丟人丟大了,綠壩盜竊原始碼,被美國公司抗議,China's Filtering Software Contains Pirated Code
Does 'Green Dam' steal code from CyberSitter? And what are PC OEMs to do?
06.12.09
The "Green Dam" filtering software that the Chinese government is reportedly requiring for all PCs sold there contains pirated code, a U.S. software manufacturer claimed Friday.
Solid Oak Software, the developer of CyberSitter, claims that the look and feel of the GUI used by Green Dam mimics the style of CyberSitter. But more damning, chief executive Brian Milburn said, was the fact that the Green Dam code uses DLLs identified with the CyberSitter name, and even makes calls back to Solid Oak's servers for updates.
[@more@]Green Dam is a piece of filtering software that will reportedly be required for all PCs sold inside China. The software is already available in China, although the restrictions go into place on July 1, according to The New York Times.
According to a study by the University of Michigan, the Green Dam software works to identify images, text, and URLs and compares them to a filter, which blocks the offending work. The researchers took the publicly available software and reverse-engineered it, using standard methods. Inside, the study's author, assistant professor of electrical engineering J. Alex Halderman, found evidence that the software uses blacklists compiled by CyberSitter, dating back to 2006. An encrypted news bulletin, which dates back to 2004, was also accidentally included, Halderman wrote.
"We've been talking with them since the report came out yesterday," Halderman said in an interview.
To Halderman, the Green Dam software presents two fundamental problems: one, that the software contains vulnerabilities that would allow others to spy on the activities of those who use it; and second, that it might contain code stolen from another manufacturer. The Chinese developer of the Green Dam software appears to have accidentally created the vulnerabilities, Halderman said, rather than being a deliberate attempt to allow government agencies to monitor its citizens online.
"If we apply reasoning to this, we would conclude that the government wants a backdoor it could access, and others could not," Halderman said.
Version 3.17 of the Green Dam software appears to contain both the references to the blacklists as well as the allegedly stolen code. But the software is also being frequently updated, and the most recent patch, applied Thursday, appears to eliminate many of the blacklist references to Solid Oak, Halderman said.
"I think the bottom line is that the Chinese government is trying to roll out the software without doing their due diligence," Halderman said. "Clearly, there needs to be more time to evaluate the software both in terms of legality and in terms of security before it is rolled out on a widespread basis."
That was small consolation to Solid Oak's Milburn, who said that he had received an anonymous email sent to a broadcast address at the site Friday morning alerting the company that Green Dam was using Solid Oak code. He dismissed it, thinking it was a hoax. But another employee researched it and found that the allegation was indeed true, and that both URLs and other Solid Oak code, including DLL files, were part of Green Dam. After doing a bit of research he found the U. of Michigan paper and contacted Halderman.
"From the stuff they've posted, I'm 100 percent certain they're using our proprietary code," Milburn said, who said he wasn't certain how much of the code was reverse-engineered or simply stolen.
"We're still trying to do the detective work here," Milburn said.
At press time, Solid Oak had determined that the filtering engine or parts of it on lower level had been decompiled, using certain proprietary methods. Solid Oak doesn't ship a Chinese-language version of CyberSitter. But, Milburn said, "the words a user sees on the screen are almost identical to ours."
According to Milburn, the company spent Friday trying to determine what its options were, and what avenues it could pursue to try and prevent its code from being misused.
According to The New York Times, PC OEMs were blindsided by the Green Dam requirement, and have tried to figure out how they could add the software to their production lines just six weeks before the mandate was scheduled to take place. Dell, Hewlett-Packard, and other OEMs would be required to add the software to their PC distributions.
But would they if it contributed to software piracy? "To my mind, [shipping Green Dam] would make the PC manufacturers an accessory after the fact to software piracy," Milburn said. "I would think that the PC manufacturers wouldn't want to do that if I were in their position."
"We haven't had any opportunity to explore our options," Milburn said. "At the very minimum, I believe we would pursue some sort of injunction."
