Slashdot Mirror
Cisco IOS Source Code Theft Story Continues
securitas writes "eWEEK's Steven J. Vaughan-Nichols reports that the source code for Cisco's 'main networking device operating system was stolen on Thursday' (May 13) according to the Russian company SecurityLab. SecurityLab says that criminals broke into Cisco's network and stole 800MB of source code for IOS 12.3 and IOS 12.3t, a pre-release variant. The purported culprit(s) then bragged about the feat in an IRC session and offered 2.5 MB of the code as proof. Industry analysts Dell'Oro Group says that 'Cisco owns 62 percent of the core router market.' More at the Sydney Morning Herald and Windows Network magazine." Our original coverage was here of this story.
...if the entire internet was taken down? for an extended period of time? The world would fall into disarray. Although once upon a time the world functioned perfectly well without the internet. Amazing how technology makes us dependent just like junkies.
They could have at least posted the code for the backdoor in all the routers.
Forgive my ignorance, but if the code is truly solid code, without buffer overruns and the like, shouldnt this theoretically not matter (just as the code for stuff like ipfw is open)?
I realize however that Cisco code is likely more complex than the relatively simple stuff ipfw does.
1. French or German
2. Linux/open source zealot
3. Lives in parents basement
4. Showers monthly
"As SecurityLab discovered, on the 13th of May all the source code of the CISCO IOS operating system, which is used in the majority of CISCO's network installations was stolen. The full extent of the stolen information runs to about 800MB compressed.
:)
According to our information, the release of fragments of the source code came about due to a break-in to the corporate network of Cisco System. Representatives of Cisco System have meanwhile made no comment on the incident.
The information came from a certain individual under the nick of franz on darknet@EFNet IRC, where he also presented a small part of the source code (about 2.5MB) as evidence.
Below are links to the first 100 lines of source code from the files ipv6_tcp.c and ipv6_discovery_test.c."
Apologies for any errors - my technical Russian's a little rusty.
++ Say to Elrond "Hello.".
Elrond says "No.". Elrond gives you some lunch.
You've got a real-time operating system, a basic file-system, the TCP/IP and all the other protocol stacks, the SNMP/MIB support and proprietary routing algorithms. Presumably, the source code would be documented to some extent, along with SCCS archiving. All of this could easily add up to over 800 Megabytes.
My one thought: it's all bullshit until Cisco comes out and says they were hacked. Anyone can put together a bunch of seemingly well-written code and say that they were l33t and got in to Cisco.
The proof is in the pudding. And all I see so far is some sugar.
Chris Knight is my hero.
..they would have noticed then if 800 MB was being downloaded.
I recently finished CCNA training and asked the instructor what OS CiscoIOS was based on and I was told it's based on BSD OS. He didn't tell me which BSD though....
It's descended from the Unix related work done at Berkeley in the early 1980's. I can't find a suitable link at the moment, but from what I remember there was some controversy about the commercialisation of the code. Much of the work was while the future Cisco founders were still employed at the university. This meant it should have belonged to the Regents, and released under a BSD license. If so, then it's ironic that the code is in the public domain, albeit under dubious circumstances.
Chris
I think that susceptibility will depend on what source was stolen. Was it the ENTIRE source? Or was it just pieces? They (the cracking types) may discover a hole in something that exists only in the Enterprise feature set, leaving most of the exposed routers on the Internet un-compromiseable (As most companies aren't going to pony up for the most expensive feature set when all they're doing is shuffling IP packets).
Also could find a problem in basic TCP/IP code, making every Cisco router on the planet a revolving door. I find this scenario highly unlikely, as thier base code is probably a lot more stable and reviewed than the newer, more advanced features.
Well ... is it not kinda strange? A few months back when the Windows code was leaked, most of Slashdot was screaming about 65,000(i dint cook that number!) Windows bugs. Well, nothing happened really. Except an IE 5.x bug, which was patched silently before the source code leak.
... Slashdotters, cant it be just possible that this leak might be much more disastrous that the Windows leak.
... its funny reading that Windows article again, and going through posts that talked abt non-existant security in Windows. And how many holes did people find.]
Now lets compare the REAL security issues.
1. The number of people who were dissecting the Windows Source Code are much more than those trying to find a Cisco hole.
2. Even without the Windows Source, we can reverse engineer large parts of the Windows Sources and identify problems. With the leak it just became easier. I dont expect too many crackers trying to find holes in Cisco's IOS.
This simply means that the chances of finding a security hole in Cisco is much higher than in Windows. Because now that the source is out in the open, its easier. Why would they choose to look?
1. Bringing down those routers could virtually bring down most of the internet.
2. The entire financial world uses them! If a hole is discovered it might just be the easiest way to get into those systems.
3. It could be easier than trying to find a Windows hole, since (as from my earlier logic) many many people have already tried without results.
4. The damage that could be done in those 2 cases are so immense, that a comparison would be irrelevant.
[Troll: Btw