Avatar

 

CEWN-Header1-550x71

Anuja SinghGuest Blog and Interview by Anuja Singh 

Welcome to the September edition of our monthly CEWN segment about role models. We all make resolutions and set goals to improve ourselves– but somewhere along the way, life interrupts our plans, we find ourselves juggling different priorities and invariably things get dropped. What you will find in this segment are experiences of some ordinary people who remained focused and went on to achieve extraordinary results. Everyone featured in this series has faced challenges and opportunities that the rest of us can identify with. Let’s draw inspiration from the choices they made and aspire to the outcomes they created.

ShubraShubhra Sinha

Find out more about Shubhra.

Cisco Empowered Women’s Network (CEWN): You have had a successful career spanning two different continents – what impact did your formative years have on you? Continue reading “Carpe Diem – Seize the day! Inspiration from everyday heroes of CEWN: Shubhra Sinha”

Authors

Rehana Rehman

No Longer with Cisco

Avatar

This post is authored by Earl Carter & Holger Unterbrink.

Overview

Talos is often tasked with mapping the backend network for a specific piece of malware. One approach is to first reverse engineer the sample and determine exactly how it operates. But what if there is no time or resources to take the sample apart? This post is going to show how to examine a botnet from the Fareit family, starting with just an IP address. Then, using sandbox communities like Cisco ThreatGRID and open source products like Gephi and VirusTotal, we will track down and visualize the botnet.

Talos recently discovered some activity from the Fareit trojan. This family of malware has a significant history associated with malware distribution. It is mainly an information stealer and malware downloader network which installs other malware on infected machines. In this campaign, it mainly tries to steal Firefox and other credentials. It is possible that this botnet is sold as a pay-per-infection botnet in the underground markets. Pay-per-infection is an underground business model where criminals are paying other criminals to distribute their malware. The analysis below was mainly done in July 2015. Let’s take a walk on the wild side….

AMPs behaviour based detection found suspicious executables that downloaded files by using the following URLs in one of our customer networks.

http://89.144.2.119/cclub02.exe
http://89.144.2.115/cclub02.exe

We began analysing the infrastructure with focus on these two IP addresses and checked what other files they had been distributing. Initial analysis showed that VirusTotal found 25 and 38 files distributed from these two IP addresses. Almost all of the files in VirusTotal had different hashes, but similar or identical filenames. The following list is a sample of some of the files found in VirusTotal.

1197cb2789ef6e29abf83938b8519fd0c56c5f0195fa4cbc7459aa573d9e521b (cclub02.exe)
58f49493aa5d3624dc225ba0a031772805af708b38abd5a620edf79d0d3f7da0 (cclub02.exe)
d1b98b7b0061fbbdfc9c2a5a5f3f3bbb0ad3d03125c5a8ab676df031a9900399 (cclub02.exe)
c054e80e02c923c4314628b5f9e3cb2cad1aa9323cbcd79d34205ad1e3cad6c3 (cclub12.exe)
bd30242996a3689c36008a63d007b982d9de693766d40e43fe13f69d76e61b63 (cclub12.exe)
c609ef45f7ff918cbac24755a3a3becc65d1c06e487acd801b76a1f46e654765 (tarhun1.exe)

Continue reading “Down the Rabbit Hole: Botnet Analysis for Non-Reverse Engineers”

Authors

Talos Group

Talos Security Intelligence & Research Group

Avatar

Next week I’m headed to the Gartner Symposium/ITxpo 2015 in Orlando – and I’m looking forward to seeing many of our top clients and many analysts from Gartner. The energy and buzz created by bringing thousands of organizational leaders, engineers, experts, and analysts together for five days of learning and collaboration is inspiring.

This year the event is very focused on DIGITAL – and the event description talks about how “a digital wave is sweeping through every industry, organization and culture.” This line sounds pretty familiar – it sounds a lot like what we at Cisco have been saying about how digital transformation is bringing together people, process, data, and things in new and important ways. From countries to businesses, it’s changing everything.

All of the momentum is behind digitization, and I’m excited to connect with our customers and partners to hear about their experiences going digital and to learn about how Cisco can continue to enable this transformation. Continue reading “Innovate in the Digital Era: Previewing the Gartner ITXpo”

Authors

Michael Riegel

Vice President

Industries, Platforms, and Services Marketing

Avatar

Cisco’s secret weapons are our engineers and our commitment to innovation that solves our customers’ business problems.

