Analysis of the Green Dam Censorware System

Scott Wolchok, Randy Yao, and J. Alex Halderman

Computer Science and Engineering Division

The University of Michigan

Revision 2.41 – June 11, 2009

Update: Addendum 1 added June 18, 2009

Summary

We have discovered remotely-exploitable vulnerabilities in Green Dam, the censorship software reportedly mandated by the Chinese government. Any web site a Green Dam user visits can take control of the PC.

According to press reports, China will soon require all PCs sold in the country to include Green Dam. This software monitors web sites visited and other activity on the computer and blocks adult content as well as politically sensitive material.

We examined the Green Dam software and found that it contains serious security vulnerabilities due to programming errors. Once Green Dam is installed, any web site the user visits can exploit these problems to take control of the computer. This could allow malicious sites to steal private data, send spam, or enlist the computer in a botnet. In addition, we found vulnerabilities in the way Green Dam processes blacklist updates that could allow the software makers or others to install malicious code during the update process.

We found these problems with less than 12 hours of testing, and we believe they may be only the tip of the iceberg. Green Dam makes frequent use of unsafe and outdated programming practices that likely introduce numerous other vulnerabilities. Correcting these problems will require extensive changes to the software and careful retesting. In the meantime, we recommend that users protect themselves by uninstalling Green Dam immediately.

Introduction

According to recent news reports (NYT, WSJ), the Chinese government has mandated that, beginning July 1, every PC sold in China must include a censorship program called Green Dam. This software is designed to monitor Internet connections and text typed on the computer. It blocks undesirable or politically sensitive content and optionally reports it to authorities. Green Dam was developed by a company called Jin Hui and is available as a free download. We examined version 3.17.

How Green Dam Works

The Green Dam software filters content by blocking URLs and website images and by monitoring text in other applications. The filtering blacklists include both political and adult content. Some of the blacklists appear to have been copied from American-made filtering software.

Image filter

Green Dam includes computer vision technology used to block online images containing nudity. The image filter reportedly works by flagging images containing large areas of human skin tone, while making an exception for close-ups of faces. We've found that the program contains code libraries and a configuration file from the open-source image recognition software OpenCV.

Text filter

Green Dam scans text entry fields in various applications for blocked words, including obscenities and politically sensitive phrases (for example, references to Falun Gong). Blacklisted terms are contained in three files, encrypted with a simple key-less scrambling operation. We decrypted the contents of these files: xwordl.dat, xwordm.dat, and xwordh.dat. We also found what appears to be a word list for a more sophisticated sentence processing algorithm in the unencrypted file FalunWord.lib. When Green Dam detects these words, the offending program is forcibly closed and an error image (shown above) is displayed.

URL filter

Green Dam filters website URLs using patterns contained in whitelist and blacklist files (*fil.dat, adwapp.dat, and TrustUrl.dat). These files are encrypted with the same keyless scrambling operation as the blacklists for the text filter. Five of the blacklists correspond to the categories in the content filtering section of Green Dam's options dialog (shown below).

We found evidence that a number of these blacklists have been taken from the American-made filtering program CyberSitter. In particular, we found an encrypted configuration file, wfileu.dat, that references these blacklists with download URLs at CyberSitter's site. We also found a setup file, xstring.s2g, that appears to date these blacklists to 2006. Finally, csnews.dat is an encrypted 2004 news bulletin by CyberSitter. We conjecture that this file was accidentally included because it has the same file extension as the filters.

Security Problems

After only one day of testing the Green Dam software, we found two major security vulnerabilities. The first is an error in the way the software processes web sites it monitors. The second is a bug in the way the software installs blacklist updates. Both allow remote parties to execute arbitrary code and take control of the computer.

Web Filtering Vulnerability

Green Dam intercepts Internet traffic and processes it to see whether visited web sites are blacklisted. In order to perform this monitoring, it injects a library called SurfGd.dll into software that uses the socket API. When a user access a web site, this code checks the address against the blacklist and logs the URL.

