Cisco Blogs


Cisco Blog > Internet of Everything

Cisco Sizzle – April Edition

Welcome to the Cisco Sizzle! Each month, we’re rounding up the best of the best from across our social media channels for your reading pleasure. From the most read blog posts to the top engaging content on Facebook or LinkedIn, catch up on things you might have missed, or on the articles you just want to see again, all in one place.

Let’s take a look back at the top content from April…

Are you prepared for the IoE Economy?
In this blog post, Cisco’s Chief Futurist Dave Evans and Joseph Bradley of Cisco’s Internet Business Solutions Group share two use cases for IoE – connected marketing and connected healthcare – with both a near-term and futuristic lens.

John Chambers Receives Honorary Doctorate
Cisco Chairman and CEO John Chambers received an honorary doctorate from San Jose State University at the honors convocation ceremony in April. His main message to the grads? Never stop learning.

Tomorrow Starts Here
What if the next big thing, isn’t big at all? It’s lots of things, all waking up. Explore how IoE will change the way we work, live, play and learn.

Innovation May Spark Economic Renewal
If we’ve learned anything from the last two decades, it’s that every time we think the Internet has exhausted its transformative potential, something highly disruptive comes along. Cisco CTO Padmasree Warrior talks IoE innovation and the $14.4 trillion value at stake that will spur research, new investments and new jobs.

A Typical Day
Explore how the Internet of Everything is sparking innovation and instigating meaningful actions to happen faster.

Is Your Site Safe From Attack?
Ars Technica editor Dan Godin compiled a list of Apache website compromises that have been impacting thousands of legitimate sites by allowing entrance to remote attackers. Until his research, no one had realized the magnitude of the situation and how widespread the attacks were. Check out the full insights, including potential solutions, in this blog post.

Three Networking Truths
There’s a clear consensus that one size does not fit all when it comes to deploying Software Defined Networking (SDN) solutions to different organizations. Time to dispel common networking misconceptions with three truths about the future of networking as Cisco sees it.

Check out the Cisco Storify feed for even more great content!Cisco_Sizzle_Final

Tags: , , , , , , , , , , , , , , , , , , , , , , , , ,

Linux/CDorked FAQs

Last Friday (April 26), ESET and Sucuri simultaneously blogged about the discovery of Linux/CDorked, a backdoor impacting Apache servers running cPanel. Since that announcement, there has been some confusion surrounding the exact nature of these attacks. Rather than reinvent the analysis that has already been done, this blog post is intended to clear up some of the confusion.

When did Linux/CDorked first appear?
According to Cisco TRAC analysis, the first encounter was on March 4, 2013.

How is Linux/CDorked related to DarkLeech?
The appearance of Linux/CDorked coincided with a drop in the number of DarkLeech infections, an indication the attacker(s) may be one and the same.

Unlike DarkLeech, the Linux/CDorked infections appear to be only targeting Apache servers with cPanel installed. Conversely, DarkLeech was found on servers running a variety of control panels (or not).  Read More »

Tags: , , , , , ,

Apache Darkleech Compromises

Dan Goodin, editor at Ars Technica, has been tracking and compiling info on an elusive series of website compromises that could be impacting tens of thousands of otherwise perfectly legitimate sites. While various researchers have reported various segments of the attacks, until Dan’s article, no one had connected the dots and linked them all together.

Dubbed “Darkleech,” thousands of Web servers across the globe running Apache 2.2.2 and above are infected with an SSHD backdoor that allows remote attackers to upload and configure malicious Apache modules. These modules are then used to turn hosted sites into attack sites, dynamically injecting iframes in real-time, only at the moment of visit.

Because the iframes are dynamically injected only when the pages are accessed, this makes discovery and remediation particularly difficult. Further, the attackers employ a sophisticated array of conditional criteria to avoid detection:

  • Checking IP addresses and blacklisting security researchers, site owners, and the compromised hosting providers;
  • Checking User Agents to target specific operating systems (to date, Windows systems);
  • Blacklisting search engine spiders;
  • Checking cookies to “wait list” recent visitors;
  • Checking referrer URLs to ensure visitor is coming in via valid search engine results. Read More »

Tags: , , , , , ,