Revisiting the Infamous Sony BMG Rootkit Scandal 10 Years Later

Hackers really have had their way with Sony over the past year, taking down its Playstation Network last Christmas Day and creating an international incident by exposing confidential data from Sony Pictures Entertainment in response to The Interview. Some say all this is karmic payback for what’s become known as a seminal moment in malware history: Sony BMG sneaking rootkits into music CDs 10 years ago in the name of digital rights management. ‘In a sense, it was the first thing Sony did that made hackers love to hate them,’ says Bruce Schneier, CTO for Resilient Systems. Sony’s scheme was revealed on Halloween of 2005, and was followed by a botched response, issuing and reissuing of rootkit removal tools, and lawsuits. There are object lessons from the incident which are relevant today.