Vulnerabilities / Threats

1/5/2010
05:25 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Web Filtering Company Sues China, PC Makers Over Green Dam

CYBERsitter, LLC, maker of the Internet filtering software of the same name, is seeking $2.2 billion in damages from China, two Chinese software makers and seven PC makers.

Among the factors that led to Chinese government to back away from its plan to require that all PCs sold in the country after July 1, 2009 include Web filtering software known as Green Dam were allegations that the Chinese companies that made the software had copied code from Solid Oak Software's CYBERsitter filtering program.

On Monday, Santa Barbara, Calif.-based CYBERsitter, LLC, which changed its name from Solid Oak Software in November, filed a lawsuit against the People's Republic of China, the two Chinese software makers involved in the creation of Green Dam, and seven computer manufacturers that distributed Green Dam: Sony, Lenovo, Toshiba, Acer, ASUSTeK, BenQ and Haier.

The civil lawsuit seeks $2.2 billion in damages for copyright infringement, theft of trade secrets, unfair competition and civil conspiracy. The company alleges that the defendants distributed over 56 million copies of the Green Dam software.

"This lawsuit aims to strike a blow against the all-too-common practices of foreign software manufacturers and distributors who believe that they can violate the intellectual property rights of small American companies with impunity without being brought to justice in U.S. courts," said attorney Greg Fayer in a statement. "American innovation is the lifeblood of the software industry, and it is vital that the fruits of those labors be protected at home and abroad."

The lawsuit also alleges that CYBERsitter has been hit by several thousand individual cyber attacks as a consequence of its intellectual property rights claims, including one on May 31, 2009, that originated from the Ministry of Health in China.

A spokesperson for the Chinese government was not immediately available. In other hacking incidents that have appeared to have originated in China, Chinese officials have dismissed claims about the government's involvement as fabrications.

In general, it's very difficult to link cyber attacks to specific individuals or organizations without access to their computers due to the ease with which skilled attackers can hijack computing resources and manipulate data trails.

Nonetheless, espionage backed by the Chinese government has been a longstanding concern among U.S. officials and advisory groups. In November 2009, the U.S.-China Economic and Security Review Commission (USCC) said in its 2009 annual report that "there has been a marked increase in cyber intrusions originating in China and targeting U.S. government and defense-related computer systems."

The USCC's 2008 and 2007 reports contained similar warnings.

In June 2009, three computer scientists with the University of Michigan on Thursday published an analysis of the "Green Dam Youth Escort" software. They found that it included security vulnerabilities and that a number of the blacklists "[had] been taken from the American-made filtering program CyberSitter."

After protests from Chinese academics and computer users, rights groups, computer trade groups, and government officials from various countries, the Chinese government backed away from its filtering rule.

In an August 2009 news conference, Minister of Industrial and Information Technology Li Yizhong said that the government's mandate was "not thoughtful enough," according to China Daily, and said the software would be optional.

CYBERsitter has already had success with a previous Green Dam lawsuit. In October, the company sued CBS Interactive's ZDNet China for distributing Green Dam. CBS Interactive settled in December, under confidential terms.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: No, no, no! Have a Unix CRON do the pop-up reminders!
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.