Cisco source code swipe suspect charged
Swede also indicted over NASA hack
A Swedish man faces computer hacking and trade secret theft charges in the US over allegations he broke into the systems of Cisco and swiped the networking giant's source code.
Philip Gabriel Pettersson (aka Stakkato), 21, also faces two charges of hacking into the network of NASA, including systems at the Ames Research Center and the NASA Advanced Supercomputing Division, Moffett Field, California.
The attacks against NASA took place on two dates in May 2004 and a separate date in October 2004. The alleged attack against Cisco took place in May 2004, at a time when the prime suspect was just 16.
Each of the five computer hacking and theft of trade secret charges Pettersson faces is punishable on conviction by up to ten years in prison and a maximum fine of $250,000. The prosecution against Pettersson follows an investigation by the FBI, the US Secret Service, investigators at NASA and other additional federal agencies. The US Department of Justice worked with the Swedish authorities on the case, an official statement explains.
The theft of Cisco's secret code back in 2004 caused ripples in the security community at the time, with fears that access to the normally proprietary information would make it easier to craft exploits against networking kit. News of the hack emerged after a hacker posted a 2.5MB extract from the source code onto an IRC channel as proof of the attack. Around 800MB of code involving Cisco IOS 12.3 and 12.3t was reportedly swiped.
As far back as 2005, FBI investigators began working on the theory that the Cisco break-in was part of a much larger assault against systems maintained by the American military, NASA and university research labs.
The attack against Cisco was traced back to Uppsala University, Sweden. A Swedish 16-year-old, identified for the first time as Pettersson this week, was charged in March 2005 with breaking into computers at Uppsala University, putting him in the frame for the much larger attack. Charges over the attacks on three Swedish universities were resolved in 2007, when Pettersson was convicted and ordered to pay $25,000 in damages, Wired reports.
Reports dating back to 2005 suggest corrupt versions of the SSH remote administration utility were used to steal computer log-ins and passwords and carry out the attack, which relied on exploiting trusted relationships between lower security University and nominally higher security research institute systems.
Pettersson's current whereabouts remain unclear. Wired reports that Sweden does not extradite its own citizens, so unless separate related charges are filed locally the case may proceed no further.
The five count US indictment against Pettersson can be found here (pdf). ®