Cisco pays out $8.6m in damages over faulty government software

Claim argues company left vulnerable video software unpatched for five years

Cisco agreed to pay $8.6 million in civil damages on Wednesday following a legal complaint that argued the company knowingly sold unsecure surveillance equipment to US federal, state and government agencies.

It marks the first time a company has paid out in a False Claims Act dispute over failing cyber security standards, according to attorneys involved in the case speaking to the New York Times.

According to the legal complaint, the US government said video surveillance software supplied by Cisco was "of no value" because it didn't enhance security in the way advertised. It added that the Cisco software, in many cases, reduced the security offered by the government's other systems, too.

An issue was originally identified in 2008 by James Glenn, a Cisco subcontractor in Denmark, after he found he was able to bypass security protocols to take over the video surveillance software, as well as gain access to any network to which the system was connected.

"Due to the vulnerability in Cisco's surveillance system, any user who has or can gain access to one video camera could potentially gain unauthorised access to the entire network of a federal agency," the claim said.

Despite immediately notifying Cisco, Glenn retested the exploit again in 2010, discovering that the software was still vulnerable.

Cisco didn't disclose these vulnerabilities until 2013, five years after Glenn originally reported the issues as part of a vulnerability disclosure practice that, at the time, was in its infancy but is now followed industry-wide.

"Multiple security vulnerabilities exist in versions of Cisco VSM prior to 7.0.0, which may allow an attacker to gain full administrative privileges on the system," said Cisco in its 2013 vulnerability disclosure.

"We are pleased to have resolved a 2011 dispute involving the architecture of a video security technology product," said Cisco spokeswoman Robyn Blum. "There was no allegation or evidence that any unauthorised access to customers' video occurred as a result of the architecture."

Despite fixing the issue, the False Claims Act case argued that Cisco had knowingly supplied its customers with this vulnerable software during the 2008-2013 period.

Among those that joined Glenn in the claim included the states of New York, California, the District of Colombia, as well as Los Angeles International Airport, the Washington D.C. police and the New York City public transport system, all of which had received vulnerable Cisco software.

Some of the highest-value customers also included the US Army, Navy, Air Force and Marine Corps.

Cisco hasn't had a favourable year in the security department. Most notably, vulnerabilities affecting the company's trust anchor module (TAm) alarmed industry experts amid claims they couldn't be patched.

At the company's annual Cisco Live conference in June, its security experts were grilled on the Thrangrycat vulnerability but ultimately sidestepped the issue, essentially blaming it on human error and not offering any insight into the action being taken.

In March, Cisco struggled to fix two vulnerabilities in a range of its small business routers despite repeated patches, leaving the hardware exposed for more than two months.

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Recommended

The ultimate guide to landing a cyber security career
Careers & training

The ultimate guide to landing a cyber security career

30 Sep 2020
8 of the most secure web browsers
web browser

8 of the most secure web browsers

25 Sep 2020
Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Nokia will replace Huawei as BT's largest 5G equipment provider
5G

Nokia will replace Huawei as BT's largest 5G equipment provider

29 Sep 2020