Omid Farhang
Table of Contents
Music labels are fighting piracy with software, not just lawyers. Sony BMG and other majors now ship copy-protected CDs that install player software, limit ripping, and sometimes phone home to verify licenses. The packaging rarely explains what happens when you insert the disc into a Windows PC.
That should worry anyone who manages desktops — including your own.
Autorun Is the Real Entry Point
Most of the friction starts with Autorun. Insert a CD, and Windows offers to launch an installer — often a custom media player with DRM components. Users click OK because the dialog looks official and the CD came from a retail shelf, not a download site.
Once that installer runs under an admin account, it can:
- Install drivers and background services
- Modify system behavior to block copying
- Register components that survive reboots
- Resist removal without dedicated uninstall tools
The threat does not always look like a .exe from a stranger. Sometimes it looks like a chart-topping album in a plastic case.
Why “Legitimate” Software Can Be Dangerous
Spyware taught us this in 2003 and 2004: software bundled with something people want — toolbars, smileys, ringtone downloaders — behaves like malware even when a company logo is on the installer.
DRM copy protection follows the same pattern:
- Installs without clear, plain-language consent
- Hides its files and registry entries from casual inspection
- Interferes with other software on the system
- Is difficult to remove cleanly when it causes problems
Security researchers have already documented rootkit-like hiding techniques in copy-protection software from other vendors. The techniques used to “protect” music are the same ones attackers use to stay hidden.
Questions Users Should Ask Before Inserting a CD
- Does the EULA clearly describe what gets installed?
- Can I decline the software and still listen on a regular CD player?
- Does my antivirus flag anything during or after install?
- Is there a documented uninstall procedure?
- Who owns this PC — me or the publisher?
If the answer to the last question is unclear, do not install.
Practical Guidance for IT Staff and Power Users
- Disable Autorun on office machines where policy allows — users can still launch players manually
- Treat all installers as privileged code — music, games, printer drivers, everything
- Hold physical media to the same standard as email attachments
- Back up before installing unknown software — even from shiny retail packaging
- Use Sysinternals tools like Process Explorer and Autoruns when behavior feels wrong after inserting a disc
If a CD demands admin rights to play music, that is a policy conversation, not a personal preference.
The Trust Problem Is Bigger Than One Label
Sony BMG is not the only company pushing DRM onto desktops. The broader trend — from copy-protected CDs to activation-locked games to always-online license checks — treats the user’s machine as hostile territory.
That breaks trust in a way generic virus warnings never could. When a major brand installs hidden software, people stop believing that “official” means “safe.”
Before Clicking OK
We do not yet know how far major labels will push copy protection on Windows. What we know now is enough: security is about trust, and trust is easy to burn.
If you manage PCs for others, explain what Autorun does before someone inserts a protected CD and clicks through the installer on autopilot.