We discovered programming errors in the code used to process web site requests. The code processes URLs with a fixed-length buffer, and a specially-crafted URL can overrun this buffer and corrupt the execution stack. Any web site the user visits can redirect the browser to a page with a malicious URL and take control of the computer.

We have constructed a demonstration URL that triggers this problem. If you have Green Dam installed, clicking the button on our demonstration attack page will cause your browser (or tab) to crash.

This proof-of-concept shows that we are able to control the execution stack. An actual attacker could exploit this to execute malicious code.

Green Dam's design makes this problem exploitable from almost any web browser. At this time, the surest way for users to protect themselves is to uninstall Green Dam.

Blacklist Update Vulnerability

We found a second problem in the way Green Dam reads its filter files. This problem would allow Green Dam's makers, or a third-party impersonating them, to execute arbitrary code and install malicious software on the user's computer after installing a filter update. Users can enable automatic filter updates from the Green Dam configuration program.

Green Dam reads its filter files using unsafe C string libraries. In places, it uses the fscanf function to read lines from filter files into a fixed-length buffer on the execution stack. This creates classic buffer-overflow vulnerabilities. For example, if a line in the file TrustUrl.dat exceeds a certain fixed length, the buffer will be overrun, corrupting the execution stack and potentially giving the attacker control of the process.

The filter files can be replaced remotely by the software maker if the user has enabled filter updates. The updates could corrupt these vulnerable files to exploit the problems we found. This could allow Green Dam's makers to take control of any computer where the software is installed and automatic filter updates are enabled. Furthermore, updates are delivered via unencrypted HTTP, which could allow a third party to impersonate the update server (for example, by exploiting DNS vulnerabilities) and take control of users' computers using this attack.

Removing Green Dam

Green Dam allows users who know its administrator password to uninstall the software. We tested the uninstaller and found that it appears to effectively remove Green Dam from the computer. However, it fails to remove some log files, so evidence of users' activity remains hidden on the system.

In light of the serious vulnerabilities we outlined above, the surest way for users to protect themselves is to remove the software immediately using its uninstall function.

Conclusion

Our brief testing proves that Green Dam contains very serious security vulnerabilities. Unfortunately, these problems seem to reflect systemic flaws in the code. The software makes extensive use of programming techniques that are known to be unsafe, such as deprecated C string processing functions including sprintf and fscanf. These problems are compounded by the design of the program, which creates a large attack surface: since Green Dam filters and processes all Internet traffic, large parts of its code are exposed to attack.

If Green Dam is deployed in its current form, it will significantly weaken China's computer security. While the flaws we discovered can be quickly patched, correcting all the problems in the Green Dam software will likely require extensive rewriting and thorough testing. This will be difficult to achieve before China's July 1 deadline for deploying Green Dam nationwide.

Additional Screenshot

Addendum 1: Green Dam Quietly Patched; Still Vulnerable — June 18, 2009

Following our initial analysis, the makers of Green Dam have released at least one security update and two filter updates. These updates address the original web filtering security vulnerability we described above, disable certain blacklists that were copied from the CyberSitter program, and bring the software into compliance with the OpenCV license.

Unfortunately, we have discovered an additional remotely-exploitable security vulnerability in the patched version. Even with the updated version installed, any web site a user visits can exploit this problem to take control of the computer. We continue to recommend that users protect themselves by uninstalling Green Dam immediately.

While Green Dam's developers have patched the software quickly, the program's continuing vulnerability suggests that its security problems run deep. We fear that the deeper problems cannot be resolved in time for the July 1 deadline for PC makers to distribute Green Dam on all new PCs sold in China.

