Hackers reopen stolen Cisco code store

An anonymous group of malicious hackers have reopened an online store that sells the stolen source code of prominent software...

An anonymous group of malicious hackers have reopened an online store that sells the stolen source code of prominent software products and is offering the code for Cisco Systems' PIX firewall software for $24,000 (£13,000).

The Source Code Club reappeared online Monday (1 November), using messages to online security discussion groups to announce that it was back in business.

The group is using e-mail and messages posted in a Usenet group to communicate with customers and receive orders for the source code of several security products, including Cisco's PIX 6.3.1 firewall and intrusion detection system (IDS) software from Enterasys Networks, the group said.

The club first surfaced in July, using a web page with an address in the Ukraine and messages posted to the Full-Disclosure security discussion list to advertise its wares.

Initially, the Source Code Club said it was selling "corporate intel[ligence]" to its customers, along with other unnamed services, according to a message posted in July to the Full-Disclosure mailing list by a group or individual using the name "Larry Hobbles".

The club offered the Enterasys Dragon IDS 6.1 source code for $16,000 and the code for file sharing software from Napster, now part of Roxio for $10,000. However, the group was forced to shutter its operations just a few days later, citing the need to redesign its business model.

In its latest incarnation, the Source Code Club is still marketing itself as a corporate espionage service, but is also playing on domestic security fears, appealing to "intelligence agencies [and] government organisations" that want to understand exactly what products like Cisco's PIX firewall do.

The group raised the price on the Enterasys and Napster code, to $19,200 and $12,000 respectively, according to the group's message, which was also posted by someone using the name "Larry Hobbles".

The Source Code Club is also offering private membership for those who buy one full copy of product source code, with the promise of access to a list of more source code "deemed to (sp) sensitive to put up", the message said.

Cisco PIX is one of the most commonly deployed corporate firewalls. Version 6.3.1 was first released in March 2003. The current version of the PIX firewall software is 6.3.4, which was released in July.

Paul Roberts writes for IDG News Service

Read more on IT risk management