Slashdot Mirror
Possible Cisco Source Code Theft
OmegaBlac writes "According to Ars Technica, a Russian security site is claiming that Cisco's corporate network was comprimised and about 800MB of Cisco's source code for IOS Operating System version 12.3 was stolen. I guess Cisco forgot to implement their own Self Defending Network solutions."
Whats the deal with that!?
if true, this could cause big problems not only for Cisco, but for the entire Internet. Cisco routers are responsible for routing much of the Internet's traffic, and the company has long practiced a policy of "security through obscurity."
We're all screwed.
-Imidazole2
One (of the many) problem(s) with the closed source business model is the fact that the entire company can depend on this intellectual property. The security surrounding that source has to be so huge that the problem quickly becomes intractable.
:P
:/
Open source however, by virtue of it being free (as in Iraq hehe), is worthless. Support contracts are alot harder to steal
Let's not forget that open source provides robust security (in principle) where as for closed source we can never be sure.
Why do we still use so much closed source stuff
Simon.
Don't touch it, don't see it, don't breathe near it, if you ever plan on contributing to linux.
Leaked code is very dangerous to open source software.
What about other companies that supply cisco with software?
This could hurt more than just cisco.
I spotted a printf, which seams odd for an IPV6 stack or part of an OS
IOS does interact with the user through a terminal session so printfs aren't all that unlikely.
Of course they ought not to be in the IPv6 stack. Unless they populate packets as formatted strings.
Yours Sincerely, Michael.
Let's not forget that open source provides robust security (in principle) where as for closed source we can never be sure.
:/
Why do we still use so much closed source stuff
SO, if you don't like it, you go out and make an OS for the Cisco routers and put it out for free - go ahead, no one is stopping you. Or go out and try and convince everyone to use your little Linux boxes as routers...oh, wait, there's just as many security issues in Linux as there are in Windows..
But wait, there's more! With IOS, there's a small set of software that can cause trouble. Using something else, esp based on Linux, can cause even more problems - they can gain access by any other means, shutdown or change some OTHER critical system, and it shutdown the routing...Use your frickin head.
Surely that's only the case if being covered by software patents... which I think the general consensus in the Linux devlopment world is that's a Bad Thing(tm). Whether they will apply in Europe is still being discussed.
Copyright-protected code is obviously not allowed, but as long as there's a way of implementing the same thing in a different manner (always assuming that European s/w patents don't get ratified) I fail to see any issue in understanding how some other piece of software works.
The whole SCO debacle has done more than just piss everyone off, there's been a remarkable amount of reticence to learn from code that isn't Free. By that very logic authors shouldn't be allowed to read books and composers should be banned from listening to music.
--
This has been a scatterbrained post on behalf of the Poorly Thougt-out Argument Party
the layman's guide to computer science
Actually that wasn't the full Win2K source, and an exploit based on being able to see the code was released (see "Exploit Based On Leaked Windows Code Released").
You would think that a company as large as CISCO would have had a backup.
I cant belive it was 'stolen' from them.
Yes that was sarcasm. Just pisses me off how the world 'theft' is perversed when it comes to digital content.
They COPIED it people. It wasnt STOLEN. ( yes, still illegal, but much different of a concept )
---- Booth was a patriot ----
This is different from calling illegal file sharing "stealing", where the information being appropriated has already been openly published. An illicit activity is taking place, and it may (indirectly) economically damage the artist or publisher. However, that is no more stealing than any number of other illegal acts that cause economic damage, such as vandalizing their offices or phoning in a false bomb threat.
No they don't: one is a *test* of IPv6 functions, so there is a printf.
Agreed, also the code is indented, but rather then using a pre (formated) tag the newlines have been replace by br`s in the .ru site. The spaces are still there to be restored. I guess I just didn`t wan`t to believe this.
Software is only secure when specific security tests are performed against it. Almost no one does much of this, or even understands it well. I doubt that in 1000 readers, more than 5 could recite the top 5, never mind the top 20 tests you must perform.
Open source is also not inherently better at security because of it must be peered reviewed. If the reviewer doesn't know what to check, then what is the point of the review?
Software must be security certified by professionals, whether open or otherwise.
Mike www.sharecube.com
How can the source code be stolen, when Cisco still has it?
How can you have identity theft if you are still you?
Phillip.
Property for sale in Nice, France
My ice coffee just shot out of my nose all over the fucking monitor... great comment :)
One thing you learn in the IT industry real quick is the cobbler's sons are the last shod.
Good luck. Where I work we legally have access to Cisco IOS, although we're very strict and only a handful of engineers have the permissions to access it (me being one of them). The code is very clean and when I've browsed it looking to see if there's any exploits, I have thus far come up empty. The code does not look like the Microsoft code I've seen, which tends to be overly complex IMO. That's not to say we don't find bugs in Cisco's code, but generally it's very high quality.
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
Thank god there aren't a bunch of old routers out there being used by people who think they are still secure.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"