name began with “$sys$” became invisible to standard OS tools: File Explorer, Task Manager, and most antivirus programs of the time. The driver loaded at every system startup and ran constantly — whether or not the user was listening to a protected disc.
XCP was installed on approximately 2 million discs, spanning 52 titles in Sony BMG’s catalog. That was only part of the catalog — but a part distributed to stores around the world. A customer buying an album by Neil Diamond or Celine Dion could not tell from the packaging that the disc contained software which would rewrite the behavior of their operating system at the kernel level. A small notice about “content protection” was present, but it disclosed neither the nature of that protection nor the depth of its intrusion into the system.
XCP would have been a scandal on its own — hidden software imposed through a legitimately purchased product. But the story had a second layer, one that turned corporate embarrassment into a full-fledged security threat.
The concealment mechanism implemented by the XCP driver was universal. It hid everything beginning with “$sys$” — without checking whether a file belonged to Sony BMG’s protection system or to something entirely different. In effect, Sony BMG handed malware authors a ready-made invisibility cloak for free. Any Trojan, worm, or spyware program could rename its files with that prefix — and instantly become invisible on millions of computers where the XCP driver had already been installed.
And malware authors did not keep anyone waiting. Within weeks of Russinovich’s publication, malicious programs emerged that deliberately exploited the XCP vulnerability for camouflage. Trojans and worms hid behind the same prefix, taking advantage of the fact that antivirus programs could not see the concealed files. US-CERT (the U.S. Department of Homeland Security division responsible for cybersecurity) issued an official warning, classifying XCP as a threat. When a government body charged with protecting critical infrastructure publishes a bulletin about software installed by a music label — that is territory no corporate lawyer wants to enter.
Put bluntly, Sony BMG created a situation in which buying a legitimate music disc made a computer less secure than downloading the same album from a pirate torrent tracker. The pirate got clean MP3 files. The law-abiding customer got a rootkit.
In the first days after Russinovich’s post, Sony BMG operated in a mode best described as aggressive denial. Thomas Hesse, president of the company’s global digital business, uttered a line on NPR that became a symbol of corporate deafness: “Most people, I think, don’t even know what a rootkit is, so why should they care about it?” An argument of the “if you cannot see the problem, the problem does not exist” variety — applied, ironically, to a technology designed specifically to be invisible.
Under growing pressure from the press, the security community, and US-CERT’s warning, the company began to give ground — but slowly and clumsily. First, Sony BMG released a “patch” that supposedly removed the cloaking function but did not remove the driver itself. Then it offered an uninstaller. And here the story took on a quality that makes you want to laugh and clutch your head at the same time.
To obtain the uninstaller, a user had to go to Sony BMG’s website, fill out a form, provide their email, wait for a reply containing a link, follow it — and install an ActiveX component that performed the removal. ActiveX — a technology tied to Internet Explorer — required the user to allow arbitrary code to run from a web page. Security researchers promptly discovered that the ActiveX component itself contained vulnerabilities: it remained in the system after XCP was removed and could be used by any malicious website to execute arbitrary code on the victim’s computer. The uninstaller meant to patch the hole cut a new one.
On November 15, 2005, Sony BMG finally announced a recall of all affected discs from sale and offered exchanges for versions without DRM protection. Exactly two weeks had passed from Russinovich’s publication to the recall — enough time for malicious software to learn how to exploit the concealment mechanism Sony BMG had provided.
XCP was not the only DRM system Sony BMG embedded in its discs. In parallel, it used MediaMax, a technology developed by SunnComm. MediaMax worked differently: it did not install a rootkit driver or hide files at the kernel level. Its problems were of another kind — it installed components on the hard drive before the user accepted the license agreement, and it had vulnerabilities of its own. But conflating these two cases is a mistake: the technical nature of the threats was fundamentally different.
MediaMax did, however, add enormous scale. While XCP affected 2 million discs, MediaMax was installed on 20 million copies, spanning 50 titles. Taken together, Sony BMG distributed DRM protection with one problem or another on tens of millions of physical media. The two episodes merged into a single crisis that the public remembered simply as “the Sony rootkit” — although, in the strict sense, only XCP was a rootkit.
What surprises me is how much larger the scale of the MediaMax discs was than XCP’s — and how much less attention it received. Apparently, the word “rootkit” has its own gravitational pull in the media space: it draws all attention toward itself, leaving less dramatic but no less real problems in the shadows.