Green Dam Security Patch

On June 17, we observed that the Green Dam installer had been updated to correct the web filtering vulnerability that we described in our original report. The update appears to have been released at around 12:00 GMT on June 13. We do not know why the update seems to have been deployed silently; the program is still marked as version 3.17, and we have seen no official announcement of the change. The installer we examined previously is 10,355,637 bytes in size and has the SHA-1 hash 4aaa6cec69b4dfd952eda3512a0b45c1f34a0f7c, and the new installer is 10,200,230 bytes in size and has the SHA-1 hash ee93d0ead4982b53d489b4766d6f96e7618fcd6e. Since these changes do not carry an official version number, we will refer to them as version 3.17a. So far, the new version is only available by downloading a fresh copy of the software from the maker's web site. The changes are not currently being distributed through the software's internal update mechanism.

Green Dam 3.17a has been modified to address several security bugs, including the original demonstration attack we described above. Despite these attempts to make the software secure, we found a new remotely-exploitable vulnerability in the patched program. It took us just over an hour to find this new vulnerability and approximately five hours to develop a demonstration.

New Web Filtering Vulnerability

Green Dam intercepts Internet traffic using a library called SurfGd.dll. Even after the security patch, SurfGd.dll uses a fixed-length buffer to process web site requests, and malicious web sites can still overrun this buffer to take control of execution. The program now checks the lengths of the URL and the individual HTTP request headers, but the sum of the lengths is erroneously allowed to be greater than the size of the buffer. An attacker can compromise the new version by using both a very long URL and a very long "Host" HTTP header. The pre-update version 3.17, which we examined in our original report, is also susceptible to this attack.

We have implemented a second demonstration attack for this new vulnerability. The page includes a Flash applet that sends a malformed HTTP request to our server. Your browser or tab should crash immediately upon loading the demonstration page if you are running Green Dam 3.17 or 3.17a and have Flash installed. While our demonstration only causes a crash, a real malicious web site could exploit this vulnerability to take control of the computer. We continue to recommend that users uninstall Green Dam immediately to protect themselves.

While our demonstration page uses Flash, this vulnerability is not limited to computers with Flash installed. Attacks are also possible using other browser plugins such as SilverLight or Java. Worse, because Green Dam monitors every program that uses the socket API, it will attempt to filter any outgoing message that is structured like an HTTP request, whether or not it actually came from a web browser. Therefore, any program that can be made to send attacker-controlled data over TCP is exposed to both of the web filtering vulnerabilities. We anticipate possible exploits in a variety of networked programs.

We are encouraged that Green Dam's developers have updated the program so quickly. This shows that they take security seriously. Yet even after the recent fix, it is still possible for any web site a Green Dam user visits to exploit other security problems to take control of the computer. As we stated in our original report, the program makes use of insecure programming practices, and there are likely to be more undiscovered problems. Consequently, making Green Dam safe will require substantial changes and careful retesting. It is unlikely that the required changes can be completed in the 12 days remaining before China's July 1 deadline for mandatory distribution of Green Dam with new PCs.

Updates to Blacklists, Whitelists, and Documentation

Green Dam's makers have released two filter updates through the software's internal update mechanism. These updates are not installed automatically by default, but users can apply them by clicking a button in Green Dam's configuration program or enabling automatic updates within the program. Update 3.173 was released on or around June 12, and 3.174 was released on or around June 17.

Changes in 3.173

With the 3.173 update installed, Green Dam no longer appears to employ the blacklist files derived from CyberSitter. Instead, it uses an updated version of the adwapp.dat blacklist. This list does not seem to be based on CyberSitter: it is over 6000 lines long and contains only five lines in common with any of the CyberSitter blacklists.

By examination of the update file (kwupdate.dat), we have established that version 3.173 moved the blacklist files auctfil.dat, bsnlist.dat, and gblfil.dat from C:\Windows\system32 to C:\Windows, and it updated wfile.dat, TrustUrl.dat, and adwapp.dat. The developers added three new entries to adwapp.dat: two pornographic sites and the site cmd5.com, which is currently hosting directions on how to change the Green Dam password back to the default. The updates to wfile.dat disable the CyberSitter blacklists, leaving only the adwapp.dat blacklist active. However, the blacklists copied from CyberSitter continue to be present on the computer following the update, and several of the CyberSitter blacklists are still used in the 3.17a version of Green Dam now being distributed on the maker's web site.

