Sony CDs continue to cause controversy as an unrelated threat emerges, and black hats are ramping up for the holidays with a new instant messaging worm designed to trick more security-conscious users.

Details

It turns out that the rootkit disaster perpetrated by Sony in an effort to prevent users from actually playing the music on the CDs they purchased wasn't the only threat posed by CDs from Sony. Just when you thought it was safe to play holiday carols over the office network, a new malware threat has surfaced on even more Sony CDs.

The latest threat—caused this time by SunnComm Technologies' anti-copying software—is unrelated to the Sony BMG digital rights management malware, hidden by the company on millions of CDs released in early 2005 and reported by Mark Russinovich in November. But after someone wrote and distributed a worm to take advantage of the First 4 Internet malware discovered in nearly 5 million Sony BMG CDs, the Electronic Frontier Foundation decided to investigate other Sony CDs.

This is a serious threat—it can allow an attacker to gain complete control of a PC that merely played the CD. The new threat apparently only applies to CDs sold in the United States and Canada; Sony has posted a list of titles infected by the SunnComm MediaMax software threat.

While Sony has also posted a patch, I'd be a bit cautious about applying the fix right away. The first patch Sony released turned out to have a bug of its own, according to a Princeton computer science professor's blog. According to the blog post, an interesting aspect of this malware is that it installs "even if you decline the MediaMax license agreement."

Sony has purportedly fixed the patch, but at this point, my advice would be to just say no to playing any Sony CDs in your computer—stick to playing them in your vehicle's sound system!

In other news, that old adage, "A fool and his money are soon parted," has always applied to people who click links in e-mails and instant messages from strangers, but even these users are slowly catching on to the threats. Never ones to rest on their laurels, black hats have been quick to adapt.

A new IM worm, Myspace04, actually sports some built-in responses. Those responses can lull even somewhat cautious individuals into following a tempting link, thereby downloading a tool that disables security software and plants a backdoor on the system.

Now, I have nothing against IM. (OK, actually I do—I think it's stupid to permit IM in most business situations.) However, it can be useful if you're smart about how you manage it.

For example, I have, on occasion, used IM when working with some of my TechRepublic editors, but I've never published my address elsewhere, and I've never had more than two addresses in my approved contact list. Remember: The major threat from IM isn't the software but how people use it.

Finally, just as Hurricane Katrina spawned a flood of malware-loaded e-mails and instant messages, the season for malicious greeting cards is now upon us. Warn your users about this impending threat, but be prepared for a flood of infections just in case.

Final word

I've never understood why most companies refuse to place the proper blame when an employee brings down the corporate network because he or she just had to see a video of a naked teenage actress and clicked a highly suspicious link. When will organizations learn that their network is vital and that the only way to stop people from crashing it—not to mention incurring costs of billions of dollars each year from cleaning up malware—is to publish and enforce severe penalties for such dumb moves?

No sensible management would tolerate employees leaving alarms turned off or doors unlocked over the weekend. However, these same companies fail to appropriately discipline employees who actively invite malware into the network. Is it any wonder we continue to see networks brought to their knees by stupid employee tricks?

The latest Sony debacle shows once again that you can't be too paranoid. A month ago, I personally would have never given a second thought to playing a new brand-name music CD in an office computer—now I wouldn't even duplicate one for personal backup.

And isn't that interesting? Could it be that Sony planned this whole thing just to stop people from making backups of their favorite CDs by scaring them out of even putting CDs in their PCs?

Even those users who only made backups and ignored DRM threats will now be extremely cautious about putting any Sony CD in their PC. Could there be something even more sinister to this story than mere incompetence?

Also watch for…

Miss a column?

Check out the IT Locksmith Archive, and catch up on the most recent editions of John McCormick's column.

Want to stay on top of the latest security updates? Automatically sign up for our free IT Locksmith newsletter, delivered each Tuesday!

John McCormick is a security consultant and well-known author in the field of IT, with more than 17,000 published articles. He has written the IT Locksmith column for TechRepublic for more than four years.