Sony appears to be putting software onto users' computers that could allow hackers to hide malware from their victims, claimed anti-virus firm F-Secure.
According to the IT security company, Sony's new Microvault USB memory drive software require installation of a hidden directory on a Windows computer so people can use the integrated fingerprint reader.
The reader's software allows users to securely store information about fingerprints on the computer, but F-Secure's researcher Mika Tolvanen said this same hidden directory could allow criminals to use the software as a rootkit to camouflage malicious code. The directory is also invisible to anti-virus applications and so cannot scan the contents of the directory for harmful programs.
"We received a report that our F-Secure DeepGuard HIPS system was warning about a USB stick software driver," said Tolvanen. "The USB stick in question has a built-in fingerprint reader. The case seemed unusual so we ordered a couple of USB sticks with fingerprint authentication."
He said that his team installed the software on a test machine and were quite surprised to see that after installation "our F-Secure BlackLight rootkit detector was reporting hidden files on the system."
Tolvanen said that it was his belief that the MicroVault software hides this folder to somehow protect the fingerprint authentication from tampering and bypass.
"It is obvious that user fingerprints cannot be in a world writable file on the disk when we are talking about secure authentication," he said "We feel that rootkit-like cloaking techniques are not the right way to go here."
He said that his company contacted Sony before deciding to go public with the case, but received no reply. Sony did not immediately respond to request for comment from IT PRO either.
This incident would not be the first time the company has been accused of allegedly installing software that hides files from the operating system. Its music arm, Sony BMG, was forced to pay out $750,000 in penalties and costs and reimburse California consumers whose computers were harmed by anti-piracy software on some CDs sold by the record company.
The agreement between Sony BMG and the attorneys general of Los Angeles County and the state of California led to the settlement of a lawsuit that charged that the company secretly embedded digital rights management software on CDs that potentially opened the door to hackers.
