Cisco pays out $8.6m in damages over faulty government software

Claim argues company left vulnerable video software unpatched for five years

Cisco agreed to pay $8.6 million in civil damages on Wednesday following a legal complaint that argued the company knowingly sold unsecure surveillance equipment to US federal, state and government agencies.

It marks the first time a company has paid out in a False Claims Act dispute over failing cyber security standards, according to attorneys involved in the case speaking to the New York Times.

Advertisement - Article continues below

According to the legal complaint, the US government said video surveillance software supplied by Cisco was "of no value" because it didn't enhance security in the way advertised. It added that the Cisco software, in many cases, reduced the security offered by the government's other systems, too.

An issue was originally identified in 2008 by James Glenn, a Cisco subcontractor in Denmark, after he found he was able to bypass security protocols to take over the video surveillance software, as well as gain access to any network to which the system was connected.

"Due to the vulnerability in Cisco's surveillance system, any user who has or can gain access to one video camera could potentially gain unauthorised access to the entire network of a federal agency," the claim said.

Despite immediately notifying Cisco, Glenn retested the exploit again in 2010, discovering that the software was still vulnerable.

Advertisement
Advertisement - Article continues below

Cisco didn't disclose these vulnerabilities until 2013, five years after Glenn originally reported the issues as part of a vulnerability disclosure practice that, at the time, was in its infancy but is now followed industry-wide.

Advertisement - Article continues below

"Multiple security vulnerabilities exist in versions of Cisco VSM prior to 7.0.0, which may allow an attacker to gain full administrative privileges on the system," said Cisco in its 2013 vulnerability disclosure.

"We are pleased to have resolved a 2011 dispute involving the architecture of a video security technology product," said Cisco spokeswoman Robyn Blum. "There was no allegation or evidence that any unauthorised access to customers' video occurred as a result of the architecture."

Despite fixing the issue, the False Claims Act case argued that Cisco had knowingly supplied its customers with this vulnerable software during the 2008-2013 period.

Among those that joined Glenn in the claim included the states of New York, California, the District of Colombia, as well as Los Angeles International Airport, the Washington D.C. police and the New York City public transport system, all of which had received vulnerable Cisco software.

Some of the highest-value customers also included the US Army, Navy, Air Force and Marine Corps.

Advertisement - Article continues below

Cisco hasn't had a favourable year in the security department. Most notably, vulnerabilities affecting the company's trust anchor module (TAm) alarmed industry experts amid claims they couldn't be patched.

At the company's annual Cisco Live conference in June, its security experts were grilled on the Thrangrycat vulnerability but ultimately sidestepped the issue, essentially blaming it on human error and not offering any insight into the action being taken.

In March, Cisco struggled to fix two vulnerabilities in a range of its small business routers despite repeated patches, leaving the hardware exposed for more than two months.

Advertisement

Recommended

Visit/security/cyber-security/355210/cyber-criminals-torn-over-how-to-adapt-to-post-coronavirus-threat
cyber security

Hackers torn over how to adapt their tactics to the coronavirus pandemic

3 Apr 2020
Visit/security/cyber-security/355185/165-million-britons-experienced-a-cyber-crime-in-the-past-year
cyber security

Report: 16.5 million Britons fell victim to cyber crime in the past year

1 Apr 2020
Visit/cloud/amazon-web-services-aws/355183/aws-launches-amazon-detective
Amazon Web Services (AWS)

AWS launches Amazon Detective for investigating security incidents

1 Apr 2020
Visit/security/privacy/355182/government-to-launch-coronavirus-contact-tracking-app
privacy

UK government to launch coronavirus 'contact tracking' app

1 Apr 2020

Most Popular

Visit/security/privacy/355211/google-releases-location-data-to-showcase-effectiveness-of-coronavirus
privacy

Google releases location data to show effectiveness of coronavirus lockdowns

3 Apr 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

2 Apr 2020
Visit/data-insights/data-management/355170/oracle-cloud-courses-are-free-during-coronavirus-lockdown
data management

Oracle cloud courses are free during coronavirus lockdown

31 Mar 2020