Cisco IOS Source Code Stolen?

A Russian Web site, SecurityLab, reported that someone claimed to have stolen the source code for Cisco IOS 12.x operating system. The code is used is huge number of Cisco devices.

According to the report someone boasted on IRC about breaking into Cisco's network and stealing the code. The person made available approximately 2.5MB of code in an effort to prove the theft actually took place.

SecurityLabs said the total amount of code stolen was approximately 800MB. At the time of this writing Cisco had not commented publically about the alleged theft.

In February code for Windows 2000 and Windows NT somehow leaked onto the Internet. But that leak was the result of poor security on a network belonging to someone with legitimate access to the code.

To date there hasn't been much fallout as a result of Microsoft's leaked code. One security vulnerability was discovered in IE 5.x and at least one worm takes advantage of a vulnerability that was discovered as a result of access to the leaked source code.

However if security-related bugs are found in the leaked Cisco IOS code and the discoverers don't notify Cisco and given them time to produce patches then the ramifications could potentially become huge since so many network uses Cisco hardware, including core Internet service providers.