Another layer of the scandal — and one of its most caustic — emerged when researchers looked inside XCP itself. The program intended to protect Sony BMG’s music copyrights contained fragments of code from open-source projects: the LAME encoder, the mpglib library, the FAAC codec, the id3lib tag library, and the VLC media player. All of these projects were distributed under free-software licenses (GPL and LGPL), which required, at a minimum, disclosure of the source code for derivative works and attribution.
Sony BMG — a corporation spending millions to prosecute people who downloaded music — had itself violated the license terms of other people’s software. It took other people’s code, compiled it into a closed commercial product, and distributed it on millions of discs without meeting a single requirement of the licenses. This was not merely hypocrisy — it was a legally significant copyright violation committed in the course of aggressively defending its own copyrights. The symmetry is so perfect it seems made up — but it is documented.
The legal consequences began mounting almost immediately. Class-action lawsuits were filed in several states. Texas Attorney General Greg Abbott sued Sony BMG under the state’s spyware law — one of the first cases in which DRM was legally classified as spyware. The Attorney General of New York also opened an investigation. The Federal Trade Commission (FTC) conducted its own inquiry into the company’s practices.
On January 30, 2007, a settlement was reached following the FTC investigation. Sony BMG agreed to compensate users — up to $150 in damages caused by the uninstaller and by XCP itself. The company also committed not to install software secretly, without the user’s explicit and informed consent. The wording of that commitment sounds so self-evident that the very fact it had to be written into a legal document says a great deal.
Beyond its direct financial losses — compensation, legal costs, the expense of recalling and replacing discs — Sony BMG suffered reputational damage that is difficult to put into numbers but easy to trace through its consequences. The word “rootkit” became permanently attached to the brand in the context of digital security. The case became a textbook example in courses on information security, computer ethics, and corporate law. Whenever a company considers embedding aggressive DRM in its product, someone in the room says “Sony rootkit” — and the conversation changes direction.
The role of Windows autorun/autoplay in this entire story deserves separate examination. In 2005, when a CD was inserted into a drive, Windows automatically ran the autorun.inf file from the disc — without any confirmation from the user. The mechanism was intended for convenience: so installation discs could launch their installers themselves, and music discs could launch a player. In practice, it became an attack vector used both by virus writers and, as it turned out, major record labels.
XCP exploited autorun to display a license agreement (EULA) whose text was opaque. The agreement did not explain that a kernel-level driver with cloaking functions would be installed on the computer. It did not warn that the component could not be removed by ordinary means, or that an attempt at manual removal could disable the CD drive. A user who simply wanted to listen to an album they had bought faced a choice: accept an incomprehensible agreement or be unable to use a product they had already paid for. And if autorun was disabled — which in 2005 was rare among ordinary users — the proprietary player simply would not install, and the disc remained an ordinary audio CD.
After the Sony BMG scandal, the discussion of autorun security reached a new level. Microsoft eventually changed autorun behavior in subsequent versions of Windows, limiting the automatic execution of code from optical media and USB devices. The road to that change took years, but the Sony BMG rootkit was one of the loudest arguments for reform.
The story of XCP matters not as a curiosity, nor as an excuse to gloat at the expense of a large corporation. It matters as a demonstration of the fundamental contradiction embedded in the very idea of aggressive DRM.
Any copy-protection system running on a user’s computer is forced to operate against that user’s interests — restricting their capabilities on their own machine. To be effective, it has to be difficult to remove. To be difficult to remove, it has to hide. To hide, it has to use the same techniques as malware. That chain is unavoidable, and XCP simply followed it to its logical end — to a rootkit in the operating system kernel, installed from a music compact disc.
It seems to me that the most precise formulation of the problem belongs not to lawyers or journalists, but to the logic of what happened itself: a corporation fighting illegal copying used methods indistinguishable from the methods of those it fought — while violating other people’s copyrights by embedding other people’s open-source code in its protection without complying with the licenses. A company demanding that consumers respect intellectual property demonstrated that it did not consider itself obliged to follow comparable rules when they concerned someone else’s work.
After the 2007 settlement, Sony BMG stopped using XCP and MediaMax. The industry as a whole began moving away from DRM on physical media — not so much for ethical reasons as for pragmatic ones: digital distribution through iTunes and, later, streaming services made CD protection pointless. But the precedent remained. It remains relevant every time a hardware manufacturer, game developer, or content provider decides that, in order to protect its product, it is acceptable to secretly install a program on someone else’s computer — one the owner of that computer knows nothing about, and never asked for.