Avatar

This post was authored by Aleksandar Nikolic, Warren Mercer, and Jaeson Schultz.

Summary

MiniUPnP is commonly used to allow two devices which are behind NAT firewalls to communicate with each other by opening connections in each of the firewalls, commonly known as “hole punching”. Various software implementations of this technique enable various peer-to-peer software applications, such as Tor and cryptocurrency miners and wallets, to operate on the network.

In 2015 Talos identified and reported a buffer overflow vulnerability in client side code of the popular MiniUPnP library. The vulnerability was promptly fixed by the vendor and was assigned TALOS-CAN-0035 as well as CVE 2015-6031. Martin Zeiser and Aleksandar Nikolic subsequently gave a talk at PacSec 2015 (“Universal Pwn n Play”) about the client side attack surface of UPnP and this vulnerability was part of it.

Talos has developed a working exploit against Bitcoin-qt wallet which utilizes this library. The exploit developed by Talos includes a Stack Smashing Protection (SSP) bypass, the details of which we will discuss here.

The Vulnerability

The vulnerability lies in the XML parser code of the MiniUPnP library in the IGDstartelt function:

Vulnerable XML parser code of the MiniUPnP library
Vulnerable XML parser code of the MiniUPnP library

 

IGDdatas struct definition
IGDdatas struct definition

 

Read More >>

Authors

Talos Group

Talos Security Intelligence & Research Group

Avatar

When dealing with TLS connections, it is important to understand how a client (in most cases this is a web browser) will be acting. Let’s quickly check some of the steps that are happening when a TLS connection is made.

A web server will send its certificate down to the requesting client during the TLS handshake. But it is not only a single certificate but usually a complete chain of certificates.
There is the server certificate , in many cases an intermediate CA certificate and finally a Root CA.
When you check your browser this will look like this:
TLS-1

Continue reading “Where is my (intermediate) TLS certificate?”

Authors

Tobias Mayer

Technical Solution Architect

EMEA Security Architecture Team

Avatar

Retail’s Big Show offers ideas and insights into the ever-changing industry of retail. This year’s NRF 2016 drew a large and influential group of the most innovative retail leaders. Throughout the show, these leaders held extensive one-on-one conversations and hosted general sessions by some of the industry’s starring professionals.

If you missed the show (or if you want to discuss it with your peers), please invite your accounts to join us at #CiscoChat on Twitter next Tuesday, February 2, at 10:00 am PST/1:00 pm EST to talk about the changes trends emerging out of NRF and during the next year.

Together, we’ll provide highlights and consider questions such as:

  • What were the latest and most influential gadgets you saw at NRF16?
  • Where should retailers focus in this fast-changing economy?
  • How can retailers better compete with e-commerce retailers?
  • What are the most important upcoming trends, and where should you put your money in 2016?
  • And many more

I’m especially happy to be joined in this live discussion by Janet Schijns, Vice President at Cisco partner Verizon Enterprise Solutions (@channelsmart).  Janet brings a unique perspective to digitization and innovation in retail.  Whether you want to join in the chat or just listen to the discussion, it promises to be a lively and informative hour.

Screen Shot 2016-02-01 at 3.03.32 PM
To participate in the Chat:

  • Make sure you’re logged onto your Twitter account.
  • Search for #CiscoChat, and click on the Live tab.
  • The @CiscoRetail handle is the moderator and will welcome guests and post questions.
  • Please submit your answers in the following format: ex. A1: Write Answer. #CiscoChat

Follow @CiscoRetail and me @techguyshaun – you don’t want to miss this. Be sure to bring your questions!

Authors

Shaun Kirby

Director and Chief Technology Officer

Cisco Consulting Services

Avatar

These are especially difficult times for the retail industry.

For starters, several of retail’s marquee names announced store closings or layoffs following a disappointing holiday sales season. Retailers simply haven’t benefited from cheaper gas and a relatively strong overall U.S. job market —retail sales declined 0.1 percent in December from the previous month, according to the U.S. Department of Commerce.

Making matters worse, brick-and-mortar retailers are quickly losing ground to online giants like Amazon. According to a recent article in The New York Times, Amazon captured almost a quarter of all U.S. retail sales growth last year.

The retail industry’s comparatively low IT spending has also placed it at high risk of disruption by technology-savvy incumbents and digital-native upstarts. In fact, according to the Global Center for Digital Business Transformation (DBT Center), retail ranked third among 12 industries studied in terms of potential for digital disruption over the next five years.

Clearly, all of this should send a strong message to the retail industry. Yet, at least from a “digital transformation” perspective, the industry doesn’t appear to be listening. Although 56 percent of retail executives say digital disruption is a board-level or CXO concern, fewer than one-quarter are doing anything about it by actively disrupting their own businesses.

It is not altogether surprising, then, that according to a new Cisco study, retailers captured just 15 percent of their potential Digital Value at Stake in 2015. By comparison, financial services realized almost twice as much digital value.

There are, however, some excellent examples of effective digitization in the retail industry.

http://www.slideshare.net/CiscoBusinessInsights/digital-transformation-in-retail-57076299

A perfect case in point is F&F, the clothing brand of U.K. grocery retailer Tesco.

F&F needed to address multiple challenges: limited floor space, little visibility into what customers did in stores, and poor customer awareness of F&F online.

Using a combination of in-store Wi-Fi and integrated mobile and tablet access for shop associates, F&F management can now track customer journeys and gain insight into customer behavior. Free Wi-Fi gave F&F the ability to track customer journeys in greater detail. It also provided a means to deliver curated content and context-specific offers directly to customers’ mobile phones, incorporating connected advertising.

