Slashdot Mirror
Cisco IOS Source Code Theft Story Continues
securitas writes "eWEEK's Steven J. Vaughan-Nichols reports that the source code for Cisco's 'main networking device operating system was stolen on Thursday' (May 13) according to the Russian company SecurityLab. SecurityLab says that criminals broke into Cisco's network and stole 800MB of source code for IOS 12.3 and IOS 12.3t, a pre-release variant. The purported culprit(s) then bragged about the feat in an IRC session and offered 2.5 MB of the code as proof. Industry analysts Dell'Oro Group says that 'Cisco owns 62 percent of the core router market.' More at the Sydney Morning Herald and Windows Network magazine." Our original coverage was here of this story.
...if the entire internet was taken down? for an extended period of time? The world would fall into disarray. Although once upon a time the world functioned perfectly well without the internet. Amazing how technology makes us dependent just like junkies.
Forgive my ignorance, but if the code is truly solid code, without buffer overruns and the like, shouldnt this theoretically not matter (just as the code for stuff like ipfw is open)?
I realize however that Cisco code is likely more complex than the relatively simple stuff ipfw does.
All of these apocalyptic arguments about the Internet going down etc. would be moot...
Then again one has to wonder how Cisco would have created their empire if their code would have been open sourced. A lot of their business is not only selling H/W but ISO features.
linux kernel source unpacked takes 150MB, compare yourself. Maybe they have stolen several versions of the source?
#
#\ @ ? Colonize Mars
#
Open source all your code. It's too late now (cat/bag/out of). Set an example to the rest of the business community.
Natsu gusa-ya, Tsuwamono domo-ga, Yume no ato
Two direct links on the front page of slashdot to (literally) stollen IP?
I wonder if Slashdot will get in trouble with Cisco for this? The moderators could have at least have checked the links, no?
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
I think that susceptibility will depend on what source was stolen. Was it the ENTIRE source? Or was it just pieces? They (the cracking types) may discover a hole in something that exists only in the Enterprise feature set, leaving most of the exposed routers on the Internet un-compromiseable (As most companies aren't going to pony up for the most expensive feature set when all they're doing is shuffling IP packets).
Also could find a problem in basic TCP/IP code, making every Cisco router on the planet a revolving door. I find this scenario highly unlikely, as thier base code is probably a lot more stable and reviewed than the newer, more advanced features.
It's like some warped Stratego (TM) game, and the hackers have captured the flag.
Now
:
1. The act of stealing it, sort of renders it useless, who would want a firewall that can be broken into an its own sources stolen.
2. This embarrasement would have been circumvented if they had most of the code in the open source domain, especially the firewall. A good algorithm should be be able to resist the test of scrutiny of its sources.
3. The routing algorithm would be valuable but I doubt that it is what the hackers were after. So maybe they would want not to open source it.
Bottom line, those things which are not core to your business should be release to the open source community. Of course some, like MS believe the universe is their core, so some will never change.
--laz
"Just remember, it takes a village idiot." -- The Motley Fool.
Slashdot labels a story as theft when no portion of the source code was removed from Cisco's computers? Never!
No, I'm afraid this is not 'theft'.
Theft must incorporate a desire to deprive the rightful owner of said taken item(s). Surely we know this by now?
Stealing, yes. Theft, no.
</PEDANT>
Changing the way the public perceives issues involving IP requires consistancy.
Whether its illegally copied songs or illegally copied code, IT IS NOT THEFT because nothing is stolen. No one that had the code before doesn't have it now due to this.
OF COURSE this is wrong, and it breaks many laws including copyright laws and computer crime laws (unauthorized access, etc), but please, do not frame this argument using the wrong terms. This just digs us deeper in our hole.
It's funny until you actually have to work with corporations with this mentality.
Does this code contain the infamous "backdoor" account ever present on certain Cisco devices? It should would be worth a criminal's time to get a hold of that. Think of all the other information he could steal once he knew that.
Fred
"A fool and his freedom are soon parted"
-RMS
The thing that I find the most interesting is that first this shows that whatever security products they are selling obviously aren't good enough because there is someway around them(assuming Ciso would be using their own best products). But more importantly, if this were an open source project like Gnome, then we'd have up to the second details on what happened, why it happened, how it happened, what was accessed, whats at risk, etc... In the closed/proprietary world this doesn't happen, we are all just basically left in the dark and have to accept whatever they tell us. All the more for linux based routers!
Regards,
Steve
- have a good design
- hire decent coders
- have a good qc
. Otherwise, they would already have a track record similar to MS.Honestly, what is so difficult about configuring cisco routers? You just configure the passwords, interfaces, set up a routing protocol, set a gateway of last resort, and you're set. You can learn how to do all this in 30 minutes!
uhh.... You must not deal with routers much. Otherwise, you'd see other products such as Bay Networks/Nortel and sprinkle your words on your shoe for seasoning. A novice can have a Cisco router up and going in less than a minute. A decent guy can break into one in 3.
Just a hunch, but I worked for cisco for five years, and that source code was kept under TIGHT control, on a TIGHT network.
Does the size relative to the amount of data that can be burned to one CD make anyone else suspect that an insider walked it out on a CD?
Maybe it was just the most l33t ever...
If Cisco were to release the code into open source now it would send a message to the world that anything they're able to steal they can have. They would never open source this code now for that reason.
Cisco does not want to reward hackers and would be "freedom fighters" for attrosities such as this one.
I think those of us that support the open source movement need to be very careful about the comments we post after incidents like this. Most of us are hard working respectable geeks that don't go busting into corporate networks to steal proprietary code.
Let them open source when they want to. Have the conviction and faith that our movement will gain their trust in time. Stealing their code is not going to get us anywhere.
BigFiber.net