Slashdot Mirror
Cisco IOS Source Code Theft Story Continues
securitas writes "eWEEK's Steven J. Vaughan-Nichols reports that the source code for Cisco's 'main networking device operating system was stolen on Thursday' (May 13) according to the Russian company SecurityLab. SecurityLab says that criminals broke into Cisco's network and stole 800MB of source code for IOS 12.3 and IOS 12.3t, a pre-release variant. The purported culprit(s) then bragged about the feat in an IRC session and offered 2.5 MB of the code as proof. Industry analysts Dell'Oro Group says that 'Cisco owns 62 percent of the core router market.' More at the Sydney Morning Herald and Windows Network magazine." Our original coverage was here of this story.
...if the entire internet was taken down? for an extended period of time? The world would fall into disarray. Although once upon a time the world functioned perfectly well without the internet. Amazing how technology makes us dependent just like junkies.
They could have at least posted the code for the backdoor in all the routers.
I notice this morning that since the code leak the Internet has been faster, more stable, and I get packeted less often. Since the code leak I also lost 5 pounds and I swear my erectioin this morning was larger. *phone rings* That must be my bank calling to tell me they lowered my intrest rates.
Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.
Please, everybody! Please remove the source code from the internet ASAP before SCO sees it and claims ownership!!
.sig: No such file or directory
Forgive my ignorance, but if the code is truly solid code, without buffer overruns and the like, shouldnt this theoretically not matter (just as the code for stuff like ipfw is open)?
I realize however that Cisco code is likely more complex than the relatively simple stuff ipfw does.
In other news, Microsoft, Valve and Cisco to give free seminars on network security!
All of these apocalyptic arguments about the Internet going down etc. would be moot...
Then again one has to wonder how Cisco would have created their empire if their code would have been open sourced. A lot of their business is not only selling H/W but ISO features.
1. French or German
2. Linux/open source zealot
3. Lives in parents basement
4. Showers monthly
I recently finished CCNA training and asked the instructor what OS CiscoIOS was based on and I was told it's based on BSD OS. He didn't tell me which BSD though....
"As SecurityLab discovered, on the 13th of May all the source code of the CISCO IOS operating system, which is used in the majority of CISCO's network installations was stolen. The full extent of the stolen information runs to about 800MB compressed.
:)
According to our information, the release of fragments of the source code came about due to a break-in to the corporate network of Cisco System. Representatives of Cisco System have meanwhile made no comment on the incident.
The information came from a certain individual under the nick of franz on darknet@EFNet IRC, where he also presented a small part of the source code (about 2.5MB) as evidence.
Below are links to the first 100 lines of source code from the files ipv6_tcp.c and ipv6_discovery_test.c."
Apologies for any errors - my technical Russian's a little rusty.
++ Say to Elrond "Hello.".
Elrond says "No.". Elrond gives you some lunch.
Open source all your code. It's too late now (cat/bag/out of). Set an example to the rest of the business community.
Natsu gusa-ya, Tsuwamono domo-ga, Yume no ato
Two direct links on the front page of slashdot to (literally) stollen IP?
I wonder if Slashdot will get in trouble with Cisco for this? The moderators could have at least have checked the links, no?
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
You've got a real-time operating system, a basic file-system, the TCP/IP and all the other protocol stacks, the SNMP/MIB support and proprietary routing algorithms. Presumably, the source code would be documented to some extent, along with SCCS archiving. All of this could easily add up to over 800 Megabytes.
In the seminars I can imagine how Cisco would explain they're love of being shafted, hence all the backdoor access (pun intended!)...
...Microsoft will just blab about how they CAN be trusted, and show everyone pretty pictures and a Matrix spoof to distract everyone...
..while Valve gets the dates for the seminar mixed up and turn up 6 months later.
Are you local? There's nothing for you here!
My one thought: it's all bullshit until Cisco comes out and says they were hacked. Anyone can put together a bunch of seemingly well-written code and say that they were l33t and got in to Cisco.
