CD anti-piracy firm vows openness

Alicia Keys' Unplugged album is protected with MediaMax

The company behind controversial anti-piracy software installed on some music CDs says it will work to end security flaws found in its products.

SunComm's MediaMax software has been discovered covertly installing itself and can leave PCs vulnerable to attack.

The company has published a list of all CDs that use the software, and has pledged to make it easier for users to refuse installation, or to uninstall.

Sony BMG vowed last December to improve security on its CDs using the program.

The Electronic Frontier Foundation, a digital rights campaign group, has pressured SunComm since MediaMax's behaviour was first exposed.

Copy-protection software is designed to stop people making illegal copies of privately-owned albums.

New promises

Responding to EFF concerns, SunComm says it will now allow users to opt not to install MediaMax software on their machines.

We are pleased to be working with EFF to ensure that consumers are notified of this potential vulnerability Kevin Clement Acting SunComm head

Uninstalling the software will be made easier in new versions of MediaMax.

Previously, users were often unaware that MediaMax had installed on their system. There were also no authorised uninstall options available.

Once installed, the software introduced a vulnerability that malicious hackers could hijack to win control of a machine.

SunComm has now agreed to submit all future versions of MediaMax for independent security testing in an effort to weed out any further vulnerabilities.

Acting SunComm head Kevin Clement said: "We are pleased to be working with EFF to ensure that consumers are notified of this potential vulnerability and our update."

Long list

SunComm's latest moves were prompted by an open letter from the EFF sent on 9 December.

Windows expert Mark Russinovich first uncovered the problem

The developers have also agreed to take steps to inform other CD owners of the potential problems.

The EFF says its concerns were driven by the widespread use of MediaMax on independent music labels not covered by Sony's independent security updates.

Thousands of customers were unaware of the potential implications of using their CDs in home computers, the group said.

In January, SunComm published lists of CDs from a range of record labels copy-protected using MediaMax.

They included high-profile and high-selling artists such as Britney Spears, Alicia Keys and British rock group Kasabian.

Settlement

EFF and Sony BMG had warned in a joint statement on 6 December that users using a CD copy-protected by MediaMax could undermine the security of their machines.

Sony BMG then announced plans to improve security issues on its own CDs.

Nevertheless, the music giant has faced a series of lawsuits from disgruntled music fans over its use of copy-protection.

The row blew up in early November following the discovery that Sony BMG was protecting some of its CDs using a system called XCP.

XCP used virus-like techniques to hide itself deep within system files.

When Sony BMG admitted more widespread use of MediaMax, legal actions from owners of both types of CDs were rolled into one.

A settlement was reached in January, with those affected being promised free downloads, with extra cash for those who used XCP.