In Cisco probe, misuse or compromise spotted on all firms' networks

Share this article:
College and university networks were 300 percent more likely to contain malware.
Cisco found misuse or compromise on 30 networks probed

After reviewing the domain name system (DNS) traffic of 30 of the world's largest multinational companies last year, Cisco found that all networks generated traffic to sites hosting malware.

The probe was carried out as a means of investigating DNS lookups originating from internal business networks, Cisco revealed in its 2014 Annual Security Report (PDF) released last Wednesday. The test was carried out throughout all of 2013.

While malicious traffic was detected on 100 percent of the international firms' networks, Cisco also saw that 96 percent of the networks specifically communicated traffic to hijacked servers, and that 92 percent transmitted traffic to web pages without content (which is often an indicator that a site is hosting malicious activity), the report said.

Cisco also detected traffic going to military or government websites – notably, at firms that usually don't do business with such organizations.

“Cisco has observed that such sites may be used because of the generally high reputation enjoyed by public or government organizations,” the report said. “Traffic to these sites may not be a definitive sign of a compromise, but for organizations that do not habitually do business with the government or the military, such traffic could indicate that networks are being compromised so that criminals can use them to breach government or military websites and networks.

“In spite of their best efforts to keep their networks free of malicious threats, all of the organizations Cisco examined during 2013 showed evidence of suspicious traffic,” the report added.

On Thursday, Levi Gundert, technical leader with Cisco's TRAC team, told in an interview that the findings were “surprising.”  

“I didn't expect 100 percent of those firms' networks to be exhibiting that kind of behavior," Gundert said. "It goes to the point that, it's not if you are going to be compromised, but how long it will take you to detect that compromise."

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.