The proof is in the pudding. And all I see so far is some sugar.
Chris Knight is my hero.
..they would have noticed then if 800 MB was being downloaded.
I think that susceptibility will depend on what source was stolen. Was it the ENTIRE source? Or was it just pieces? They (the cracking types) may discover a hole in something that exists only in the Enterprise feature set, leaving most of the exposed routers on the Internet un-compromiseable (As most companies aren't going to pony up for the most expensive feature set when all they're doing is shuffling IP packets).
Also could find a problem in basic TCP/IP code, making every Cisco router on the planet a revolving door. I find this scenario highly unlikely, as thier base code is probably a lot more stable and reviewed than the newer, more advanced features.
/*
* Juniper engineers are weenies!
*/
bash$
Well ... is it not kinda strange? A few months back when the Windows code was leaked, most of Slashdot was screaming about 65,000(i dint cook that number!) Windows bugs. Well, nothing happened really. Except an IE 5.x bug, which was patched silently before the source code leak.
... Slashdotters, cant it be just possible that this leak might be much more disastrous that the Windows leak.
... its funny reading that Windows article again, and going through posts that talked abt non-existant security in Windows. And how many holes did people find.]
Now lets compare the REAL security issues.
1. The number of people who were dissecting the Windows Source Code are much more than those trying to find a Cisco hole.
2. Even without the Windows Source, we can reverse engineer large parts of the Windows Sources and identify problems. With the leak it just became easier. I dont expect too many crackers trying to find holes in Cisco's IOS.
This simply means that the chances of finding a security hole in Cisco is much higher than in Windows. Because now that the source is out in the open, its easier. Why would they choose to look?
1. Bringing down those routers could virtually bring down most of the internet.
2. The entire financial world uses them! If a hole is discovered it might just be the easiest way to get into those systems.
3. It could be easier than trying to find a Windows hole, since (as from my earlier logic) many many people have already tried without results.
4. The damage that could be done in those 2 cases are so immense, that a comparison would be irrelevant.
[Troll: Btw
Slashdot labels a story as theft when no portion of the source code was removed from Cisco's computers? Never!
No, I'm afraid this is not 'theft'.
Theft must incorporate a desire to deprive the rightful owner of said taken item(s). Surely we know this by now?
Stealing, yes. Theft, no.
</PEDANT>
I've looked at the sources on display at the russian site [IPv6 sources], that pretend to be from the IOS. Several things took my attention: :) ;)))
1. Since when programmers, working for a serious company, write copyright notices for themselves in the header... Like if you work for, let's say, SCO (ha-ha), you will put in the header copytight by you, and then - who knows - might sue SCO for stealing code from you
2. printf("\nAdding %P to ND cache", &target);
The ND cache is really connected to neighbor solicit messages, but would the Cisco IOS be printing a message, saying that it is adding the address to the ND cache without checking debug flags, etc.? And I am sure it is not a matter of system design in this case. You cannot get the impression just from one tiny piece of code.
3. Some post here were stating... "root" access, which certainly made me smile. The IOS is running cooperative multitasking and the tasks usually run at the same level.
4. Ole Troan really works for Cisco Systems (in UK) and is the proud author of the IPv6 DHCP RFC specification 3633. So this is an argument that supports a little bit of the theory. Just didnt think that Cisco still has developers in UK. I thought they outsourced everything to India long time ago
There are some more, but I'll save you the tiny details, like big endian or other nifty stuff in the code.
Does this code contain the infamous "backdoor" account ever present on certain Cisco devices? It should would be worth a criminal's time to get a hold of that. Think of all the other information he could steal once he knew that.
Fred
"A fool and his freedom are soon parted"
-RMS
Who would use critical hardware from a company that can't even decide where to put their curly-braces? Are they at the end of the line or on a line by themself? Make up your frickin' mind!!