Cisco Blogs

Cisco Blog > Threat Research

Project Aspis


One of the hardest jobs on the Internet is to work the abuse desk at a hosting provider.  These teams have to strike a difficult balance between protecting their customers, ensuring that their services aren’t being abused by malicious actors and delivering the service and convenience their customers expect.  They don’t get near enough credit for their work.

Recently, Talos had the privilege to work with the abuse team from Limestone Networks.  In the course of our joint investigation, we learned that Limestone Networks had been working against the same actor abusing their services for months.  Based on our findings, this actor was costing them approximately $10,000 a month in fraudulent charges plus wasted engineering time and the overhead of managing the abuse tickets this actor was causing.  By working together, Talos and Limestone Networks were able to make their network a difficult one for the actor to work in by rapidly identifying and terminating the systems they were trying to use.  As a result, the actor moved off of their network.

The results of this experience were so positive, both for Limestone Networks and Talos, that today Talos is announcing Project Aspis.

What is Project Aspis?
Provided by Talos, Project Aspis assists hosting providers, in certain situations, who are dealing with malicious actors who are persistent in their environment and a threat to others on the Internet.
Read More »

Tags: , , ,

Cybersecurity: The Holistic Trust Approach

In the past few years, the security industry has invested heavily in the detection and containment of attacks and breaches as a primary focus of innovation. To help protect Cisco, its customers, products, services and partners, we have embarked on a journey to build security and trust into every aspect of our business, including the culture of our workplace itself. The rapid evolution of the threat landscape has made this trust journey a necessity. Exploits are more frequent, better financed, more sophisticated and are causing more damage. Technology shifts like mobility and BYOD are the new normal and have resulted in more points of access for malware, resulting in a larger attack surface. In order to be more effective against the broad range of security threats, the industry must focus on foundational security being present in critical systems. By ensuring that trustworthiness is built into the technology, processes and policies involved in your IT systems, you can reduce risk and the attack surface while enabling more effective overall security.

Read More »

Tags: , , ,

Vulnerability Spotlight: MiniUPnP Internet Gateway Device Protocol XML Parser Buffer Overflow

Vulnerability discovered by Aleksandar Nikolic of Cisco Talos. Post authored by Earl Carter and William Largent

Talos is disclosing the discovery of an exploitable buffer overflow vulnerability in the the MiniUPnP library TALOS-2015-0035 (CVE-2015-6031). The buffer overflow is present in client-side XML parser functionality in miniupnpc. A specially crafted XML response can lead to a buffer overflow, on the stack, resulting in remote code execution.

This miniupnpc buffer overflow is present in client-side part of the library. The vulnerable code is triggered by an oversized XML element name when applications using miniupnpc library are doing initial network discovery upon startup, while parsing the replies from UPNP servers on the local network.

MiniUPnP is commonly used to allow two devices which are behind NAT firewalls to communicate with each other by opening connections in each of the firewalls, commonly known as “hole punching”. Various software implementations of this technique enable various peer-to-peer software applications, such as Tor and cryptocurrency miners and wallets, to operate on the network.

When parsing the UPNP replies, the XML parser is initialized and `parsexml()` function is called:


Read More »

Tags: , , , ,

Cisco to Expand Security Consultancy Services with Acquisition of Portcullis

There’s no question that cybersecurity is top-of-mind for Fortune 500 companies. This, compounded by a significant global security talent shortage, contributes to the burgeoning need for security companies to deliver both a comprehensive technology portfolio and a strong security consultancy service practice.

With this as the backdrop, Cisco is pleased to announce its intent to acquire Portcullis Computer Security, Ltd., a privately held UK-based consultancy that provides cybersecurity services to enterprise clients and the government sector. Portcullis’ range of security consulting services includes assessments to identify vulnerabilities, forensic testing, first responder training to prepare for attacks, policy review and creation, security awareness training, and overall security posture audits. Together, Cisco and Portcullis will provide strategic guidance to our clients to help them with their most difficult security challenges.

Through this acquisition, we increase our ability to offer robust security, risk and compliance services to help clients overcome operational and technical security challenges, anticipate and respond to new threats, and drive new business.

The acquisition of Portcullis also complements the talent and skills Cisco gained through the Neohapsis acquisition earlier this year. Portcullis has a long history of providing security consulting services in Europe, with an extensive customer network, and a respected reputation for penetration testing of web applications and infrastructure. When paired with Cisco’s existing security services portfolio, Portcullis will help accelerate Cisco’s security services business and more quickly expand its security consulting services outside of North America.

The Portcullis team will join the Cisco Security Solutions organization under the leadership of Vice President James Mobley. The acquisition is expected to be complete in the second quarter of fiscal year 2016.


Tags: , , , , , , ,

It’s That Time Again—Announcing the Cisco IOS & XE Software Security Advisory Bundled Publication

Today, we released the last Cisco IOS & XE Software Security Advisory Bundled Publication of 2015. As a reminder, Cisco discloses IOS vulnerabilities on a predictable schedule (the fourth Wednesday of March and September each calendar year).  Last cycle, we began including Cisco Security Advisories addressing vulnerabilities in Cisco IOS XE Software in this publication.  This change was a direct result of your feedback, and we hope the timeline and additional “bundling” continues to allow organizations to plan and ensure resources are available to analyze, test, and remediate vulnerabilities in their environments.

Today’s edition of the Cisco IOS & XE Software Security Advisory Bundled Publication includes three advisories that affect the following technologies:

  • IPv6 First-Hop Security
  • SSH Version 2 (SSHv2)
  • Cisco IOS XE Software

You may recall that Cisco announced enhancements to the Cisco IOS Software Checker last year. As my colleague Kevin Saling shared, the tool can display first-fixed software release data based on the combination of Cisco IOS Software releases and Cisco Security Advisories selected. Users can now quickly identify the first release that addresses all vulnerabilities disclosed in the selected advisories.   Read More »

Tags: , , , ,