Theoretically, this could place PC OEMs wishing to do business in China with a nearly impossible choice: face the threat of an injunction or suits within the United States, risk angering the Chinese government by removing the Green Dam software, or halt PC sales into China altogether. Representatives at Hewlett-Packard and Dell were unable to be reached for comment by press time.
This isn't the first time Solid Oak's code has been stolen, Milburn said. In the late 1990s, hackers reverse-engineered CyberSitter, which prevents underage children from accessing pornography or other adult content, to allow users to access such content.
The hackers, as well as other detractors, have previously accused Solid Oak and CyberSitter of censoring the Internet. "That's why we don't want to be associated with it," Milburn said of Green Dam.
Moreover, potentially millions of Chinese PC users could hit Solid Oak's servers for updates, causing them huge fees for the additional bandwidth costs the company would be charged for.
One obvious solution to the problem would be to block access to China, a move that would also cut off a number of American schools in China, including missionary schools, that use the software as a legitimate means of preventing children from accessing the adult content. Some organizations with satellite offices in Singapore, Korea, or other South Asian countries might also be affected.
"They're using it legitimately, and we don't want to turn off the entire continent," Milburn said.
來自 “ ITPUB部落格 ” ,連結:http://blog.itpub.net/37724/viewspace-1023074/,如需轉載,請註明出處,否則將追究法律責任。
相關文章
- 美國指責伊朗攻擊大壩,“網路松鼠”暗暗竊喜
- Budget Direct:超過0.5%的美國人遭遇過入室盜竊
- 登登等登 瞪登等登,原生一對一直播交友app原始碼 丟丟丟APP原始碼
- 相容 WebRTC 標準的抗丟包語音編碼器Web
- 遊戲界巨頭EA原始碼被盜竊,駭客以2800萬美元出售資料遊戲原始碼
- 美國癌症協會線上商店感染了信用卡盜竊惡意軟體
- 太丟人了……GitHub 阿波羅11號程式碼倉庫慘遭中文灌水Github
- 美國要在邊境大搞人臉識別,求你千萬別丟資料庫資料庫
- mysql root密碼丟失MySql密碼
- 公司使用盜版SolidWorks被髮函Solid
- 伺服器資料丟失了怎麼恢復/分割槽丟失恢復教程伺服器
- LeetCode:尋找丟失的數字LeetCode
- 密碼是如何被竊取的密碼
- 這個警報器能嚇走歹徒還能跟蹤定位 丟人丟物都不怕
- 公司區域網丟包率高怎麼辦?-VeCloudCloud
- Pew:74%的美國人對大選期間科技公司阻止其平臺被濫用沒有信心
- R星《俠盜獵車手5》的完整原始碼疑似被洩露原始碼
- 9月30日全球網路安全熱點|比特幣網站被劫持、AirTag丟失模式或被用於竊取賬號密碼比特幣網站AI模式密碼
- 士康員工因丟失iPhone被調查跳樓自殺iPhone
- 美國IT公司薪酬大起底
- oracle 更新丟失Oracle
- 在java專案中的mongodb的_id被fastjson轉為json時竟然丟失了JavaMongoDBASTJSON
- [吐槽貼,後刪]程式碼命名、註釋還是請稍微規範一丟丟吧
- iKon智慧追蹤器:再也不怕丟東西了
- [求助]exp時丟失了一個資料檔案?
- 位元組面試:SYN 包在什麼場景下會被丟棄?面試
- Symantec:調查稱半數丟失的智慧手機被找回
- XCode除錯時丟擲異常,定位到某一行程式碼XCode除錯行程
- 可穿戴加密貨幣錢包Trove來了 不再擔心密碼被盜加密密碼
- 數維圖智慧大壩3D視覺化 一屏掌控大壩安全3D視覺化
- 丟人啊,專家們竟然說google的技術不行Go
- Software Code Areas (105)
- 廣播丟資料
- 網路丟包分析
- ASM丟魂記(一)ASM
- AsM丟魂記?(二)ASM
- AsM丟魂記?(三)ASM
- struts中session丟失Session