Slashdot Mirror
Cisco Confirms Arrest In Theft Of Its Code
spafbnerf writes "Informationweek is reporting on Cisco Systems' confirmation of an arrest in connection with the theft of its IOS 12.3 source code last year. On Tuesday, The New York Times reported that federal officials and security experts have acknowledged that the theft of the Cisco source code was part of a wider pattern of thousands of attacks on military and research computers perpetrated by an unknown number of individuals." From the article: "The FBI fully recognizes the inherent sophistication and global nature of intrusion investigations...As such, we have worked hard to develop strong partnerships within the international law-enforcement community. In this case, we have been working closely with our international partners to include Sweden, Great Britain, and others. As a result of recent actions, the criminal activity appears to have stopped."
The parents of the teenager in question have taken all his pokémon games.
I read that as: "As a result, the criminals have realised they were being watched and have cleaned up their act, and have made sure they are not noticed by 'them' anymore.
Now on to the FA.
This space is intentionally staring blankly at you
They. Who ever they are, will be back if indeed it's more than a few people. When it comes down to it nothing is secure. There is always going to be a way for the smart/crafty to cercumvent anything put in place.
Then again we could just write rock solid code. but that apparently is cost prohibitive.
"As a result of recent actions, the criminal activity appears to have stopped."
Thanks to the bear patrol recently put in place in my neighborhood, all bear-related activity appears to have stopped.
lol omfg idiots bought it!!!
Yeah. Stay put for 2 months more. And just in case you have something urgent, tunnel through Luser832, I have planted enough "evidence" on his PC to keep him in prison for 50 years.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Maybe the thief could have made IOS more stable and secure. I'm beginning to think anyone could do a better job...
...at least walk out with a 6500 router under your coat that you can flog on Ebay!
Gentoo Linux - another day, another USE flag.
More like "liberation".
Information wants to be free.
"As a result of recent actions, the criminal activity appears to have stopped."
Wow, that statement really made me feel better.
He who knows best knows how little he knows. - Thomas Jefferson
As such, we have worked hard to develop strong partnerships within the international law-enforcement community.
Had Bush known that this was occurring, he would have stepped in and stopped this attack on US sovereignty.
We all know that the US will always choose the unilateralist role in defeating enemies of the State.
(chill... It is a joke.)
"Rocky Rococo, at your cervix!"
Eurasia is now at peace with Oceania, and the harvests of grain improved 20% compared to last year ;)
Tsunami -- You can't bring a good wave down!
Thank goodness Cisco finally got its source code back! Now the source code is safe and sound, never to be seen again by anyone outside Cisco.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
Anyone got a torrent?
You mean it wasn't Habib Marwan and his terrorist cell that stole the IOS code to reverse engineer it into a software chipset that could be used to simultaneously override a nuclear powerplant and a nuclear warhead! Man I was way off.
News Reporters Make Tasty Polar Bear Treats!
Mainly that the folks who are behind the break ins read the same news articles we do.
"Learning is not compulsory... neither is survival."
--Dr.W.Edwards Deming
The suspect is a 16 year old boy from Uppsala, Sweden, my hometown. I bet he doesn't feel as clever now as he used to. :-)
I look forward to Maureen O'Gara's next scoop though: "He came from Uppsala, the headquarter of famous open source company mySQL AB! Also the place where Vikings once slaughtered Christians in pagan rituals! All a coincidence? I think not!!"
Being bitter is drinking poison and hoping someone else will die
Since I bitch-slapped a hacker trying to break into my system I have not seen another one trying. All that activity must have stopped as well. Wow...I suddenly feel all is right with the world
I'm not a troll, but I play one on Slashdot.
Looks like they could do with a decent firewall to keep out intruders. Can anyone recommend a good one?
Or maybe they're not really bothering to verify it, but instead quoting each other, since if one of them says it, it must be true!
The more and more I hear about these types of hacks, attacks, and thefts, it makes me wonder why many big companies still choose to remain 'online.'
We all know that the internet can be a very dangerous place, so why would any company in their right mind choose to have computers with potentially sensitive source code or database information remaining on a publicly facing network?!
Very few machines in a given development or database office should have Internet access, and these machines should not be directly connected to the rest of the company. The reason you spend all of that cash on networking equipment is for private closed intranets, it's not to get you online!
Plugging into the internet is just like going public, no matter how many basements with feline guards at the doors you have in place, you can never be 100% secure.
Translation: We don't have time to QA this code, so we'd rather not have anyone do it themselves, either, then hack us with the holes we neglected to look for in the first place.
Ugh. Sometimes I wonder if there ought to be an open-source REQUIREMENT in RFP's to vendors. Hell, code availability has HELPED Linksys (who's also Cisco!) - folks have "hacked" it to make it MORE robust, but you don't see any greater number of "hacks" for Linksys products than you do for anyone else...
Maybe Cisco ought to focus on the security BASICS (it's still easiest to get into some else's network because they never changed the default password than it is to script-kid some mutated hack into working) rather than worrying that "outsiders" might actually harden their products FOR them...
From TFA: "The stolen code was a portion of Cisco's Internetworking Operating System version 12.3. The incident has been a matter of concern because malicious hackers might find flaws in the code that could be exploited to impair the functioning of Cisco's routers."
Translation: We don't have time to QA this code, so we'd rather not have anyone do it themselves, either, then hack us with the holes we neglected to look for in the first place.
Well, if security isn't a concern in our daily lives; why should computers be somehow different?
If someone steals a master key from GM, he goes to jail; he isn't charge just with petty theft, even if he doesn't attempt to use the key himself. The authorities (police and lawmakers) don't want that kind of information (how to make a master key) getting out. They don't blame GM for having a common exploit available in a large range of vehicles: they blame the guy who tried to obtain the forbidden knowledge.
Similarly, they arrested a boy who gained forbidden knowledge that could be used to damage Cisco routers, if those routers aren't secure. Cisco is not held liable for any insecurities in their routers: and this is consistant with legal tradition.
The fact is, cars are not secure, and GM isn't expected to accept liability for that. They're stolen every day, and the existance of master keys doesn't help much. Even without that, there are many are well-known classes of attacks by which thieves can compromise vehicle security.
There's the "smashed windshield" attack, the "lockpick" attack, the "hotwire the engine" attack and many others. Tactics range from "social engineering" tricks (like lying to the valet to get the keys) to sheer brute force methods (such as clubbing the driver over the head, and stealing his car).
The automotive industry hasn't dealt with this problem by manufacturing significantly more secure vehicles. Instead, it relies upon the police to enforce the laws against people who would take advantage of these exploits.
Similar attitudes are seen in the housing industries (most windows aren't made of bulletproof glass), and in fact, in most industries where security is a concern. Security is expensive: and we're already paying for a police force to ensure that criminals aren't lurking about. [1]
Within the computer industry, some programmers seem shocked that security is a low concern: and yet, they go home to places with breakable glass in the windows. There's an exploit for that, too: it's called a "flying brick attack", and it's nastier than your average DDOS...
In short, they arrested the boy, because it's consistant with what the laws say, and with what the police do. If you want to change that, talk to your local politicans...
--
AC
[1] I didn't say it was working... just that the concept was there...