The update also removed 603 entries from TrustUrl.dat, a whitelist of sites that are not subject to filtering. Notable entries on the whitelist include aol.com, ibm.com, download.com, abcnews.com, symantec.com, dell.com, china.com, zdnet.com, *.gov.cn, apple.com, filterdam.com, lssw365.*, doubleclick.net, time.com, nokia.com.cn, amazon.com, ebay.com.cn, icq.com, and tucows.com. Curiously, “lssw365” is whitelisted for all top level domains, exempting them from filtering. This includes the site lssw365.org, a Chinese site dedicated to opposing Green Dam.

Changes in 3.174

The 3.174 update changed the program's help file, kw.chm, and moved that file from C:\Windows to C:\Windows\Help. The update added the license text required for the OpenCV open-source project to Green Dam's help, as shown in the screenshot below:

OpenCV is an open-source computer vision package developed by Intel. Green Dam uses it to try to recognize online images that contain nudity. OpenCV is distributed under a license that allows free commercial and educational use, but requires that programs using it include a copy of the license text. We examined Green Dam and found that it contains code libraries and a configuration file derived from version 1.0rc1 of OpenCV, confirming earlier reports on SourceForge. In particular, we found striking similarities between xcore.dll, Xcv.dll, and Xtool.dll from Green Dam and cxcore099.dll, cv099.dll, highgui099.dll from OpenCV 1.0rc1, respectively. Furthermore, Green Dam's XFimage.xml is identical to haarcascade_frontalface_alt2.xml , except that the license at the top of haarcascade_frontalface_alt2.xml (lines 2-44) is not present in XFimage.xml.

While the 3.174 filter update added the required license, Green Dam's use of OpenCV prior to version 3.174 may be in violation of OpenCV's license. The license still does not appear in the 3.17a version of Green Dam now being distributed on the maker's web site.

Acknowledgments

We wish to thank our colleagues at the University of Michigan who alerted us to Green Dam and assisted with translation.

Contacting the Authors

Please send questions or comments to Professor J. Alex Halderman.

原文地址：http://www.cse.umich.edu/~jhalderm/pub/gd/ （已失效）

原文地址存档：https://web.archive.org/web/20110131043503/http://www.cse.umich.edu/~jhalderm/pub/gd/

机翻如下：

绿坝审查软件系统分析

作者：Scott Wolchok、Randy Yao、J. Alex Halderman  

单位：密歇根大学计算机科学与工程系  

版本：2.41版 – 2009年6月11日  

更新：2009年6月18日添加附录1  

摘要

我们发现了绿坝审查软件中存在可被远程利用的漏洞，据报道该软件由中国政府强制要求安装。任何绿坝用户访问的网站都可以利用这些漏洞控制用户的计算机。

根据新闻报道，中国将要求国内销售的所有个人计算机预装绿坝软件。该软件监控用户访问的网站及其他计算机活动，屏蔽成人内容及政治敏感内容。

我们对绿坝软件进行了分析，发现由于编程错误导致的严重安全漏洞。一旦安装绿坝，用户访问的任何网站都可利用这些漏洞控制计算机。这可能导致恶意网站窃取私人数据、发送垃圾邮件或将计算机纳入僵尸网络。此外，我们还发现绿坝处理黑名单更新的方式存在漏洞，可能允许软件开发商或其他人在更新过程中植入恶意代码。

我们在不到12小时的测试中发现了这些问题，并认为这可能只是冰山一角。绿坝频繁使用不安全且过时的编程实践，可能引入更多漏洞。修复这些问题需要对软件进行大幅修改并重新测试。我们建议用户立即卸载绿坝以保护自身安全。

