Road Paved for the Great Botnet of China

One of the security industry's worst nightmares, a gigantic botnet of Chinese origin, might become a reality if the government in Beijing goes ahead with its plan to deploy the Green Dam Youth Escort censorship software on all new PCs sold in the country, starting next month. Security researchers warn that the content-filtering application suffers from critical design flaws, which can allow attackers to take control of computers.

The Green Dam Youth Escort is part of the Chinese government's efforts to control what its citizens can access over the Internet, and serves as an extension to the already functioning nation-wide firewall, informally referred to as the Great Firewall of China. The application is able to filter adult explicit material or politically sensitive content by blocking URLs and images specified in several blacklists. It can also be used to monitor text in other programs installed on the computer.

"After only one day of testing the Green Dam software, we found two major security vulnerabilities. The first is an error in the way the software processes web sites it monitors. The second is a bug in the way the software installs blacklist updates. Both allow remote parties to execute arbitrary code and take control of the computer," announce computer experts from the University of Michigan.

Furthermore, resolving these two issues would be of little effect to the overall security of the application. Large portions of the code are unsafe by design, since the developers made extensive use of deprecated C string processing functions such as sprintf and fscanf. "While the flaws we discovered can be quickly patched, correcting all the problems in the Green Dam software will likely require extensive rewriting and thorough testing," the researchers warn.

China is already a big source of attack traffic and because of the cultural barrier attempts to shutdown abusive servers hosted in the country have most of the time proven futile. Under such conditions, the prospect of a huge Chinese botnet is frightening, as the threat would be very hard to contain or mitigate.