Sony BMG put rootkits on 22 million music CDs and paid millions in settlements

In 2005, Sony BMG distributed approximately 22 million music CDs containing copy-protection software that used rootkit techniques to hide its files. The software — Extended Copy Protection (XCP) on about 2 million CDs and MediaMax on the remaining 20 million — installed itself on Windows when the CD was played, ran constantly in the background, and reported user listening habits. Winternals researcher Mark Russinovich discovered the rootkit and published his findings on October 31, 2005.

The rootkit created security vulnerabilities that were quickly exploited by malware, worms, and trojans. US-CERT, part of the Department of Homeland Security, issued an advisory calling the software a security threat. Sony BMG initially denied the rootkit was harmful, then released a flawed uninstaller that introduced additional security holes. The company recalled unsold CDs on November 15, 2005, but investigators found affected CDs still on store shelves weeks later.

Texas Attorney General Greg Abbott sued Sony BMG under the state's 2005 spyware law. Additional class-action suits were filed in New York and California, and the Electronic Frontier Foundation pursued its own action. The Federal Trade Commission charged Sony BMG with unfair and deceptive business practices. Sony BMG settled with Texas for $750,000 in legal fees plus up to $150 per damaged computer, and agreed to a class-action settlement providing compensation to affected consumers. The company suspended CD copy-protection in early 2007.