|
本文通过一路BBS站telnet客户端发布
发信人: ass (Mutated Free Radical), 信区: ITExpress
标 题: PC Magazine:绿坝仍在向美一公司发送升级请求
发信站: 水木社区 (Sat Jun 13 10:54:05 2009), 站内
原文太长,基本就是一家美国公司"Solid Oak Software",发现绿坝和自己的CyberSitter非
常相似,于是进行分析..结果发现绿坝使用了他们2006年编译的的黑名单.并且在绿坝的2进
制文件中发现一份该公司2004发布的加密后的新闻公告..绿坝的一个dll仍然在向该公司的
服务器发送升级请求.
http://www.pcmag.com/article2/0,2817,2348705,00.asp
China's Filtering Software Contains Pirated Code
Does 'Green Dam' steal code from CyberSitter? And what are PC OEMs to do?
06.12.09
The "Green Dam" filtering software that the Chinese government is reportedly
requiring for all PCs sold there contains pirated code, a U.S. software
manufacturer claimed Friday.
Solid Oak Software, the developer of CyberSitter, claims that the look and feel
of the GUI used by Green Dam mimics the style of CyberSitter. But more damning,
chief executive Brian Milburn said, was the fact that the Green Dam code uses
DLLs identified with the CyberSitter name, and even makes calls back to Solid
Oak's servers for updates.
Green Dam is a piece of filtering software that will reportedly be required for
all PCs sold inside China. The software is already available in China, although
the restrictions go into place on July 1, according to The New York Times.
According to a study by the University of Michigan, the Green Dam software
works to identify images, text, and URLs and compares them to a filter, which
blocks the offending work. The researchers took the publicly available software
and reverse-engineered it, using standard methods. Inside, the study's author,
assistant professor of electrical engineering J. Alex Halderman, found evidence
that the software uses blacklists compiled by CyberSitter, dating back to 2006.
An encrypted news bulletin, which dates back to 2004, was also accidentally
included, Halderman wrote.
"We've been talking with them since the report came out yesterday," Halderman
said in an interview.
To Halderman, the Green Dam software presents two fundamental problems: one,
that the software contains vulnerabilities that would allow others to spy on
the activities of those who use it; and second, that it might contain code
stolen from another manufacturer. The Chinese developer of the Green Dam
software appears to have accidentally created the vulnerabilities, Halderman
said, rather than being a deliberate attempt to allow government agencies to
monitor its citizens online.
"If we apply reasoning to this, we would conclude that the government wants a
backdoor it could access, and others could not," Halderman said.
Version 3.17 of the Green Dam software appears to contain both the references
to the blacklists as well as the allegedly stolen code. But the software is
also being frequently updated, and the most recent patch, applied Thursday,
appears to eliminate many of the blacklist references to Solid Oak, Halderman
said.
"I think the bottom line is that the Chinese government is trying to roll out
the software without doing their due diligence," Halderman said. "Clearly,
there needs to be more time to evaluate the software both in terms of legality
and in terms of security before it is rolled out on a widespread basis."
That was small consolation to Solid Oak's Milburn, who said that he had
received an anonymous email sent to a broadcast address at the site Friday
morning alerting the company that Green Dam was using Solid Oak code. He
dismissed it, thinking it was a hoax. But another employee researched it and
found that the allegation was indeed true, and that both URLs and other Solid
Oak code, including DLL files, were part of Green Dam. After doing a bit of
research he found the U. of Michigan paper and contacted Halderman.
"From the stuff they've posted, I'm 100 percent certain they're using our
proprietary code," Milburn said, who said he wasn't certain how much of the
code was reverse-engineered or simply stolen.
"We're still trying to do the detective work here," Milburn said.
At press time, Solid Oak had determined that the filtering engine or parts of
it on lower level had been decompiled, using certain proprietary methods. Solid
Oak doesn't ship a Chinese-language version of CyberSitter. But, Milburn said,
"the words a user sees on the screen are almost identical to ours."
According to Milburn, the company spent Friday trying to determine what its
options were, and what avenues it could pursue to try and prevent its code from
being misused.
According to The New York Times, PC OEMs were blindsided by the Green Dam
requirement, and have tried to figure out how they could add the software to
their production lines just six weeks before the mandate was scheduled to take
place. Dell, Hewlett-Packard, and other OEMs would be required to add the
software to their PC distributions.
But would they if it contributed to software piracy? "To my mind, [shipping
Green Dam] would make the PC manufacturers an accessory after the fact to
software piracy," Milburn said. "I would think that the PC manufacturers wouldn'
t want to do that if I were in their position."
"We haven't had any opportunity to explore our options," Milburn said. "At the
very minimum, I believe we would pursue some sort of injunction."
Theoretically, this could place PC OEMs wishing to do business in China with a
nearly impossible choice: face the threat of an injunction or suits within the
United States, risk angering the Chinese government by removing the Green Dam
software, or halt PC sales into China altogether. Representatives at
Hewlett-Packard and Dell were unable to be reached for comment by press time.
This isn't the first time Solid Oak's code has been stolen, Milburn said. In
the late 1990s, hackers reverse-engineered CyberSitter, which prevents underage
children from accessing pornography or other adult content, to allow users to
access such content.
The hackers, as well as other detractors, have previously accused Solid Oak and
CyberSitter of censoring the Internet. "That's why we don't want to be
associated with it," Milburn said of Green Dam.
Moreover, potentially millions of Chinese PC users could hit Solid Oak's
servers for updates, causing them huge fees for the additional bandwidth costs
the company would be charged for.
One obvious solution to the problem would be to block access to China, a move
that would also cut off a number of American schools in China, including
missionary schools, that use the software as a legitimate means of preventing
children from accessing the adult content. Some organizations with satellite
offices in Singapore, Korea, or other South Asian countries might also be
affected.
"They're using it legitimately, and we don't want to turn off the entire
continent," Milburn said.
--
|
发表于 6-12-2009 20:11:06
收藏
分享
支持
反对