引言

根据近期新闻报道（《纽约时报》、《华尔街日报》），中国政府要求自7月1日起，国内销售的每台个人计算机必须预装名为“绿坝”的审查软件。该软件用于监控互联网连接和用户输入的文本，屏蔽不良或政治敏感内容，并可选地向当局报告。绿坝由金惠公司开发，可免费下载。我们分析了版本3.17。

绿坝工作原理

绿坝通过过滤URL、网站图片和监控其他应用程序中的文本输入来实现内容审查。过滤黑名单包括政治和成人内容，部分黑名单似乎是从美国制造的过滤软件中复制的。

图片过滤

绿坝使用计算机视觉技术屏蔽含有裸露的在线图片。据报道，其图片过滤器通过检测图像中大面积的人体肤色来工作，但对面部特写图片例外。我们发现绿坝包含了开源图像识别软件 OpenCV 的代码库和配置文件。

文本过滤

绿坝扫描应用程序中的文本输入字段，检查是否包含被禁词语，包括淫秽词汇和政治敏感词（例如法轮功相关内容）。黑名单词语存储在三个文件中（xwordl.dat、xwordm.dat、xwordh.dat），这些文件使用简单的无密钥加密操作进行加密。我们解密了这些文件内容，并发现了一个未加密文件 FalunWord.lib，似乎用于更复杂的句子处理算法。当绿坝检测到被禁词语时，会强制关闭相关程序并显示错误提示图片（如上图）。

URL 过滤

绿坝通过白名单和黑名单文件（*fil.dat、adwapp.dat、TrustUrl.dat）过滤网站URL。这些文件与文本过滤器的黑名单一样，使用无密钥加密操作加密。其中五个黑名单对应绿坝选项对话框中的内容过滤类别（如下图所示）。

我们发现部分黑名单来自美国制造的过滤软件 CyberSitter。特别是，加密配置文件 wfileu.dat 中引用了 CyberSitter 网站上的下载URL。我们还发现了一个设置文件 xstring.s2g，表明这些黑名单可追溯至2006年。此外，csnews.dat 是一个2004年的 CyberSitter 加密新闻公告，可能是因为文件扩展名与过滤器相同而被意外包含。

安全问题

仅测试一天后，我们发现了绿坝软件的两个主要安全漏洞。第一个是软件处理监控网站时的错误，第二个是安装黑名单更新时的漏洞。两者均允许远程方执行任意代码并控制计算机。

网站过滤漏洞

绿坝拦截互联网流量并检查访问的网站是否在黑名单中。为此，它将 SurfGd.dll 库注入使用套接字 API 的软件。当用户访问网站时，该代码检查地址是否在黑名单中并记录URL。

我们发现处理网站请求的代码存在编程错误。该代码使用固定长度缓冲区处理URL，特制超长URL可溢出缓冲区并破坏执行堆栈。用户访问的任何网站都可以通过重定向到包含恶意URL的页面来控制计算机。

我们构建了一个演示URL来触发此问题。如果安装了绿坝，点击我们演示攻击页面上的按钮将导致浏览器（或标签页）崩溃。此概念验证显示我们可以控制执行堆栈。实际攻击者可利用此漏洞执行恶意代码。

绿坝的设计使此问题几乎可在任何浏览器上被利用。目前，用户保护自己的最佳方法是立即卸载绿坝。

黑名单更新漏洞

我们在绿坝读取过滤文件的方式中发现了第二个问题。如果用户启用自动过滤器更新，此问题可能允许绿坝开发商或冒充开发商的第三方在更新后执行任意代码并安装恶意软件。

绿坝使用不安全的 C 字符串库读取过滤文件。例如，它使用 fscanf 函数将过滤文件中的行读入固定长度缓冲区，造成经典的缓冲区溢出漏洞。例如，如果 TrustUrl.dat 文件中的一行超过固定长度，缓冲区将被溢出，破坏执行堆栈，攻击者可能因此控制进程。

如果用户启用了过滤器更新，软件开发商可远程替换过滤文件，触发我们发现的漏洞。这可能使绿坝开发商控制安装了软件并启用自动更新的任何计算机。此外，更新通过未加密的 HTTP 传输，第三方可能通过利用 DNS 漏洞冒充更新服务器，进而通过此攻击控制用户计算机。