When we committed ourselves to being the leader in networking virtualization in the service provider industry, our team has been maniacally focused on Network Function Virtualization (NFV) to enable our customers to transform their network architectures and prepare their businesses for the future.

We doubled the number of virtualized functions last year, and have done the same again this year, to reach more than 100 – a number that represents the breadth of our portfolio and the scope of the opportunity this new approach to networking brings to service providers.

Today was an important validation of our commitment to NFV and another strong proof point as to how virtualization is moving beyond “proof of concept” and into the largest networks on the globe. Together, with AT&T, we announced that our two companies are collaborating to enhance the AT&T Network on Demand platform by developing and deploying advanced virtualized technologies, including software-based customer premise equipment (CPE), that will deliver expanded benefits to business customers.

Untitled

AT&T is utilizing Software Defined Networking (SDN) and NFV technologies to create dynamic, on-demand services. In March, we announced our joint efforts with virtualization to connect cars in Europe, and are pleased that we can work again with our long-standing partner, as they lead the shift to next-generation networking by providing customers more flexible and scalable services and experiences.

AT&T and other trailblazing service providers are in an enviable position, bringing together people, processes, data, and things to make networked connections more relevant and valuable than ever before.

By combining Cisco’s expertise and industry-leading portfolio with AT&T’s vision and industry leadership, together we are working to capture new business opportunities that deliver on the promise of virtualization.

Authors

Kelly Ahuja

Senior Vice President

Service Provider Business, Products, and Solutions

Avatar

Not surprisingly, as a networking company Cisco frequently publishes predictions on the growth of Internet traffic. Bragging unintended, typically the forecasts are pretty accurate. In a 2012 report we predicted that by 2017 there would be 2.5 devices and related connections for every person on earth, while there would be 5 devices and related connections for every Internet user in the same year. In the same report, we also predicted that this burst in hyperconnectivity – including machine to machine connections that are increasingly prevalent with growth of the Internet of Things (IoT) – would create more global network traffic in 2017 alone than in all prior “Internet years” combined.

How correct were our predictions? You don’t have to wait until 2017 for an answer. Welcome to the early arrival of the future of networked communications – a future where the hyper-distribution of information is driving new business demands, and where the old rules of data management and analytics no longer apply. Data is no longer passive. Central stores of stale information aren’t sufficient. Analytics can’t be an afterthought. The new rules require that you live your business daily on the edge of your network, where vital customer and market data is created. And you need to be prepared to respond to what you learn immediately. Are you ready to live on the edge?

The Future is Now . . . Like it or Not Continue reading “Connected Analytics: Learn to Live on the Edge – and Love It!”

Authors

Mala Anand

No Longer with Cisco

Avatar

There’s no question that cybersecurity is top-of-mind for Fortune 500 companies. This, compounded by a significant global security talent shortage, contributes to the burgeoning need for security companies to deliver both a comprehensive technology portfolio and a strong security consultancy service practice.

With this as the backdrop, Cisco is pleased to announce its intent to acquire Portcullis Computer Security, Ltd., a privately held UK-based consultancy that provides cybersecurity services to enterprise clients and the government sector. Portcullis’ range of security consulting services includes assessments to identify vulnerabilities, forensic testing, first responder training to prepare for attacks, policy review and creation, security awareness training, and overall security posture audits. Together, Cisco and Portcullis will provide strategic guidance to our clients to help them with their most difficult security challenges.

Through this acquisition, we increase our ability to offer robust security, risk and compliance services to help clients overcome operational and technical security challenges, anticipate and respond to new threats, and drive new business.

The acquisition of Portcullis also complements the talent and skills Cisco gained through the Neohapsis acquisition earlier this year. Portcullis has a long history of providing security consulting services in Europe, with an extensive customer network, and a respected reputation for penetration testing of web applications and infrastructure. When paired with Cisco’s existing security services portfolio, Portcullis will help accelerate Cisco’s security services business and more quickly expand its security consulting services outside of North America.

The Portcullis team will join the Cisco Security Solutions organization under the leadership of Vice President James Mobley. The acquisition is expected to be complete in the second quarter of fiscal year 2016.

 

Authors

Rob Salvagno

Vice President

Corporate Development and Cisco Investments

Avatar

During Elon Musk’s presentation of Tesla Powerwall, a battery system that lets you store energy to power your home, he shared a slide showing a small area of the Texas panhandle – with a small blue square representing the land area necessary to produce enough solar power to meet the entire electric power needs of the United States.

