Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security IT

Cisco Confirms Arrest In Theft Of Its Code 113

Posted by Zonk from the crackdown-on-black-hats dept.
spafbnerf writes "Informationweek is reporting on Cisco Systems' confirmation of an arrest in connection with the theft of its IOS 12.3 source code last year. On Tuesday, The New York Times reported that federal officials and security experts have acknowledged that the theft of the Cisco source code was part of a wider pattern of thousands of attacks on military and research computers perpetrated by an unknown number of individuals." From the article: "The FBI fully recognizes the inherent sophistication and global nature of intrusion investigations...As such, we have worked hard to develop strong partnerships within the international law-enforcement community. In this case, we have been working closely with our international partners to include Sweden, Great Britain, and others. As a result of recent actions, the criminal activity appears to have stopped."
This discussion has been archived. No new comments can be posted.

Cisco Confirms Arrest In Theft Of Its Code More

Cisco Confirms Arrest In Theft Of Its Code

Comments Filter:

  • I can confirm this (Score:3, Funny)

    by kote-men-do ( 881870 ) on Thursday May 12, 2005 @10:01AM (#12509267)
    The parents of the teenager in question have taken all his pokémon games.

  • do they believe it themselves? (Score:5, Interesting)

    by nietsch ( 112711 ) on Thursday May 12, 2005 @10:02AM (#12509269) Homepage Journal
    As a result of recent actions, the criminal activity appears to have stopped.


    I read that as: "As a result, the criminals have realised they were being watched and have cleaned up their act, and have made sure they are not noticed by 'them' anymore.

    Now on to the FA.

  • Appears to have stopped - for now! (Score:4, Insightful)

    by PacketScan ( 797299 ) on Thursday May 12, 2005 @10:02AM (#12509271)
    They. Who ever they are, will be back if indeed it's more than a few people. When it comes down to it nothing is secure. There is always going to be a way for the smart/crafty to cercumvent anything put in place.
    Then again we could just write rock solid code. but that apparently is cost prohibitive.
    • So... now the bad guys enjoy the code they can read in peace, and look for security holes to their heart's content. They face just a small bunch of overworked developers and very little review.

      On the other appendage, a vintage PC in my basement churns packets on its cozy shelf, with an OS that has seen continuous attention of millions of developers...

      Face it, the bad guys _will_ have guns. No laws or copyrights can stop them. By obstructing the access you limit the amount of kids but do nothing against
    • Comment removed based on user account deletion

  • Over-confident (Score:5, Funny)

    by dbleoslow ( 650429 ) on Thursday May 12, 2005 @10:03AM (#12509280)
    "As a result of recent actions, the criminal activity appears to have stopped."

    Thanks to the bear patrol recently put in place in my neighborhood, all bear-related activity appears to have stopped.

  • "appears to have stopped"... (Score:4, Funny)

    by SharpFang ( 651121 ) on Thursday May 12, 2005 @10:03AM (#12509289) Homepage Journal
    lol omfg idiots bought it!!!
    Yeah. Stay put for 2 months more. And just in case you have something urgent, tunnel through Luser832, I have planted enough "evidence" on his PC to keep him in prison for 50 years.
  • Maybe the thief could have made IOS more stable and secure. I'm beginning to think anyone could do a better job...
    • Thats why I have a Linksys wifi router. It works as good as everything else and has the nifty little cisco brand on it to make it look expensive and impressive.

    • Re:Too bad... (Score:5, Funny)

      by EvilTwinSkippy ( 112490 ) <yoda AT etoyoc DOT com> on Thursday May 12, 2005 @10:22AM (#12509474) Homepage Journal
      I have found Cisco routers to be remarkably stable.

      We have a 7100 series that I use as a step-ladder to access stuff on a top shelf. It has never teetered or shifted.

      • How can you not be stable when the entire vlan standard is practically locked by cisco. They can QA the hell out of it. It's all their code.

        • Cisco's proprietary vlan trunking standard is ISL, which they seem to have abandoned. Newer switches now support 802.1Q, which is an open standard that works with Linux and MS Windows.

          • Re:Too bad... (Score:1, Informative)

            by Anonymous Coward
            Link to 802.1Q std [ieee.org](just in case people thing only the RFC's are available free). Oh - if anyone actually intends reading it, take a *LOT* of V or Red Bull or whatever passes for caffiene in your neighbourhood
      • We have a 7100 series that I use as a step-ladder to access stuff on a top shelf. It has never teetered or shifted.

        And if it does start to teeter one day, you can fix it since you have the source now!

        Or something like that.
      • Oh dood, those were crap. I have 2 7120's that holding up the end of my table right now, $30k worth of routers...even Cisco can't get them to do what a Linksys can do now....

