Cisco Says Vegas Conference Attendees' Information Was Leaked 97
Julie188 writes "Thousands of people got a nasty e-mail this morning from Cisco. The company was warning people that its attendee registration database for its Cisco Live 2010 event was hacked. Cisco Live 2010 is the company's annual user conference, held last week in Las Vegas with an estimated 18,000 in attendance. If it's not embarrassing enough for a company that sells security gear to get hacked, the e-mail also went out to people who didn't register and didn't attend the event. That raises questions about exactly what database was pried open and how bad the damage is. Cisco's e-mail said the hole was quickly closed and only business-card type information was exposed."
Routing error (Score:5, Funny)
the e-mail also went out to people who didn't register and didn't attend the event.
That's even more embarassing than a security breach -- it's a routing error. From Cisco.
Re:Routing error (Score:5, Insightful)
Cisco's customers will not find bureaucratic bungling from them to be anything out of the ordinary, trust me, they are very used to it.
Re: (Score:1)
Re: (Score:2)
She's also a dirty lesbian.
I dunno why that bothers you - even if she wasn't she wouldn't fancy you anyway!
Re: (Score:2, Funny)
Re: (Score:2, Funny)
It seems jokes automatically route around you. Must be a mis-configured sense of humor. Check your subnet mask.
Re: (Score:2)
If anyone has a secret collation of all the email lists used in mass-emailings, it's Cisco.
They also know how often you accidentally use the default ".com" instead of ".org".
Re: (Score:3, Interesting)
For a long time, you could retrieve all of Cisco's customer data (from people who entered data on their web site) from just changing "submit" to "retreive" in the URL. Haven't tried it recently, but they exposed names, addresses and emails by the thousands for years without doing anything to correct it.
Never gave me a good impression of Cisco...
Re: (Score:3, Funny)
Perhaps Cisco's purchase of linksys was more like HP's "purchase" of compaq...
TFA (Score:5, Informative)
We hope you have returned home safely and are back into your normal routine after a busy week at Cisco Live 2010.
We are contacting you because on the final afternoon of Cisco Live, one of our vendors identified an unexpected attempt to access attendee information through ciscolive2010.com. The ability to access this information was quickly removed, but not before some conference listings were accessed.
Cisco Live takes the security of attendee information very seriously and immediately elevated this matter to our chief security officer. His team completed a thorough review and as a result we believe your registration information – specifically your Cisco Live badge number, name, title, company address and email address– was accessed. No other information was available or accessed.
Although these details are commonly accessed by our World of Solutions partners and often freely provided by Cisco Live attendees, we felt it was our responsibility to inform you as quickly as possible. As we cannot yet confirm the information was accessed by an authorized Cisco Live partner, we encourage you to consider the appropriate precautions to protect against any unwanted email.
Please accept our apologies for any inconvenience that may result and feel free to contact us directly at support@ciscolive2010.com if you have any additional questions or information.
We hope you enjoyed your Cisco Live experience and we look forward to welcoming you to Las Vegas in 2011.
Regards,
Re: (Score:2)
Re: (Score:2)
AC's working for Cisco now???
so what? (Score:4, Insightful)
I can't think of anything less important than seeing phonebook-style data made public. Losing credit card numbers or bank account numbers for large groups is bad; losing email addresses is not.
Re:so what? (Score:5, Insightful)
Losing credit card numbers or bank account numbers for large groups is bad; losing email addresses is not.
Losing email addresses is not AS BAD as losing more sensitive information, but it is still not good. I, for one, wouldn't be happy about that information being exposed.
Re:so what? (Score:5, Funny)
Re: (Score:2)
Re: (Score:3, Insightful)
Assuming they weren't arm-twisted into it, I'd say it's cool that they notified everybody.
Competition? (Score:3, Insightful)
Do you really think Cisco is going to be happy if their customer list falls into the hands of their competitors? If this data has profile info like "How much Cisco equipment have you bought in the last year" then it could be VERY VERY useful to their competitors.
