In Cisco probe, misuse or compromise spotted on all firms' networks

Share this article:
College and university networks were 300 percent more likely to contain malware.
Cisco found misuse or compromise on 30 networks probed

After reviewing the domain name system (DNS) traffic of 30 of the world's largest multinational companies last year, Cisco found that all networks generated traffic to sites hosting malware.

The probe was carried out as a means of investigating DNS lookups originating from internal business networks, Cisco revealed in its 2014 Annual Security Report (PDF) released last Wednesday. The test was carried out throughout all of 2013.

While malicious traffic was detected on 100 percent of the international firms' networks, Cisco also saw that 96 percent of the networks specifically communicated traffic to hijacked servers, and that 92 percent transmitted traffic to web pages without content (which is often an indicator that a site is hosting malicious activity), the report said.

Cisco also detected traffic going to military or government websites – notably, at firms that usually don't do business with such organizations.

“Cisco has observed that such sites may be used because of the generally high reputation enjoyed by public or government organizations,” the report said. “Traffic to these sites may not be a definitive sign of a compromise, but for organizations that do not habitually do business with the government or the military, such traffic could indicate that networks are being compromised so that criminals can use them to breach government or military websites and networks.

“In spite of their best efforts to keep their networks free of malicious threats, all of the organizations Cisco examined during 2013 showed evidence of suspicious traffic,” the report added.

On Thursday, Levi Gundert, technical leader with Cisco's TRAC team, told in an interview that the findings were “surprising.”  

“I didn't expect 100 percent of those firms' networks to be exhibiting that kind of behavior," Gundert said. "It goes to the point that, it's not if you are going to be compromised, but how long it will take you to detect that compromise."

Share this article:

Sign up to our newsletters

More in News

Senator Leahy prepares bill to tackle NSA snooping

The bill is set to be introduced on Tuesday.

Malware used to compromise payment cards at Wendy's restaurant in Michigan

Customers who paid with credit and debit cards at a Wendy's in Michigan may have had their payment card compromised if they used it at the restaurant for about a month prior to July 15.

Report: Japan eyes law requiring security incident reporting

Bloomberg says the Japanese government is eyeing cyber security legislation to make companies 'fess up to security incidents impacting users.