Cisco pays out $8.6m in damages over faulty government software

Claim argues company left vulnerable video software unpatched for five years

The Cisco company logo as seen when printed

Cisco agreed to pay $8.6 million in civil damages on Wednesday following a legal complaint that argued the company knowingly sold unsecure surveillance equipment to US federal, state and government agencies.

It marks the first time a company has paid out in a False Claims Act dispute over failing cyber security standards, according to attorneys involved in the case speaking to the New York Times.

According to the legal complaint, the US government said video surveillance software supplied by Cisco was "of no value" because it didn't enhance security in the way advertised. It added that the Cisco software, in many cases, reduced the security offered by the government's other systems, too.

An issue was originally identified in 2008 by James Glenn, a Cisco subcontractor in Denmark, after he found he was able to bypass security protocols to take over the video surveillance software, as well as gain access to any network to which the system was connected.

"Due to the vulnerability in Cisco's surveillance system, any user who has or can gain access to one video camera could potentially gain unauthorised access to the entire network of a federal agency," the claim said.

Despite immediately notifying Cisco, Glenn retested the exploit again in 2010, discovering that the software was still vulnerable.

Cisco didn't disclose these vulnerabilities until 2013, five years after Glenn originally reported the issues as part of a vulnerability disclosure practice that, at the time, was in its infancy but is now followed industry-wide.

"Multiple security vulnerabilities exist in versions of Cisco VSM prior to 7.0.0, which may allow an attacker to gain full administrative privileges on the system," said Cisco in its 2013 vulnerability disclosure.

"We are pleased to have resolved a 2011 dispute involving the architecture of a video security technology product," said Cisco spokeswoman Robyn Blum. "There was no allegation or evidence that any unauthorised access to customers' video occurred as a result of the architecture."

Despite fixing the issue, the False Claims Act case argued that Cisco had knowingly supplied its customers with this vulnerable software during the 2008-2013 period.

Among those that joined Glenn in the claim included the states of New York, California, the District of Colombia, as well as Los Angeles International Airport, the Washington D.C. police and the New York City public transport system, all of which had received vulnerable Cisco software.

Some of the highest-value customers also included the US Army, Navy, Air Force and Marine Corps.

Cisco hasn't had a favourable year in the security department. Most notably, vulnerabilities affecting the company's trust anchor module (TAm) alarmed industry experts amid claims they couldn't be patched.

At the company's annual Cisco Live conference in June, its security experts were grilled on the Thrangrycat vulnerability but ultimately sidestepped the issue, essentially blaming it on human error and not offering any insight into the action being taken.

In March, Cisco struggled to fix two vulnerabilities in a range of its small business routers despite repeated patches, leaving the hardware exposed for more than two months.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Security best practices for PostgreSQL

Securing data with PostgreSQL

Download now

Transform your MSP business into a money-making machine

Benefits and challenges of a recurring revenue model

Download now

The care and feeding of cloud

How to support cloud infrastructure post-migration

Watch now

Recommended

Hackers leak data from dark web marketplace
cyber security

Hackers leak data from dark web marketplace

9 Apr 2021
How to encrypt files and folders in Windows 10
encryption

How to encrypt files and folders in Windows 10

9 Apr 2021
The definitive guide to IT security
Whitepaper

The definitive guide to IT security

9 Apr 2021
Evidence suggests REvil behind Harris Federation ransomware attack
ransomware

Evidence suggests REvil behind Harris Federation ransomware attack

9 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
Data belonging to 500 million LinkedIn users found for sale on hacker marketplace
hacking

Data belonging to 500 million LinkedIn users found for sale on hacker marketplace

8 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021