• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

So long cisco, and thanks for all the code! UPDATE: FBI involved

shocking indeed. i dont think there will be a super bug that threatens the existence of the internet (similar to the scare which followed the windows code leak) but 800mb is a grip of code... odds are somethign will be found in it.
 
not confirmed yet AFAIK.

we'll see how this pans out. It is a public relations nightmare.

what I've been reading it is NOT cisco source code.
 
Originally posted by: n0cmonkey
Despite the fact I'm not a fan of cisco, I hope this is fake...
Click to expand...

yeah. we'll see. I hope it is.

But then again these day's security is such a tremendous administration pain (especialy for large companies) that boo-boos do happen.
 
how exactly do you steal code from cisco? If ANYONE should have properly installed hardware and software.. i would be cisco
 
Originally posted by: alexXx
how exactly do you steal code from cisco? If ANYONE should have properly installed hardware and software.. i would be cisco
Click to expand...

You'd think the same thing about Microsoft and their software. Doesn't always work though.

I think spidey07 said it, but when networks get that big, it gets REAL tough.
 
Originally posted by: n0cmonkey
Originally posted by: alexXx
how exactly do you steal code from cisco? If ANYONE should have properly installed hardware and software.. i would be cisco
Click to expand...

You'd think the same thing about Microsoft and their software. Doesn't always work though.

I think spidey07 said it, but when networks get that big, it gets REAL tough.
Click to expand...

yep.

Trust me. When you start dealing with many layered firewalls, vlan filtering, etc it can get very complicated.

Almost TOOcomplicated.

Its the old security vs. administration/managibility dogma. We're a medium sized enterprize and just the routing complexity alone is enough to boggle the mind...much less throwing in firewall rule sets and vlan filtering.

Looks great in theory, a supreme pain in practice.
 
Originally posted by: n0cmonkey
Maybe someone at cisco brought their daughter in and she downloaded a game to his computer...
Click to expand...

Holy crap that was funny dude.

No one inside Cisco that I know has heard anything definite on this. However, Tony Li seems to think it's genuine stuff. Hes one of Cisco's former programming gurus. If you guys dont read NANOG, you really should :beer:.

I wonder how this affects their "self-defending network" initiative?

"...and in other news, Cisco Systems today announced their newest product in the 'Self-Defending Network' family. The "Rapier 600" series Physical Protection System is a totally new, best-of-breed network security solution. The Rapier 600 works at the Application layer to identify rogue users tampering with network equipment. Upon identifcation of a rogue user, the system can respond in a variety of ways depending on the severity of the threat. For example, when tested internally, the system prevented a simulated theft of source code by delivering 10,000 watts through the end-user's system. The resulting explosion neutralized the threat. While the entire network was destroyed, the ultimate goal was acheived - the target of the attack was protected. Cisco is expected to bundle the system with an extensive tape backup solution as a value-added bonus to it's customers."

Heh...sorry. I was bored, couldn't resist.
 
Ok, this basically reads like Cisco is admitting to the break in. But, this could be some old stuff, not that it makes it irrelevant.

Some quotes of note:
"Cisco will continue to take every measure to protect our intellectual property, employee and customer information. In this case, Cisco is working with the FBI on this matter," the company says in a statement.
Click to expand...

Putting IP over customers is a mistake. Intellectual Property is a horrible business model anyways.

A computer directory listing purported to be of the stolen IOS modules was also recovered. The listing identifies a Sun Sparc server named iwan-view3.cisco.com and a list of directories, but no information on their contents. Still, the listing gives some indication of when the leak may have occurred. Most of the directories were last updated in 2002 and 2003, with one changed in November 2003.
Click to expand...

