F-Secure confirms rootkits on DVDs

The computer security specialists of F-Secure have confirmed that the Settec Alpha-DISC DVD copy protection system contains rootkit-like cloaking features. This type protection can be found at least of the Mr. & Mrs. Smith -movie German DVD release. The manufacturer is decent enough to provide an uninstaller for the malicious software.

The Settec Alpha-DISC copy protection system used on the DVD contains user-mode rootkit-like features to hide itself. The system will hide its own process, but does not appear to hide any files or registry entries. This makes the feature a bit less dangerous, as anti-virus products will still be able to scan all files on the disk. However, as we note in our article on rootkits, it’s not that uncommon for real malware to only hide their processes.

Our message to software companies producing any software (not just copy protection products) is clear. You should always avoid hiding anything from the user, especially the administrator. It rarely serves the needs of the user, and in many cases it’s very easy to create a security vulnerability this way.

Source: F-Secure