Sony Corp. is up to its old tricks again, hiding software that can be exploited by hackers ina line ofportable USB drives, a Finnish security firm says.
The fingerprint reader software includedwith Sony's MicroVault USM-F line installs a driver in a hidden folder that can be accessed by hackerson the user's computer, according to F-Secure Corp.
Hackers could get into that folder, which is not visible through Windows, and use it to store additional hidden files, F-Secure wrote on its blog.
"There are also ways to run files from this directory," wrote researcher Mika Tolvanen. "It is therefore technically possible for malware to use the hidden directory as a hiding place."
|What is a rootkit?|
|A rootkit is software that hides itself on a computer and which often cannot be easily detected by the operating system or virus-scanning software. Hackers can use the rootkit to hide malicious files on a computer.|
Sony, which has not yet commented on the matter, was embroiled in controversy two years ago when security researchers discovered similar software hidden on its music CDs. The "rootkit" software, which installed itself whenthe CD was played on a computer,was designed to restrict copies being made of the CD tracks, but could also be accessed by hackers.
The U.S. Federal Trade Commission alleged that Sony had broken the law, and settled with the company last year. As well, Sonypaid out nearly $6 million US to settle cases with several states.
Sony also settled three suits in Canada last year. The first,affecting customers in every province except British Columbia and Quebec, was settledlast September. The other two provinces reached settlements later in the year.
The companyfaced massive consumer backlash during the controversy, with many music buyers boycotting Sony CDs.
F-Secure researchers did suggest that Sony had a good reason for hiding the files. The company was likely trying to protect the USB drive's fingerprint authenticator information from being tampered with. However, the files are invisible to some anti-virus detection software.
"We feel that rootkit-like cloaking techniques are not the right way to go here," Tolvanen wrote.
F-Secure said it notified Sony of the problem about a month ago, but did not receive a reply. On Tuesday, researchers with security firm McAfee Inc. confirmed F-Secure's findings.