Re: (Score:2)
"How much Cisco equipment have you bought in the last year" then it could be VERY VERY useful to their competitors.
How would that data be VERY VERY useful?
(I'm not asking to argue, I'm asking to understand.)
Re: (Score:1, Insightful)
Dear MobileTatsu-NJG, we noticed some information of yours on a website we are monitoring due to the Cisco data loss.
We can offer BETTER security cheaper. Our services have never been compromised. You will be able to trust again. Guaranteed.
Re: (Score:2)
Okay, that's kinda useful. What about 'really really useful'?
Re: (Score:1, Funny)
Re: (Score:3, Insightful)
I thought 'really really useful' would have a more interesting meaning than "SPAM PEOPLE WHO'VE ALREADY PURCHASED THE PRODUCTS THEY NEED". My bad.
Re: (Score:2)
Heh. Yeah, leads to new customers and contracts that have already spent the money and signed contracts. Making lots of sense, there!
Re: (Score:2)
Those are among the best types. You KNOW they spend money, they're not tire-kickers. You know WHAT they spend it on, so you can go in and tailor your pitch accordingly. You also know HOW MUCH they paid, so you can go in and "innocently" work the conversation around to propose a solution that would have saved them a few bucks (since they'll ask for one anyway to see if they go
Re: (Score:2)
... in a year or two or ten when the contract is up and now you've got the uphill battle of vendor lock-in. Heh.
This is how salesmen keep their jobs.
Re: (Score:2)
Re: (Score:2)
You're right! They'd go off and find other people who haven't spent money yet and aren't locked in a contract. Heh.
Re: (Score:1, Funny)
you are an idiot
Here on the internet we say "your an idiot". Please try to keep up.
Re: (Score:2, Insightful)
It's useful if, for example, their competitors want to let everyone know that they buy stolen lists of email addresses to spam/cold call people with.
Re: (Score:2)
How better to sell a product, than to know what the customer is currently buying?
Re: (Score:2)
How better to sell a product, than to know what the customer is currently buying?
Umm just about any way would be better. "Hi! Want to buy our cheaper stuff?" "Shoulda asked me last week before I bought this stuff."
Re: (Score:1)
Re: (Score:3, Insightful)
The fact that supposedly secure information was accessed is the main story. As in: they broke into your house and only managed to get a stuffed toy (this time).
Re: (Score:1)
That all depends on how the information was leaked/stolen. The "how" could be more important to Cisco's reputation than the "what".
It could be worse... (Score:5, Insightful)
Re: (Score:1)
They're a California company, aren't they? Certain breaches must be disclosed under California state law, so their merry band of lawyers probably advised them to make this public. (Yes, they could still stay quiet about it, but...)
It's just the website. (Score:3, Insightful)
Re: (Score:2)
If any gear was subverted I doubt CISCO would admit it.
Re: (Score:2)
Re: (Score:1, Informative)
That assumption is incorrect [cisco.com].
Read the source material. Cisco doesn't like full disclosure, but they are serious about tracking, fixing, and then informing. They mention welcoming contributions from 'independent researchers' several times in their docs, maintain multiple related mailing lists, and provide upload facilities for suspect firmware.
Hmmm [cisco.com]:"Cisco Security Advisory: Hard-Coded SNMP Community Names in Cisco Industrial Ethernet 3000 Series Switches Vulnerability: For Public Release 2010 July 07 1600
Uh huh (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Wait a minute . . . we never actioned SAID that it happened during a week. GRAB HIM!!!!
Is the email from Cisco legit? (Score:5, Interesting)
Re: (Score:2, Funny)
It's legit, I saw your info in a few of the dumps.
Re: (Score:1)
Re: (Score:1)
Re:Is the email from Cisco legit? (Score:5, Interesting)
Re: (Score:2)
I attended last week and have not received any emails of this type.
Re:Is the email from Cisco legit? (Score:4, Funny)
I did not attend and I have not received any emails of this type.
