Vulnerabilities / Threats
1/5/2010
05:25 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Web Filtering Company Sues China, PC Makers Over Green Dam

CYBERsitter, LLC, maker of the Internet filtering software of the same name, is seeking $2.2 billion in damages from China, two Chinese software makers and seven PC makers.

Among the factors that led to Chinese government to back away from its plan to require that all PCs sold in the country after July 1, 2009 include Web filtering software known as Green Dam were allegations that the Chinese companies that made the software had copied code from Solid Oak Software's CYBERsitter filtering program.

On Monday, Santa Barbara, Calif.-based CYBERsitter, LLC, which changed its name from Solid Oak Software in November, filed a lawsuit against the People's Republic of China, the two Chinese software makers involved in the creation of Green Dam, and seven computer manufacturers that distributed Green Dam: Sony, Lenovo, Toshiba, Acer, ASUSTeK, BenQ and Haier.

The civil lawsuit seeks $2.2 billion in damages for copyright infringement, theft of trade secrets, unfair competition and civil conspiracy. The company alleges that the defendants distributed over 56 million copies of the Green Dam software.

"This lawsuit aims to strike a blow against the all-too-common practices of foreign software manufacturers and distributors who believe that they can violate the intellectual property rights of small American companies with impunity without being brought to justice in U.S. courts," said attorney Greg Fayer in a statement. "American innovation is the lifeblood of the software industry, and it is vital that the fruits of those labors be protected at home and abroad."

The lawsuit also alleges that CYBERsitter has been hit by several thousand individual cyber attacks as a consequence of its intellectual property rights claims, including one on May 31, 2009, that originated from the Ministry of Health in China.

A spokesperson for the Chinese government was not immediately available. In other hacking incidents that have appeared to have originated in China, Chinese officials have dismissed claims about the government's involvement as fabrications.

In general, it's very difficult to link cyber attacks to specific individuals or organizations without access to their computers due to the ease with which skilled attackers can hijack computing resources and manipulate data trails.

Nonetheless, espionage backed by the Chinese government has been a longstanding concern among U.S. officials and advisory groups. In November 2009, the U.S.-China Economic and Security Review Commission (USCC) said in its 2009 annual report that "there has been a marked increase in cyber intrusions originating in China and targeting U.S. government and defense-related computer systems."

The USCC's 2008 and 2007 reports contained similar warnings.

In June 2009, three computer scientists with the University of Michigan on Thursday published an analysis of the "Green Dam Youth Escort" software. They found that it included security vulnerabilities and that a number of the blacklists "[had] been taken from the American-made filtering program CyberSitter."

After protests from Chinese academics and computer users, rights groups, computer trade groups, and government officials from various countries, the Chinese government backed away from its filtering rule.

In an August 2009 news conference, Minister of Industrial and Information Technology Li Yizhong said that the government's mandate was "not thoughtful enough," according to China Daily, and said the software would be optional.

CYBERsitter has already had success with a previous Green Dam lawsuit. In October, the company sued CBS Interactive's ZDNet China for distributing Green Dam. CBS Interactive settled in December, under confidential terms.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2004-2771
Published: 2014-12-24
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

CVE-2014-3569
Published: 2014-12-24
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshak...

CVE-2014-4322
Published: 2014-12-24
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or c...

CVE-2014-6132
Published: 2014-12-24
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML vi...

CVE-2014-6153
Published: 2014-12-24
The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.