Mr. Kevin M. Clement
President and Chief Executive Officer
MediaMax Technologies, Inc.

Mr. Clement:

As you know, we have already discovered one security concern arising from the MediaMax software, resulting in the patch issued on Tuesday and the revised patch issued yesterday.

The Electronic Frontier Foundation (EFF) remains concerned that additional security flaws will be discovered in MediaMax software, in both version 5 and version 3. EFF isn't alone in this concern. Indeed, as Professor Ed Felten has noted, "Experience teaches that where there is one bug, there are probably others. That's doubly true where the basic design of the product is risky. I'd be surprised if there aren't more security bugs lurking in MediaMax." See http://www.freedom-to-tinker.com/?p=944.

While Sony BMG has taken some steps to address the security vulnerabilities in the MediaMax software, we are very concerned about consumers who purchase "MediaMax'd" CDs from labels other than Sony BMG, such as Cuban Link's "Chain Reaction" by Men of Business Records, Peter Cetera's "You Just Gotta Love Christmas" by Viastar Records or MediaMax'd releases on KOCH Records. Many of these consumers have not been notified of this security issue, and indeed may be unaware that they even have a security vulnerability.

To ensure that all affected consumer received notice of the problem and to reduce the possibility that such problems will re-occur, we urge SunnComm International, Inc. and MediaMax Technology Corp. to promptly:

  1. Publish a list of every CD, regardless of label, that employs the MediaMax technology, including the version.
  2. Provide every other label using MediaMax with information about the vulnerability, and confirm this to EFF.
  3. Work with those labels to quickly and effectively resolve the security vulnerability.
  4. Publicly commit to ensuring that MediaMax software does not install when the user clicks "No."
  5. Publicly commit to including true uninstallers in all versions of MediaMax software.
  6. Publicly commit to providing all future MediaMax software to an independent security testing firm, and to the public release of the results of such test.

We look forward to a prompt response affirming your intent to take the above steps and setting forth a timeline for their completion.

Sincerely,

Kurt Opsahl
Staff Attorney, Electronic Frontier Foundation

Related Issues

DRM

Related Updates

multi-color alien sprites from videogame space invaders
Deeplinks Blog by Rory Mir | January 23, 2024

Fragging: The Subscription Model Comes for Gamers

The video game industry is undergoing the same concerning changes we’ve seen before with film and TV, and it underscores the need for meaningful digital ownership. Twenty years ago you owned DVDs. Ten years ago you probably had a Netflix subscription with a seemingly endless library. Now, you probably have...
Press Release | November 29, 2023

Pseudo-Copyright Rules That Block Fair Uses and Other Speech Violate the First Amendment, EFF Argues in Appellate Brief

WASHINGTON, DC—A 1998 federal law that criminalizes access to digital works for lawful purposes—chilling free expression and impeding scientific research—is unenforceable because it’s too broad and violates the First Amendment, the Electronic Frontier Foundation (EFF) and co-counsel Wilson Sonsini Goodrich & Rosati argued in an appeals...

Wheelchair icon where person fixes their wheelchair
Deeplinks Blog by Cory Doctorow | June 7, 2022

When DRM Comes For Your Wheelchair

Making it easier for people who use powered wheelchairs to get them fixed won’t solve all the other problems with powered wheelchairs: it won’t solve the problem of being forced to use indoor chairs outdoors; it won’t solve the problem of a market concentrated into the hands of two companies...
Deeplinks Blog by Kit Walsh | May 11, 2022

EFF to Court: Fair Use is a Right Congress Cannot Cast Aside

Copyright law and free expression have always been in tension, with the courts protecting speech from overzealous copyright claims using legal doctrines such as fair use. But in 1998, Congress passed the Digital Millennium Copyright Act, and since then courts have interpreted its “anti-circumvention” provision to give rightsholders the unprecedented...