Page 6

option. Installing software without first obtaining the user's consent appears to be illegal in the U.S. under
the Computer Fraud and Abuse Act (CFAA) as well as various state anti-spyware laws [2, 3].

Software vendors conventionally obtain the user's consent to the installation of their software by dis-

playing an End User License Agreement (EULA) and asking the user to accept it. Only after the user agrees
to the EULA is the software installed. The EULA informs the user, in theory at least, of the general scope
and purpose of the software being installed, and the user has the option to withhold consent by declining the
EULA, in which case no software is installed. As we will see below, the DRM vendors do not always follow
this procedure.

If the discs didn't use any other protection measures, the music would be vulnerable to copying while the

installer waited for the user to accept or reject the EULA. Users could just ignore the installer's EULA win-
dow and switch tasks to a CD ripping or copying application. Both XCP and MediaMax employ temporary
protection mechanisms to protect the music during this time.

4.2.1

XCP Temporary Protection

The first time an XCP-protected disc is inserted into a Windows machine, the Windows autorun feature

launches the XCP installer, the file

go.exe

located in the

contents

folder on the CD. The installer

displays a license agreement and prompts the user to accept or decline it. If the user accepts the agreement,
the installer installs the XCP active protection software onto the machine; if the user declines, the installer
exits after ejecting the CD, preventing other applications from ripping or copying it.

While the EULA is being displayed, the

XCP installer continuously monitors the list of

processes running on the system. It compares
the image name of each process to a blacklist
of nearly 200 ripping and copying applications
hard coded into the

go.exe

program. If one

or more blacklisted applications are running,
the installer replaces the EULA display with
a warning (shown at right) indicating that the
applications need to be closed in order for the
installation to continue. It also initiates a 30-
second countdown timer; if any of the appli-
cations are still running when the countdown
reaches zero, the installer ejects the CD and
quits.

This technique might prevent some unso-

phisticated users from copying the disc while
the installer is running, but it can be bypassed with a number of widely known techniques. For instance,
users might kill the installer process (using the Windows Task Manager) before it can eject the CD, or they
might use a ripping or copying application that locks the CD tray, preventing the installer from ejecting the
disc.

The greatest limitation of the XCP temporary protection system is the blacklist. Users might find ripping

or copying applications that are not on the list, or they might use a blacklisted application but rename its
executable file to prevent the installer from recognizing it. Since there is no mechanism for updating the
blacklist on existing CDs, they will gradually become easier to rip and copy as new applications not on the

Similar application blacklisting techniques have been used in other security contexts. The client software for World of Warcraft,

a massively multiplayer online role playing game, checks running applications against a regularly updated blacklist of programs
used to cheat in the game [15].