“...very little land is required to get rid of all fossil fuel electricity generation in the United States.”  Elon Musk
“…very little land is required to get rid of all fossil fuel electricity generation in the United States.” Elon Musk

As you might expect, this generated quite a bit of controversy about whether or not his assertion is even within the realm of possibility.

Does Musk’s claim pass the smell test? Continue reading “Tesla Powerwall May Be a Game Changer for PV Energy Production, but Distribution Networking is Vital”

Authors

Rick Geiger

Executive Director

Utilities and Smart Grid

Avatar

It seems people sometimes have this view of SDN as addressing rather esoteric use cases and situations. However, the reality is that while there are instances of ‘out there stuff’ happening, there are many situations where we see customers leverage the technology to address pretty straightforward issues. And these issues are often similar across different business/vertical/customer types.

Aftab Rasool is Senior Manager, Data Center Infrastructure and Service Design Operations for Du.   I recently had the chance to talk with him about Cisco’s flagship SDN solution – Application Centric Infrastructure (ACI) – and Du’s experience with it. I found there were many instances of Du using ACI to simply make traditional challenges easier to deal with.

https://www.youtube.com/watch?v=n_yfj3trHNc&list=PLFT-9JpKjRTAB1jxPP0GT_PEdI6Hu32TQ&index=1

Du is an Information & Communications Technology (ICT) company based in Dubai. They offer a broad range of services to both consumer and business markets, including triple play to the home, mobile voice/data, and hosting. The nature of their business means the data center, and thus the data center network, is critical to their success. They need a solution to effectively handle challenges of both deployment, as well as operations…and that’s where ACI comes in.

I’ll quickly use the metaphor of driving to summarize the challenges Aftab covers in the video. He addresses issues that are both ‘in the rear view mirror’ as well as ‘in the windshield’ – with both being generalizable to lots of other customers. What I mean is that there are issues from the past that, though they are largely behind the car and visible in the mirror, still impact the driving experience. There are also issues on the horizon that are visible through the windshield, but are just now starting to come into focus and have effect.

Rear view mirror issues – These are concepts as basic as scalability associated with spanning tree issues, or sub optimal use of bandwidth, also due to spanning tree limitations. These issues are addressed with ACI, as there is no spanning tree in the fabric, and the use of Equal Cost Multi Pathing (ECMP) allows use of all links. Additionally, use of BiDi allows use of existing 10G fiber plant for 40G upgrades, thus obviating the expense and hassle of fiber upgrades. As a result, the ACI fabric, based on Nexus 9000’s, provides all the performance and capacity Du needs.

Windshield issues – These are represented by a range of things that result from business’s need for speed, yet are diametrically opposed by the complexity of most data centers. The need for speed through automation is becoming more and more critical, as is simplifying the operating environment, particularly as the business must scale. Within this context, Aftab mentioned both provisioning and troubleshooting.

Provisioning: Without ACI, provisioning involved getting into each individual switch, making requisite changes – configuring VLANs, L3, etc. It also required going into L4-7 services devices to assure they were configured properly and worked in concert with the L2 and L3 configurations. This device by device configuration not only was time consuming, but created the potential for human error. With ACI, these and other types of activities are automated and happen with a couple of clicks.

Troubleshooting: Before ACI, troubleshooting was complicated and time consuming, in part because they had to troll through each switch, look at various link by link characteristics to check for errors, etc. With ACI, healthscores make it easy and fast to pinpoint where the challenge is.

Please take a few minutes to check out what Aftab has to say about these, and other aspects of his experience with ACI at Du.

 

Authors

Craig Huitema

No Longer with Cisco

Avatar

Growing Market Share Leadership in Mobility – #1 in Packet Core, EPC, MME, SGW, & PGW for Q2 2015, driven by demand for LTE, Wi-Fi, VoWi-Fi, VoLTE, Policy Suite.

Wasn’t that a great lunar event Sunday Night? We had a great view of the full moon, lunar eclipse, blood moon last night that won’t occur again until 2030 something. A before and after picture of the lunar event.

Blood Moon

So the reason I am blogging this week is to give you an update from Continue reading “ACG Research says “Cisco Packet Core is Accelerating””

Authors

Jim O'Leary

Sr. Manager Mobile Solutions Marketing