In case you're being thorough about data, here.
Re: (Score:1)
Re:Is the email from Cisco legit? (Score:5, Funny)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2, Funny)
Re:Is the email from Cisco legit? (Score:5, Informative)
Do not shame them for releasing the info! (Score:1)
It is good that a company which got hacked informs possible collateral victims. Yes, at first glance it appears to be particularly embarrassing for a company to get hacked if it advertises to security conscious people -- until you realize that there is no perfect security and every worthwhile target eventually gets hacked. How you deal with it when it happens is what separates the pros from the amateurs.
Re: (Score:2)
LoB
The other day, upon the stairs . . . (Score:3, Funny)
the e-mail also went out to people who didn't register and didn't attend the event.
. . . I met a man, who wasn't there.
He wasn't there again today . . . I think he's from the CIA . . .
Re: (Score:2)
They were going to let their "partners" spam you (Score:5, Interesting)
Cisco collected that information so they and their "partners" could spam you: "... we believe your registration information - specifically your Cisco Live badge number, name, title, company address and email address- was accessed. No other information was available or accessed. Although these details are commonly accessed by our World of Solutions partners".... Their "partner locator" [cisco.com] finds 16601 partners in the United States, 3241 in China, 998 in Russia, 427 in Romania. 330 in Nigeria, and 12 in Afghanistan. So just about anybody who wants that data could get it.
They're just irked that someone who didn't pay for their mailing list might spam you.
Re: (Score:2)
I'm afraid of the boogie-man just as much as the next guy but this stuff people are drumming up here is nothing but a witch hunt. There's nothing here so stop
Re:They were going to let their "partners" spam yo (Score:4, Informative)
Cisco's entire worldwide partner ecosystem != Cisco Live! World of Solutions, which was a vendor booth exhibition at Cisco Live in Las Vegas last week.
I'm not sure how many partners were in World of Solutions but there were perhaps 200. Companies like EMC, APC, CA, etc. You want a light-up rubber ball or blinking shot glass or whatever shiny object they were giving away at their booths, you let them scan your badge. Some had booth babes running around with scanners, which was fairly effective at a conference where 95% of the attendees are men.
Every conference I've ever attended has worked this way.
Motives? (Score:2)
This isn't a non-event being blown into a mountain by a trade rag that wants web hits, is it?
What happens in Vegas (Score:1)
Lies... (Score:2)
Re: (Score:2)
Selling security at conforance (Score:1)
registration of these events done by others than (Score:3, Interesting)
Trusted Technology
World-class Delivery
Event organizers around the world rely on WingateWeb’s event management software and services to deliver the world’s top conferences, conventions and trade shows. Optimize your strategy, maximize your audience and deliver perfect events every time with WingateWeb.
So before people blame Cisco for someone getting into the database and getting attendee data dumps you might want to ask who really was to blame. And FYI, very often the on site software for registering and checking in is not only run on Windows laptops but they are very poorly done. Way to many times redundant information was requested and don't even try to use tab completion for city, state, etc, tab navigation, or the space bar for button activation. I would not doubt that many many other conference databases have been hacked but this Cisco conference hack was found out because they are very security minded and looked into it.
LoB
Re: (Score:2)
So before people blame Cisco for someone getting into the database and getting attendee data dumps you might want to ask who really was to blame.
Cisco is to blame for contracting an incompetent.
It's their conference, it's their fault.
What's next, BP's CEO bears no responsibility for the spill? Er, wait...
Re: (Score:2)
Regarding the BP comment, have you not read anything of how a BP employee was on the DWH and was directing operations to use unsafe measures? The CEO can say all he wants that he's not to blame but his direct employees caused the problems. But of course, it also appears they hired contractors who sidesteps minor things like BOP systems failures an
This is (Score:2)
what happens when you leave the root login as "root" on the database. I mean Cisco and security? LOL. Oh and Hayley Williams was "hacked" too.
Sooo... (Score:1)
They had to know... (Score:2)
it was a gamble.