Feeds

Cisco source code swipe suspect charged

Swede also indicted over NASA hack

Top three mobile application threats

A Swedish man faces computer hacking and trade secret theft charges in the US over allegations he broke into the systems of Cisco and swiped the networking giant's source code.

Philip Gabriel Pettersson (aka Stakkato), 21, also faces two charges of hacking into the network of NASA, including systems at the Ames Research Center and the NASA Advanced Supercomputing Division, Moffett Field, California.

The attacks against NASA took place on two dates in May 2004 and a separate date in October 2004. The alleged attack against Cisco took place in May 2004, at a time when the prime suspect was just 16.

Each of the five computer hacking and theft of trade secret charges Pettersson faces is punishable on conviction by up to ten years in prison and a maximum fine of $250,000. The prosecution against Pettersson follows an investigation by the FBI, the US Secret Service, investigators at NASA and other additional federal agencies. The US Department of Justice worked with the Swedish authorities on the case, an official statement explains.

The theft of Cisco's secret code back in 2004 caused ripples in the security community at the time, with fears that access to the normally proprietary information would make it easier to craft exploits against networking kit. News of the hack emerged after a hacker posted a 2.5MB extract from the source code onto an IRC channel as proof of the attack. Around 800MB of code involving Cisco IOS 12.3 and 12.3t was reportedly swiped.

As far back as 2005, FBI investigators began working on the theory that the Cisco break-in was part of a much larger assault against systems maintained by the American military, NASA and university research labs.

The attack against Cisco was traced back to Uppsala University, Sweden. A Swedish 16-year-old, identified for the first time as Pettersson this week, was charged in March 2005 with breaking into computers at Uppsala University, putting him in the frame for the much larger attack. Charges over the attacks on three Swedish universities were resolved in 2007, when Pettersson was convicted and ordered to pay $25,000 in damages, Wired reports.

Reports dating back to 2005 suggest corrupt versions of the SSH remote administration utility were used to steal computer log-ins and passwords and carry out the attack, which relied on exploiting trusted relationships between lower security University and nominally higher security research institute systems.

Pettersson's current whereabouts remain unclear. Wired reports that Sweden does not extradite its own citizens, so unless separate related charges are filed locally the case may proceed no further.

The five count US indictment against Pettersson can be found here (pdf). ®

High performance access to file storage

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Kingston DataTraveler MicroDuo: Turn your phone into a 72GB beast
USB-usiness in the front, micro-USB party in the back
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Inside the Hekaton: SQL Server 2014's database engine deconstructed
Nadella's database sqares the circle of cheap memory vs speed
BOFH: Oh DO tell us what you think. *CLICK*
$%%&amp Oh dear, we've been cut *CLICK* Well hello *CLICK* You're breaking up...
Just what could be inside Dropbox's new 'Home For Life'?
Biz apps, messaging, photos, email, more storage – sorry, did you think there would be cake?
Amazon reveals its Google-killing 'R3' server instances
A mega-memory instance that never forgets
Cisco reps flog Whiptail's Invicta arrays against EMC and Pure
Storage reseller report reveals who's selling what
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.