Ok, so it's older code. And they don't know how to secure Solaris machines. maybe I should brush up on my Sun hardening skills.... Nah. 😉

"People aren't typically [using Virtual Private Network connections] into Sun boxes. The Solaris stations tend to be on site, that's where you'd use them," he says.
Click to expand...

ruh roh, someone doesn't know about SSH, telnet, Exceed... 😛

Unlike open source software products, the security of Cisco's systems and those of other proprietary software vendors depends on keeping source code out of public view, he notes.
Click to expand...

I could have done without the obvious security through obscurity/FOSS is good comment:
Unlike open source software products, the security of Cisco's systems and those of other proprietary software vendors depends on keeping source code out of public view, he notes.
Click to expand...
 
Hmm, I lost some respect for Cisco because they allowed this to happen, but not TOO much respect, it can happen to almost anyone.

But that security through obscurity comment was a little, uh, retarded. No security person worth his or her weight in rat droppings thinks that's a valid security approach any more, at least I hope not.
 
Originally posted by: Rainsford
Hmm, I lost some respect for Cisco because they allowed this to happen, but not TOO much respect, it can happen to almost anyone.

But that security through obscurity comment was a little, uh, retarded. No security person worth his or her weight in rat droppings thinks that's a valid security approach any more, at least I hope not.
Click to expand...

Cisco seems to think it's a valid way to do business. 😉
 
Originally posted by: n0cmonkey
Originally posted by: Rainsford
Hmm, I lost some respect for Cisco because they allowed this to happen, but not TOO much respect, it can happen to almost anyone.

But that security through obscurity comment was a little, uh, retarded. No security person worth his or her weight in rat droppings thinks that's a valid security approach any more, at least I hope not.
Click to expand...

Cisco seems to think it's a valid way to do business. 😉
Click to expand...

You're just loving this one, aren't you, N0c? I find it rather ironically amusing - Cisco has been just ASKING for this for a while. Surprised it hasn't happened sooner. If you know what you're doing and try hard enough with a variety of different methods, there's always a way around nearly every security system. (Don't get me wrong - I'm a huge Cisco customer and I love their gear. They just need to tone down the attitude a bit)

You'd be surprised how easy it would be to penetrate a lot of large corporations. Not hard to get a digicam shot of a badge, create and print your own with your picture, then follow someone through a security door. As long as you look like you know what you're doing, you're golden and it's relatively easy to work your way into a building. Once you're in, it's not hard to find someone going to lunch that forgot to lock their terminal, install one key logger, and off you go...

Pssssst.. Anyone want the super-secret recipe for distilling Jack Daniels?

*grin*

- G
 
Originally posted by: Garion
You're just loving this one, aren't you, N0c?
Click to expand...

I'm torn. On one side, it's hilarious. I love seeing these big corporations that don't give a crap about anyone but themselves getting it in the rear. But on the other side, ~62% of the core routers out there are Cisco. If I can't get to openbsd.org, what I am going to do?! 😉

And I really do like those Cisco self-defending network commercials. I find them hilarious, even if I don't think much about the technology.

You'd be surprised how easy it would be to penetrate a lot of large corporations. Not hard to get a digicam shot of a badge, create and print your own with your picture, then follow someone through a security door. As long as you look like you know what you're doing, you're golden and it's relatively easy to work your way into a building.
Click to expand...

Wasn't there a line back in the day, something along the lines of: "With a name tag and a clip board you can get through any door." This article reminds me of a few thigns I've done in the past. 😉

Once you're in, it's not hard to find someone going to lunch that forgot to lock their terminal, install one key logger, and off you go...
Click to expand...

Some of the hardware keyloggers out there are really nice, and you can get them on sites like thinkgeek. 😉

Or you just find a terminal that is locked but has a nice phone list printed out. Since Windows keeps the username in the little box for you, calling up the help desk and getting a password reset might not be too tough. 😉

Pssssst.. Anyone want the super-secret recipe for distilling Jack Daniels?

*grin*

- G
Click to expand...

Hey now. That kind of reminds me, I should ask my grandpa if he put me in for membership to the Tennesee Squires yet. 😀
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top