China's Green Dam, No Longer Compulsory, May Have Lifted Code
"Much has been made previously of how China's Green Dam software
must be installed on all new PCs in China, and of more recent revelations that
the software may create exploitable security vulnerabilities or even
provide the Chinese government with a ready-made botnet to use for potentially nefarious purposes. (One of those prior articles even discusses how Green Dam incorporates blacklists from CyberSitter.) Now the BBC is reporting that Solid Oak's CyberSitter software may have had
more than just a compiled blacklist lifted from it. Solid Oak is claiming that
actual pieces of their code somehow ended up in Green Dam. From PC Magazine's article: 'Solid Oak Software, the developer of CyberSitter, claims that the look and feel of the GUI used by Green Dam mimics the style of CyberSitter. But more damning, chief executive Brian Milburn said, was the fact that the Green Dam code uses DLLs identified with the CyberSitter name, and even makes calls back to Solid Oak's servers for updates.'"
Is China Creating the World's Largest Botnet Army?
"The Chinese government is mandating that all computers sold in China come with Internet blocking software. Rob Cottingham writes an excellent
piece noting how the censorship application of this software should be the least of our concerns. This new software may create an opportunity for the Chinese Government to appropriate these computers and use them to create the worlds largest botnet army."
"My students and I have been examining the Green Dam censorware software. We've found serious vulnerabilities that can be exploited by any web site a user visits with the software installed. We also found that some of the blacklists seems to have been taken from the American-made filtering program CyberSitter. We've posted a
report and demo."
Chinese Govt Spyware Puts Computers At Risk
"China's mandatory 'Green Dam Youth Escort' web filter software apparently has a series of severe flaws. In addition to not working on Linux or MacOS,
traffic between the software and its servers is unencrypted."
