Cisco IOS Source Code Stolen?

A Russian Web site, SecurityLab, reported that someone claimed to have stolen the source code for Cisco IOS 12.x operating system. The code is used is huge number of Cisco devices.

According to the report someone boasted on IRC about breaking into Cisco's network and stealing the code. The person made available approximately 2.5MB of code in an effort to prove the theft actually took place.

SecurityLabs said the total amount of code stolen was approximately 800MB. At the time of this writing Cisco had not commented publically about the alleged theft.

In February code for Windows 2000 and Windows NT somehow leaked onto the Internet. But that leak was the result of poor security on a network belonging to someone with legitimate access to the code.

To date there hasn't been much fallout as a result of Microsoft's leaked code. One security vulnerability was discovered in IE 5.x and at least one worm takes advantage of a vulnerability that was discovered as a result of access to the leaked source code.

However if security-related bugs are found in the leaked Cisco IOS code and the discoverers don't notify Cisco and given them time to produce patches then the ramifications could potentially become huge since so many network uses Cisco hardware, including core Internet service providers.

End of Article

Editor: The grammatical errors in this document were bad. I am not an English major by any stretch of the imagination. That

Ex:
...since so many network uses Cisco...

could be:
...since so many networks use Cisco...
or
...since so many networks utilize Cisco...

Ex:
The code is used is huge number of Cisco devices.

could be:
The code is used by a huge number of Cisco devices.
or
The code is used on a huge number of Cisco devices.
or
The leaked code is part of the Cisco IOS that is utilized on a large (huge, significant, great, etc.) number of Cisco products. (or devices).
or
The Cisco IOS is the heart of Cisco devices, which means that a huge number of Cisco products running IOS 12.x could be potentially be affected. (or devices).
-The grammar with this statement was bad, but the legal implications could be more or less...is this current code, old code, code that is still in use, code that is obsolete. Saying the code is used on the device might be incorrect. Stating that the code is part of the IOS and that IOS is used on Cisco devices is better than saying that code is used on the device. The leaked code is probably compiled as part of the IOS.

Bob Christian II May 17, 2004

Intresting....if i was given the code...i wouldnt know what to do with it.. ;-)

Sami Aleem May 18, 2004

You must log on before posting a comment.

If you don't have a username & password, please register now.