卸载绿坝

绿坝允许知道管理员密码的用户卸载软件。我们测试了卸载程序，发现它能有效移除绿坝，但会遗留部分日志文件，因此用户活动记录可能仍隐藏在系统中。

鉴于上述严重漏洞，用户保护自己的最佳方法是立即使用卸载功能移除绿坝。

结论

我们短暂的测试证明绿坝存在非常严重的安全漏洞。不幸的是，这些问题似乎反映了代码中的系统性缺陷。软件广泛使用不安全的编程技术，例如已废弃的 C 字符串处理函数（如 sprintf 和 fscanf）。程序设计使攻击面较大：绿坝过滤并处理所有互联网流量，其大部分代码暴露于攻击之下。

如果绿坝以当前形式部署，将显著削弱中国的计算机安全。虽然我们发现的漏洞可被快速修补，但修复绿坝软件的所有问题需要大幅重写代码并进行彻底测试。这在7月1日全国强制部署绿坝的截止日期前难以实现。

附加截图

附录1：绿坝悄然修补，仍存漏洞 — 2009年6月18日

在我们初步分析后，绿坝开发商至少发布了一个安全更新和两个过滤器更新。这些更新修复了我们描述的原始网站过滤漏洞，禁用了从 CyberSitter 复制的黑名单，并使软件符合 OpenCV 许可证要求。

不幸的是，我们在修补版本中发现了新的可远程利用的安全漏洞。即使安装了更新版本，用户访问的任何网站仍可利用此问题控制计算机。我们继续建议用户立即卸载绿坝以保护自身安全。

虽然绿坝开发商迅速修补了软件，但程序持续存在的漏洞表明其安全问题根深蒂固。我们担心在7月1日截止日期前无法解决这些深层问题。

绿坝安全补丁

6月17日，我们观察到绿坝安装程序已更新，修复了我们原始报告中描述的网站过滤漏洞。更新似乎于6月13日12:00 GMT 左右发布。我们不清楚为何更新悄无声息；程序仍标记为版本3.17，且未见官方公告。此前测试的安装程序大小为 10,355,637 字节，SHA-1 哈希值为 4aaa6cec69b4dfd952eda3512a0b45c1f34a0f7c；新安装程序大小为 10,200,230 字节，SHA-1 哈希值为 ee93d0ead4982b53d489b4766d6f96e7618fcd6e。由于这些变更未携带官方版本号，我们称之为版本3.17a。目前，新版本仅通过开发商网站下载获得，软件内部更新机制尚未分发这些变更。

绿坝3.17a 已修改以修复多个安全漏洞，包括我们描述的原始演示攻击。尽管尝试使软件更安全，我们在修补程序中发现了一个新的可远程利用漏洞。找到此漏洞仅用了一个多小时，开发演示攻击约五小时。

新网站过滤漏洞

绿坝使用 SurfGd.dll 库拦截互联网流量。即使在安全补丁后，SurfGd.dll 仍使用固定长度缓冲区处理网站请求，恶意网站可溢出此缓冲区以控制执行。程序现在检查URL和HTTP请求头各自的长度，但错误地允许总长度超过缓冲区大小。攻击者可通过超长URL和超长的“Host” HTTP头危害新版本。我们原始报告中分析的3.17版也易受此攻击。

我们为新漏洞实现了第二个演示攻击。该页面包含一个发送畸形HTTP请求的 Flash 小程序。如果运行绿坝3.17或3.17a并安装了 Flash，加载演示页面将立即导致浏览器或标签页崩溃。虽然我们的演示仅导致崩溃，真实恶意网站可利用此漏洞控制计算机。我们继续建议用户立即卸载绿坝以保护自身。

