The other option is to choose an alternative browser, such as Firefox or Opera. However, even these browsers are not as safe from attack as they were once considered.

Firefox has been subject to a number of flaws over the past year, including one that could leave its users more vulnerable to phishing scams. Meanwhile, a report published in September by Symantec rated Internet Explorer as safer than Firefox. The report found some 25 flaws in Mozilla’s Firefox internet browser, almost double the number it discovered in IE.

Vulnerabilities in Opera is not mentioned - not here, not elsewhere - and I wonder: Why not? There are vulnerabilities to mention, right? Since it’s mentioned that it’s not as safe from attacks as once considered, I mean. Wouldn’t it be natural to mention at least one, serious vulnerability, like with Firefox?

Just wondered…

The update is more than 3.5 megabytes in size, and it appears to contain new versions of almost all the files included in the initial installation of the entire DRM system, as well as creating some new files. In short, they’re not just taking away the rootkit-like function — they’re almost certainly adding things to the system as well. And once again, they’re not disclosing what they’re doing.

No doubt they’ll ask us to just trust them. I wouldn’t. The companies still assert — falsely — that the original rootkit-like software “does not compromise security” and “[t]here should be no concern” about it. So I wouldn’t put much faith in any claim that the new update is harmless. And the companies claim to have developed “new ways of cloaking files on a hard drive”. So I wouldn’t derive much comfort from carefully worded assertions that they have removed “the … component .. that has been discussed”.

But, there’s more - related to the rootkit, unrelated to the “fix”.

Use the rootkit to cheat other companies

Players of World of Warcraft don’t like the game makers, and the controversial tactics to avoid cheating in the game. (To my limited understanding - I don’t play it myself.) The program ‘Warden’ scans the players’ PCs, to make sure there’s no processes running tohelp cheating in the game.

Sony to the rescue - their rootkit DRM helps War of Worldcraft hackers to fool the Warden. After all, with the DRM rootkit installed, all that is needed to hide a process is to start the filename with $sys$ - right?

Sony has reacted, and posted a service pack/update that removes the cloaking technology. But does it apologise? No - instead it downplays the problems, saying it wasn’t malicious and didn’t compromise security.

Funny. I thought the previous article showed how easy security could be compromised…

Bad move, not to apologise. If Sony doesn’t regret the actions, what can we expect from the company later?

One thing is to try to limit what can be done with the music on the CD, but trying to hide that you’ve installed software, and make it very difficult to uninstall, that’s going too far. Especially as the software in question takes up resources, poses a security risk, and may also be unstable in itself. This sounds too much alike what is commonly known as malware.

Another question that begs to be asked is: Is what Sony has done here legal? Sony may write about this in their EULA, (but it is not certain that they actually do this, even after they updated it after the fact,) but an EULA can’t override laws - not everywhere at least - and may even be known before the product is bought to be valid.

Maybe it’s time for consumers to sue?

A number of recent phishing sites blocked by the Netcraft Toolbar community have had a common technique of using JavaScript to create a narrow popup window, which is then placed on top of the Address bar. A fake URL is entered into the popup, using the same default font as the real address bar. The script continually checks the location of the browser window and moves the popup accordingly, ensuring that it is always placed on top of the Address bar, thus obscuring the real URL of the phishing site.

It might be in its place to remind people that the safest way to avoid trouble with IE, is to use a different browser. (And while there’s a lot of talk about Firefox, personally I find Opera a better choice. In my humble opinion, of course.)