In Cisco probe, misuse or compromise spotted on all firms' networks

Share this article:
College and university networks were 300 percent more likely to contain malware.
Cisco found misuse or compromise on 30 networks probed

After reviewing the domain name system (DNS) traffic of 30 of the world's largest multinational companies last year, Cisco found that all networks generated traffic to sites hosting malware.

The probe was carried out as a means of investigating DNS lookups originating from internal business networks, Cisco revealed in its 2014 Annual Security Report (PDF) released last Wednesday. The test was carried out throughout all of 2013.

While malicious traffic was detected on 100 percent of the international firms' networks, Cisco also saw that 96 percent of the networks specifically communicated traffic to hijacked servers, and that 92 percent transmitted traffic to web pages without content (which is often an indicator that a site is hosting malicious activity), the report said.

Cisco also detected traffic going to military or government websites – notably, at firms that usually don't do business with such organizations.

“Cisco has observed that such sites may be used because of the generally high reputation enjoyed by public or government organizations,” the report said. “Traffic to these sites may not be a definitive sign of a compromise, but for organizations that do not habitually do business with the government or the military, such traffic could indicate that networks are being compromised so that criminals can use them to breach government or military websites and networks.

“In spite of their best efforts to keep their networks free of malicious threats, all of the organizations Cisco examined during 2013 showed evidence of suspicious traffic,” the report added.

On Thursday, Levi Gundert, technical leader with Cisco's TRAC team, told SCMagazine.com in an interview that the findings were “surprising.”  

“I didn't expect 100 percent of those firms' networks to be exhibiting that kind of behavior," Gundert said. "It goes to the point that, it's not if you are going to be compromised, but how long it will take you to detect that compromise."

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Florida Supreme Court rules warrants a must for real-time cell location tracking

Florida Supreme Court rules warrants a must for ...

The Florida Supreme Court put the kibosh on warrantless real-time tracking using location data obtained from cell phone providers.

Modular malware for OS X includes backdoor, keylogger components

Modular malware for OS X includes backdoor, keylogger ...

The modular malware was named "Ventir," by researchers at Kaspersky.

Fake Dropbox login page nabs credentials, is hosted on Dropbox

Fake Dropbox login page nabs credentials, is hosted ...

Symantec researchers received a phishing email linking recipients to a fake Dropbox login page that is hosted on Dropbox's user content domain and served over SSL.