Incident Response, TDR

In Cisco probe, misuse or compromise spotted on all firms’ networks

After reviewing the domain name system (DNS) traffic of 30 of the world's largest multinational companies last year, Cisco found that all networks generated traffic to sites hosting malware.

The probe was carried out as a means of investigating DNS lookups originating from internal business networks, Cisco revealed in its 2014 Annual Security Report (PDF) released last Wednesday. The test was carried out throughout all of 2013.

While malicious traffic was detected on 100 percent of the international firms' networks, Cisco also saw that 96 percent of the networks specifically communicated traffic to hijacked servers, and that 92 percent transmitted traffic to web pages without content (which is often an indicator that a site is hosting malicious activity), the report said.

Cisco also detected traffic going to military or government websites – notably, at firms that usually don't do business with such organizations.

“Cisco has observed that such sites may be used because of the generally high reputation enjoyed by public or government organizations,” the report said. “Traffic to these sites may not be a definitive sign of a compromise, but for organizations that do not habitually do business with the government or the military, such traffic could indicate that networks are being compromised so that criminals can use them to breach government or military websites and networks.

“In spite of their best efforts to keep their networks free of malicious threats, all of the organizations Cisco examined during 2013 showed evidence of suspicious traffic,” the report added.

On Thursday, Levi Gundert, technical leader with Cisco's TRAC team, told SCMagazine.com in an interview that the findings were “surprising.”  

“I didn't expect 100 percent of those firms' networks to be exhibiting that kind of behavior," Gundert said. "It goes to the point that, it's not if you are going to be compromised, but how long it will take you to detect that compromise."

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.