Breach that hit Cisco wider than thought

[notiCIas]

Breach that hit Cisco wider than thought

Thousands of computers penetrated by attack that stole, posted software from Cisco network.

May 10, 2005: 10:58 AM EDT

NEW YORK (CNN/Money) - The theft of software from a Cisco Systems network last year was only part of a series of widespread attacks that breached thousands of computer systems, federal officials and security investigators now say.

The FBI confirmed that investigators now believe the attacks involved systems serving the American military, NASA and research laboratories.

Software on routers and computers that control the Internet were compromised last year by a hacker, perhaps a youth in Sweden, who has been charged as a juvenile, the agency said.

The FBI said it is unclear to U.S. authorities what, if anything, can be done to prosecute the youth for violating U.S. laws.

The New York Times, which first reported the expanded breadth of the attacks Tuesday, said the youth did not devise a new kind of attack but cleverly organized computers, perhaps with a small band of other hackers, to automate the theft of computer log-ins and passwords.

The paper reported that security specialists at U.S. supercomputer laboratories, looking into intrusions there, discovered a year ago that passwords to Cisco's computers were compromised.

While they notified Cisco (Research), some of the company's software was stolen before officials could respond. Soon after that theft, a portion of the Cisco programming instructions appeared on a Russian Web site.

Cisco moved to shore up its security, but portions of its software code were published on an Internet site in Russia, the Times reported.

The paper also said that sophisticated users could potentially use that software to compromise security on routers used to link computers of Cisco customers.

But the paper said there is not yet evidence that such a compromise has occurred, and the company told the paper, "Cisco believes that the improper publication of this information does not create increased risk to customers' networks."

The first invasions were publicly reported in April of last year.