Despite being burned in 2005 by scandal with Sony music CDs installing an exploitable “cloaked” directory on consumers’ PCs, another arm of the company has been hit by a similar problem. In particular, purchasers of Sony MicroVault USM-F flash drives (with built-in fingerprint reader) apparently get a hidden directory that can be used to hide malware.
According to F-Secure, the fingerprint-reader software included with the Sony MicroVault USM-F line of flash drives installs a driver that hides in a hidden directory under “c:\windows”. That directory and the files within it are not visible through Windows’ usual APIs, said F-Secure researcher Mika Tolvanen in a posting to the company’s blog Monday.
“[But] if you know the name of the directory, it is possible to enter the hidden directory using [the] Command Prompt, and it is possible to create new hidden files,” said Tolvanen. “There are also ways to run files from this directory.”
All of this — and the fact that the directory goes unspotted by some anti-virus scanners — is similar to the Sony BMG rootkit case in late 2005. Then, researchers spotted rootkit-like cloaking technologies used by the copy-protection software Sony BMG Music Entertainment installed on PCs when customers played the label’s audio CDs. The Federal Trade Commission (FTC) alleged that Sony had violated federal law and settled with the company earlier this year. Before that, Sony paid out nearly $6 million to settle cases with U.S. states.
In this case, the purpose isn’t copy protection, but to hide some sensitive fingerprint reader authentication files. Unfortunately anyone, including malware authors, who knows the directory name can stash files there which is exactly what happened with the music copy protection software. No exploits of the MicroVault USM-F drives have yet been reported, but it seems wise to avoid them until Sony gets its act together.