  • Comment removed (Score:3, Funny)

    by account_deleted ( 4530225 ) on Thursday May 12, 2005 @10:06AM (#12509319)
    Comment removed based on user account deletion

  • Theft? (Score:4, Funny)

    by Anonymous Coward on Thursday May 12, 2005 @10:07AM (#12509331)
    More like "liberation".

    Information wants to be free.

  • Appearances are deceiving (Score:3, Funny)

    by digitaldc ( 879047 ) on Thursday May 12, 2005 @10:07AM (#12509332)
    "As a result of recent actions, the criminal activity appears to have stopped."

    Wow, that statement really made me feel better.

  • The fact that every report says "since the arrest, the intrusions have stopped" ought to tell us something...

    • The fact that every report says "since the arrest, the intrusions have stopped" ought to tell us something...

      Mainly that the folks who are behind the break ins read the same news articles we do.

    • Re:Light on evidence? (Score:3, Insightful)

      by Veinor ( 871770 )
      Or maybe they're not really bothering to verify it, but instead quoting each other, since if one of them says it, it must be true!
  • As such, we have worked hard to develop strong partnerships within the international law-enforcement community.

    Had Bush known that this was occurring, he would have stepped in and stopped this attack on US sovereignty.

    We all know that the US will always choose the unilateralist role in defeating enemies of the State.

    (chill... It is a joke.)
  • Eurasia is now at peace with Oceania, and the harvests of grain improved 20% compared to last year ;)

  • Phew! (Score:5, Funny)

    by Dirtside ( 91468 ) on Thursday May 12, 2005 @10:18AM (#12509433) Journal
    Thank goodness Cisco finally got its source code back! Now the source code is safe and sound, never to be seen again by anyone outside Cisco.

    • Re:Phew! (Score:2, Insightful)

      by noidentity ( 188756 )
      Thank goodness Cisco finally got its source code back! Now the source code is safe and sound, never to be seen again by anyone outside Cisco.

      At least they can continue development on it. It must have been costly to have to put development on hold while the source code was missing.

      Or maybe the code wasn't stolen, rather copied.

  • torrent? (Score:2, Funny)

    by Anonymous Coward
    Anyone got a torrent?
  • You mean it wasn't Habib Marwan and his terrorist cell that stole the IOS code to reverse engineer it into a software chipset that could be used to simultaneously override a nuclear powerplant and a nuclear warhead! Man I was way off.

  • The suspect (Score:5, Funny)

    by LarsWestergren ( 9033 ) on Thursday May 12, 2005 @10:23AM (#12509488) Homepage Journal
    The suspect is a 16 year old boy from Uppsala, Sweden, my hometown. I bet he doesn't feel as clever now as he used to. :-)

    I look forward to Maureen O'Gara's next scoop though: "He came from Uppsala, the headquarter of famous open source company mySQL AB! Also the place where Vikings once slaughtered Christians in pagan rituals! All a coincidence? I think not!!"
    • Contriwise, I bet he feels that the FBI is more clever now than he used to.
  • Since I bitch-slapped a hacker trying to break into my system I have not seen another one trying. All that activity must have stopped as well. Wow...I suddenly feel all is right with the world

  • Firewall? (Score:5, Funny)

    by nogginthenog ( 582552 ) on Thursday May 12, 2005 @10:27AM (#12509522)
    Looks like they could do with a decent firewall to keep out intruders. Can anyone recommend a good one?

    • Re:Firewall? (Score:2, Funny)

      by Anonymous Coward
      I hear Cisco is pretty good....

      Oh Wait...
    • Dude. Don't you know they just route the firewall and then hack your proxy? A firewall isn't gonna do anything for you. It's the self-defending network you gotta have.
    • Just dont use that abortiong of hardware called a PIX. A bigger peice of shit I have not seen in a while.

  • Swedish reporting: (Score:1, Informative)

    by Anonymous Coward
    Apparently the villain was a 16-year old kid.
    http://www.dn.se/DNet/jsp/polopoly.jsp?d=678&a=413 232 [www.dn.se]

  • Decentralized Networking... (Score:4, Insightful)

    by Anonymous Coward on Thursday May 12, 2005 @10:32AM (#12509558)
    The more and more I hear about these types of hacks, attacks, and thefts, it makes me wonder why many big companies still choose to remain 'online.'

    We all know that the internet can be a very dangerous place, so why would any company in their right mind choose to have computers with potentially sensitive source code or database information remaining on a publicly facing network?!

    Very few machines in a given development or database office should have Internet access, and these machines should not be directly connected to the rest of the company. The reason you spend all of that cash on networking equipment is for private closed intranets, it's not to get you online!

