Security experts warn of Sony 'hidden files'

Summary:The fingerprint-recognition software packaged with Sony's Microvault USB could be used by malware to compromise users' PCs

Security specialists are warning that Sony's MicroVault USB, which is a biometric USB storage device, cloaks driver software in a Windows directory that could be used by malware to avoid detection from security applications.

The manner of installing and hiding software on users' PCs is reminiscent of Sony BMG's attempt two years ago to protect music copyright by installing rootkit software.

The fingerprint-recognition software packaged with Sony's Microvault USB installs itself as hidden files on the user's system under the "c:\windows\" directory.

F-Secure security expert, Mika Tolvanen, reported that it is possible to enter the hidden directory using a Command Prompt and from there create and run new hidden files.

"Files in this directory are also hidden from some antivirus scanners — as with the Sony BMG DRM case — depending on the techniques employed by the antivirus software. It is therefore technically possible for malware to use the directory as a hiding place," said Tolvanen on the F-Secure blog.

Tolvenan believes Sony's intention was to protect the fingerprint authentication software from tampering but he disagrees with employing "rootkit-like cloaking techniques" to do so.

Sony BMG was heavily criticised in 2005 by analysts and vendors for hiding files on users' systems that left PCs vulnerable to hackers.

At the time, Symantec's senior director, Vincent Weafer said: "We're trying to reinforce here that we're not talking about a virus, or malicious code, we're talking about technology that could be misused."

To put a halt to various US state-based investigations into its use of rootkits to protect copyright, Sony BMG forked out $6m (£3m).

F-Secure's Tolvanen said of Sony BMG's use of rootkit software: "It is unclear if the 'rise of the rootkit' would have happened in this magnitude without the publicity of the Sony BMG case. In any case, a lot more people now know what a 'rootkit' is than back then."

Topics: Security


Liam Tung is an Australian business technology journalist living a few too many Swedish miles north of Stockholm for his liking. He gained a bachelors degree in economics and arts (cultural studies) at Sydney's Macquarie University, but hacked (without Norse or malicious code for that matter) his way into a career as an enterprise tech, s... Full Bio

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.