虽然我们的演示页面使用 Flash，但此漏洞不限于安装了 Flash 的计算机。其他浏览器插件（如 SilverLight 或 Java）也可能被利用。更糟的是，由于绿坝监控所有使用套接字 API 的程序，它会尝试过滤任何类似 HTTP 请求的传出消息，无论是否来自浏览器。因此，任何可发送攻击者控制的 TCP 数据的程序都可能受这两个网站过滤漏洞的影响。我们预计多种网络程序可能存在类似漏洞。

绿坝开发商的快速更新令人鼓舞，表明他们重视安全问题。然而，即使在近期修复后，用户访问的任何网站仍可利用其他安全问题控制计算机。正如我们原始报告所述，程序使用不安全的编程实践，可能存在更多未发现的问题。因此，使绿坝安全需要大幅修改和仔细重新测试。在距离7月1日截止日期仅剩12天的情况下，完成这些变更不太可能。

黑名单、白名单和文档更新

绿坝开发商通过软件内部更新机制发布了两个过滤器更新。默认情况下，这些更新不会自动安装，但用户可通过配置程序点击按钮或启用自动更新来应用。更新3.173于6月12日左右发布，3.174于6月17日左右发布。

3.173更新

安装3.173更新后，绿坝不再使用源自 CyberSitter 的黑名单文件，改用更新的 adwapp.dat 黑名单。此列表似乎不基于 CyberSitter，包含超过6000行，仅与 CyberSitter 黑名单有五行重叠。

通过检查更新文件（kwupdate.dat），我们确认3.173将黑名单文件 auctfil.dat、bsnlist.dat 和 gblfil.dat 从 C:\Windows\system32 移动到 C:\Windows，并更新了 wfile.dat、TrustUrl.dat 和 adwapp.dat。开发商向 adwapp.dat 添加了三个新条目：两个色情网站和 cmd5.com（该网站当前提供将绿坝密码重置为默认值的指南）。wfile.dat 的更新禁用了 CyberSitter 黑名单，仅保留 adwapp.dat 黑名单有效。然而，来自 CyberSitter 的黑名单在更新后仍存在于计算机上，且3.17a版（开发商网站分发的版本）仍在使用部分 CyberSitter 黑名单。

更新还从 TrustUrl.dat 白名单中删除了 603 个条目。白名单中的显著条目包括 aol.com、ibm.com、download.com、abcnews.com、symantec.com、dell.com、china.com、zdnet.com、*.gov.cn、apple.com、filterdam.com、lssw365.*、doubleclick.net、time.com、nokia.com.cn、amazon.com、ebay.com.cn、icq.com 和 tucows.com。奇怪的是，“lssw365”对所有顶级域名均列入白名单，免于过滤，包括反对绿坝的中文网站 lssw365.org。

3.174更新

3.174更新更改了程序的帮助文件 kw.chm，并将其从 C:\Windows 移动到 C:\Windows\Help。更新为绿坝的帮助文件添加了 OpenCV 开源项目的许可证文本（如下图所示）：

OpenCV 是英特尔开发的开源计算机视觉包，绿坝使用它识别含有裸露的在线图片。OpenCV 在允许免费商业和教育使用的许可证下分发，但要求使用它的程序包含许可证文本副本。我们分析绿坝，发现其包含源自 OpenCV 1.0rc1 的代码库和配置文件。特别是，绿坝的 xcore.dll、Xcv.dll 和 Xtool.dll 与 OpenCV 1.0rc1 的 cxcore099.dll、cv099.dll 和 highgui099.dll 高度相似。此外，绿坝的 XFimage.xml 与 haarcascade_frontalface_alt2.xml 相同，仅缺少后者文件顶部的许可证文本（第2-44行）。

虽然3.174过滤器更新添加了所需许可证，但绿坝在3.174版之前使用 OpenCV 可能违反其许可证。目前，开发商网站分发的3.17a版仍未包含该许可证。

致谢

感谢密歇根大学的同事提醒我们关注绿坝并协助翻译。

联系作者

如有疑问或意见，请联系 J. Alex Halderman 教授。