    Plugging into the internet is just like going public, no matter how many basements with feline guards at the doors you have in place, you can never be 100% secure.
    • Cisco likes to test it's equipment within Cisco in real business world scenarios, unfourtunately if it breaks then it's Cisco that has it own stuff stolen which means other Cisco systems could be compromised. It's brilliant in concept but it can be very lacking in execution.
    • why would any company in their right mind

      By definition, no company in their right mind would do such a thing.

      I applied for a system administration job at a local hospital. During the interview, my would-be boss showed me their network diagram which looked something like:

      Internet | patient data

      After I picked my jaw back up off the floor, I asked what the vertical line represented. "That's our firewall!," he beamed. And what kind? "It's Gauntlet running on Windows NT."

      I didn't get the job

  • They should have used open source, you don't get arrested for stealing open source code, right?

  • Don't they WANT it secure? (Score:5, Interesting)

    by mreed911 ( 794582 ) on Thursday May 12, 2005 @10:49AM (#12509718)
    From TFA: "The stolen code was a portion of Cisco's Internetworking Operating System version 12.3. The incident has been a matter of concern because malicious hackers might find flaws in the code that could be exploited to impair the functioning of Cisco's routers."

    Translation: We don't have time to QA this code, so we'd rather not have anyone do it themselves, either, then hack us with the holes we neglected to look for in the first place.

    Ugh. Sometimes I wonder if there ought to be an open-source REQUIREMENT in RFP's to vendors. Hell, code availability has HELPED Linksys (who's also Cisco!) - folks have "hacked" it to make it MORE robust, but you don't see any greater number of "hacks" for Linksys products than you do for anyone else...

    Maybe Cisco ought to focus on the security BASICS (it's still easiest to get into some else's network because they never changed the default password than it is to script-kid some mutated hack into working) rather than worrying that "outsiders" might actually harden their products FOR them...

    • Cisco has to be finding itself in a rather uncomfortable situation. After all, Open Source is insecure by nature due to the availablity of code to malicious eyes... right? It is according to the Alexis de Tocqueville Institution. Couple that claim without the counter "many eyes" claim... and it wouldn't be suprising if Cisco's been flooded with anxious calls from various IT managers.

      Whether the concern is legitimate or not is a different issue.

    • Re:Don't they WANT it secure? (Score:2, Interesting)

      by Anonymous Coward
      Do you have any idea what it's like to maintain a codebase for something as enormous and complex as IOS?

      I'm really growing tired of people blindly presenting the position that EVERYTHING would be better open-source.

      Look at the number of security vulnerabilities over the last 5 years for the Linux kernel. Now look at the vulnerabilities over the same 5 years for Cisco IOS.

      Simply having something opensource does not imply that the end result will be more secure. And the prospect of having something like IO

    • Yes: and that's why they arrested the boy (Score:2, Interesting)

      by Anonymous Coward
      From TFA: "The stolen code was a portion of Cisco's Internetworking Operating System version 12.3. The incident has been a matter of concern because malicious hackers might find flaws in the code that could be exploited to impair the functioning of Cisco's routers."

      Translation: We don't have time to QA this code, so we'd rather not have anyone do it themselves, either, then hack us with the holes we neglected to look for in the first place.

      Well, if security isn't a concern in our daily lives; why should

      • If someone steals a master key from GM, he goes to jail; he isn't charge just with petty theft, even if he doesn't attempt to use the key himself. The authorities (police and lawmakers) don't want that kind of information (how to make a master key) getting out. They don't blame GM for having a common exploit available in a large range of vehicles: they blame the guy who tried to obtain the forbidden knowledge.

        I would hope our network kit doesn't come with a master key preset from the factory. The ind

  • On last week's "24", when the terrorist hackers tried to perform a network attack on the "CTU" headquarters, it was Cisco's network protection system that thwarted them. In fact, when all of the characters stopped what they were doing (chasing down a stolen nuclear device from being detonated on U.S. soil.) and stood around talking about how their Cisco systems were self-defending and how great that was, and those scenes were intercut with screenshots of the Cisco defense system at work saving the day, I wa
    • It's a sad truth, but I believe in the intelligence of terrorists.

      I asume that they are at least intelligent enough to not waste incredible amounts of time, enery, and manpower to hack / break into Cisco so they can perform a very high level analysis of the source code for security holes, so they can hack into backbone routers and misconfigure / shutdown them.

      Instead of say, the dumb way of running into the telephone pole brining down the power lines outside or blowing up a critical resource.

      Most people
  • May the source be with you....
  • They got the original router code from Stanford University in the first place, and now they complain so bitterly! Check this [stanford.edu]

Slashdot Top Deals

Software production is assumed to be a line function, but it is run like a staff function. -- Paul Licker

Close