Cisco pays out $8.6m in damages over faulty government software

Claim argues company left vulnerable video software unpatched for five years

Cisco agreed to pay $8.6 million in civil damages on Wednesday following a legal complaint that argued the company knowingly sold unsecure surveillance equipment to US federal, state and government agencies.

It marks the first time a company has paid out in a False Claims Act dispute over failing cyber security standards, according to attorneys involved in the case speaking to the New York Times.

According to the legal complaint, the US government said video surveillance software supplied by Cisco was "of no value" because it didn't enhance security in the way advertised. It added that the Cisco software, in many cases, reduced the security offered by the government's other systems, too.

An issue was originally identified in 2008 by James Glenn, a Cisco subcontractor in Denmark, after he found he was able to bypass security protocols to take over the video surveillance software, as well as gain access to any network to which the system was connected.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"Due to the vulnerability in Cisco's surveillance system, any user who has or can gain access to one video camera could potentially gain unauthorised access to the entire network of a federal agency," the claim said.

Despite immediately notifying Cisco, Glenn retested the exploit again in 2010, discovering that the software was still vulnerable.

Cisco didn't disclose these vulnerabilities until 2013, five years after Glenn originally reported the issues as part of a vulnerability disclosure practice that, at the time, was in its infancy but is now followed industry-wide.

"Multiple security vulnerabilities exist in versions of Cisco VSM prior to 7.0.0, which may allow an attacker to gain full administrative privileges on the system," said Cisco in its 2013 vulnerability disclosure.

"We are pleased to have resolved a 2011 dispute involving the architecture of a video security technology product," said Cisco spokeswoman Robyn Blum. "There was no allegation or evidence that any unauthorised access to customers' video occurred as a result of the architecture."

Despite fixing the issue, the False Claims Act case argued that Cisco had knowingly supplied its customers with this vulnerable software during the 2008-2013 period.

Advertisement - Article continues below

Among those that joined Glenn in the claim included the states of New York, California, the District of Colombia, as well as Los Angeles International Airport, the Washington D.C. police and the New York City public transport system, all of which had received vulnerable Cisco software.

Some of the highest-value customers also included the US Army, Navy, Air Force and Marine Corps.

Cisco hasn't had a favourable year in the security department. Most notably, vulnerabilities affecting the company's trust anchor module (TAm) alarmed industry experts amid claims they couldn't be patched.

At the company's annual Cisco Live conference in June, its security experts were grilled on the Thrangrycat vulnerability but ultimately sidestepped the issue, essentially blaming it on human error and not offering any insight into the action being taken.

In March, Cisco struggled to fix two vulnerabilities in a range of its small business routers despite repeated patches, leaving the hardware exposed for more than two months.

Featured Resources

Transform the operator experience with enhanced automation & analytics

Bring networking into the digital era

Download now

Artificially intelligent data centres

How the C-Suite is embracing continuous change to drive value

Download now

Deliver secure automated multicloud for containers with Red Hat and Juniper

Learn how to get started with the multicloud enabler from Red Hat and Juniper

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/operating-systems/microsoft-windows/354297/this-exploit-could-give-users-free-windows-7-updates
Microsoft Windows

This exploit could give users free Windows 7 updates beyond 2020

9 Dec 2019
Visit/security/vulnerability/354309/patch-issued-for-critical-windows-bug
vulnerability

Patch issued for critical Windows bug

11 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/data-insights/big-data/354311/google-reveals-uks-most-searched-for-terms-in-2019
big data

Google reveals UK’s most searched for terms in 2019

11 Dec 2019