Vulnerabilities / Threats
1/5/2010
05:25 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Web Filtering Company Sues China, PC Makers Over Green Dam

CYBERsitter, LLC, maker of the Internet filtering software of the same name, is seeking $2.2 billion in damages from China, two Chinese software makers and seven PC makers.

Among the factors that led to Chinese government to back away from its plan to require that all PCs sold in the country after July 1, 2009 include Web filtering software known as Green Dam were allegations that the Chinese companies that made the software had copied code from Solid Oak Software's CYBERsitter filtering program.

On Monday, Santa Barbara, Calif.-based CYBERsitter, LLC, which changed its name from Solid Oak Software in November, filed a lawsuit against the People's Republic of China, the two Chinese software makers involved in the creation of Green Dam, and seven computer manufacturers that distributed Green Dam: Sony, Lenovo, Toshiba, Acer, ASUSTeK, BenQ and Haier.

The civil lawsuit seeks $2.2 billion in damages for copyright infringement, theft of trade secrets, unfair competition and civil conspiracy. The company alleges that the defendants distributed over 56 million copies of the Green Dam software.

"This lawsuit aims to strike a blow against the all-too-common practices of foreign software manufacturers and distributors who believe that they can violate the intellectual property rights of small American companies with impunity without being brought to justice in U.S. courts," said attorney Greg Fayer in a statement. "American innovation is the lifeblood of the software industry, and it is vital that the fruits of those labors be protected at home and abroad."

The lawsuit also alleges that CYBERsitter has been hit by several thousand individual cyber attacks as a consequence of its intellectual property rights claims, including one on May 31, 2009, that originated from the Ministry of Health in China.

A spokesperson for the Chinese government was not immediately available. In other hacking incidents that have appeared to have originated in China, Chinese officials have dismissed claims about the government's involvement as fabrications.

In general, it's very difficult to link cyber attacks to specific individuals or organizations without access to their computers due to the ease with which skilled attackers can hijack computing resources and manipulate data trails.

Nonetheless, espionage backed by the Chinese government has been a longstanding concern among U.S. officials and advisory groups. In November 2009, the U.S.-China Economic and Security Review Commission (USCC) said in its 2009 annual report that "there has been a marked increase in cyber intrusions originating in China and targeting U.S. government and defense-related computer systems."

The USCC's 2008 and 2007 reports contained similar warnings.

In June 2009, three computer scientists with the University of Michigan on Thursday published an analysis of the "Green Dam Youth Escort" software. They found that it included security vulnerabilities and that a number of the blacklists "[had] been taken from the American-made filtering program CyberSitter."

After protests from Chinese academics and computer users, rights groups, computer trade groups, and government officials from various countries, the Chinese government backed away from its filtering rule.

In an August 2009 news conference, Minister of Industrial and Information Technology Li Yizhong said that the government's mandate was "not thoughtful enough," according to China Daily, and said the software would be optional.

CYBERsitter has already had success with a previous Green Dam lawsuit. In October, the company sued CBS Interactive's ZDNet China for distributing Green Dam. CBS Interactive settled in December, under confidential terms.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7437
Published: 2015-03-29
Multiple integer overflows in potrace 1.11 allow remote attackers to cause a denial of service (crash) via large dimensions in a BMP image, which triggers a buffer overflow.

CVE-2013-7438
Published: 2015-03-29
Multiple buffer overflows in pbm212030 allow remote attackers to cause a denial of service (crash) or possible execute arbitrary code via a crafted PBM image, related to (1) stream line data, which triggers a heap-based buffer overflow, or (2) vectors related to an "internal intermediate heap-based ...

CVE-2014-5427
Published: 2015-03-29
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to read pa...

CVE-2014-5428
Published: 2015-03-29
Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integratio...

CVE-2014-9205
Published: 2015-03-29
Stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC stable before 8.2.19 and PROMOTIC development before 8.3.2 allows remote attackers to execute arbitrary code by providing a large amount of data.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.