Feeds

Cisco source code swipe suspect charged

Swede also indicted over NASA hack

Choosing a cloud hosting partner with confidence

A Swedish man faces computer hacking and trade secret theft charges in the US over allegations he broke into the systems of Cisco and swiped the networking giant's source code.

Philip Gabriel Pettersson (aka Stakkato), 21, also faces two charges of hacking into the network of NASA, including systems at the Ames Research Center and the NASA Advanced Supercomputing Division, Moffett Field, California.

The attacks against NASA took place on two dates in May 2004 and a separate date in October 2004. The alleged attack against Cisco took place in May 2004, at a time when the prime suspect was just 16.

Each of the five computer hacking and theft of trade secret charges Pettersson faces is punishable on conviction by up to ten years in prison and a maximum fine of $250,000. The prosecution against Pettersson follows an investigation by the FBI, the US Secret Service, investigators at NASA and other additional federal agencies. The US Department of Justice worked with the Swedish authorities on the case, an official statement explains.

The theft of Cisco's secret code back in 2004 caused ripples in the security community at the time, with fears that access to the normally proprietary information would make it easier to craft exploits against networking kit. News of the hack emerged after a hacker posted a 2.5MB extract from the source code onto an IRC channel as proof of the attack. Around 800MB of code involving Cisco IOS 12.3 and 12.3t was reportedly swiped.

As far back as 2005, FBI investigators began working on the theory that the Cisco break-in was part of a much larger assault against systems maintained by the American military, NASA and university research labs.

The attack against Cisco was traced back to Uppsala University, Sweden. A Swedish 16-year-old, identified for the first time as Pettersson this week, was charged in March 2005 with breaking into computers at Uppsala University, putting him in the frame for the much larger attack. Charges over the attacks on three Swedish universities were resolved in 2007, when Pettersson was convicted and ordered to pay $25,000 in damages, Wired reports.

Reports dating back to 2005 suggest corrupt versions of the SSH remote administration utility were used to steal computer log-ins and passwords and carry out the attack, which relied on exploiting trusted relationships between lower security University and nominally higher security research institute systems.

Pettersson's current whereabouts remain unclear. Wired reports that Sweden does not extradite its own citizens, so unless separate related charges are filed locally the case may proceed no further.

The five count US indictment against Pettersson can be found here (pdf). ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Azure TITSUP caused by INFINITE LOOP
Fat fingered geo-block kept Aussies in the dark
NASA launches new climate model at SC14
75 days of supercomputing later ...
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Cloud unicorns are extinct so DiData cloud mess was YOUR fault
Applications need to be built to handle TITSUP incidents
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
BOFH: WHERE did this 'fax-enabled' printer UPGRADE come from?
Don't worry about that cable, it's part of the config
Stop the IoT revolution! We need to figure out packet sizes first
Researchers test 802.15.4 and find we know nuh-think! about large scale sensor network ops
DEATH by COMMENTS: WordPress XSS vuln is BIGGEST for YEARS
Trio of XSS turns attackers into admins
SanDisk vows: We'll have a 16TB SSD WHOPPER by 2016
Flash WORM has a serious use for archived photos and videos
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.