Over three months, the number of customers logging onto Wi-Fi increased 50 percent. Customers spent roughly 30 to 50 percent of their physical dwell time online on personal devices, while also engaging with push offers. This engagement changed customer behavior, increasing dwell times and sales.

F&F was also eager to build its online customer base to augment its relatively small physical floor space. Key technologies in the store made this possible. Interactive kiosks allowed customers to order items online and have them delivered to the store or their home. This reduced the number of customers leaving empty-handed because their size or preferred style wasn’t in stock at the store. It also offered a strong introduction to F&F online—and to styles customers might not otherwise have seen. The brand has experienced a steady increase in online sales as a result.

F&F has also piloted “remote expert,” a means of providing virtual access to a style advisor who isn’t physically present in the store. Although associates on the floor are armed with tablets to help advise customers, remote experts offer personal styling advice. Using the same kinds of technology tools as next-generation workers, remote experts employ video conferencing to increase customer engagement—supporting sales, especially on higher-ticket items—and to promote F&F as a fashion brand.

For many retailers, the biggest challenge in becoming a digital business is figuring out where to start. Here are three steps to take:

  1. Evaluate where you are on the journey—are you using digital capabilities to enable operational efficiency, differentiate through improved business processes, or define new business models? There’s a good chance that you already have key elements of the required digital foundation.
  2. Build an investment plan to meet your business objectives. Prioritize the biggest areas of payback and plan short-term gains that can fund ongoing investment.
  3. Finally, use this investment plan to close the gap between the
digital capabilities you need and the outcomes you want. While the fundamentals will remain the same, your objectives and priorities may change over time.

The time for retailers to act is now.

Authors

Michael Riegel

Vice President

Industries, Platforms, and Services Marketing

Avatar

The City of Schenectady, New York has long been on the forefront of the Smart Cities movement, utilizing new technology to help improve its municipal services and government operations. The city’s goal is to become a fully integrated, connected city by implementing a wireless network that takes advantage of the Internet of Everything (IoE), the networked connection of people, process, data, and things.

To work towards this goal, the city has rolled out numerous IoE-based projects designed to improve city life in a variety of areas based on an outdoor City-owned Wi-Fi network that can perform multiple simultaneous tasks. For example, the city has installed a smart LED lighting system in the downtown area, which will allow them to automatically brighten or dim the lights to help save on energy costs. The smart lighting system will automatically report on broken lights so they can be fixed faster, ensuring citizens feel safe downtown. The city is also testing out a smart parking system, which uses cameras to monitor open parking spots. The same cameras can help police fight crime and give citizens a live view of their streets to feel safer at night. These projects have allowed Schenectady to both save taxpayer money and increase the quality of services it is providing to its citizens, and the city continues to look to the future using technology to attract new business and startups.

This past week, Mayor Gary R. McCarthy announced the appointment of a Smart City commission, designed to help Schenectady further take advantage of new technology to improve the quality of life for its residents. The commission will work on a variety of technology and sustainability initiatives, focusing on the next generation of wireless communications and product development. This new commission will allow Schenectady to continue to grow and expand as a connected city, and will only bring more benefits to its citizens. As the new commission chairman Mark Little put it: “It’s all about making Schenectady the best place it can be to live and to work.”

Learn more about how Cisco’s Connected+Smart Cities solutions can help your city!

Authors

Tony Morelli

Vice President, SLED East

Avatar

#CiscoChampion Radio is a podcast series by Cisco Champions as technologists. Today we’re discussing the 2016 Cisco Annual Security Report with Cisco Subject Matter Expert Tim Gurganus.

CiscoChampionbadge_announcementGet the Podcast

  • Listen to this episode
  • Download this episode (right-click on the episode’s download button)
  • View this episode in iTunes

Cisco Guest

Tim Gurganus (@hotzoner), Security Incident Manager at Cisco

Tim is a Security Incident Manager with Cisco Active Threat Analytics. He monitors security of Cisco’s largest customers, including Hospitals, financial service companies, and others. He helps to make sure a method exists to detect and mitigate attacks across Cisco’s customers. Tim contributed to the threat intelligence section of the Annual Security Report.

Cisco Champion Hosts

  • Brandon Carroll (@brandoncarroll), Network Security Solutions Engineer
  • Jake Gillen  (@jakegillen), Senior Security Engineer
  • Chris Brown (@ChrisKnowsIT), Senior Network Operations Manager

Moderator

Continue reading “#CiscoChampion Radio, S3|Ep. 3. 2016 Cisco Annual Security Report”

Avatar

What’s your winning combo for big data and analytics? This may come as a surprise to you – but given that the Superbowl is approaching – I am going to use a football analogy. As we get ready for the game in 2 weeks, we have a tale of two quarterbacks. One is an established quarter back with a long-standing history of victories. The other –new, up and coming—brings a ton of enthusiasm and fresh legs to the game.

This is like the analytics market place of today. We have established players like SAP, SAS, and IBM and new ones such as Splunk, Platfora, and ParStream (now part of Cisco). On this 10th birthday of Hadoop, we have established technology approaches from Cloudera, Hortonworks and MapR using MapReduce being challenged by the new player to the game – Spark, which is starting to score big in the technology field. The big 3 are taking different approaches to this, which should make it fun to watch.

Ok, guess how Cisco UCS ties into all of this? The foundation under all of these players is a solid integrated infrastructure that enables the game to be played and won. And like Levi’s stadium, UCS is the state of the art infrastructure with all of the most essential bells and whistles (Yes, I’m talking about service profiles for policy execution and management and ACI for business-relevant software defined networking (SDN)). Because in football and in business, it’s important to go ALL THE WAY, you can rely on Cisco’s end-to-end solutions to make this happen.

Trying to figure out the winning combination for your team? I pulled together a ‘scouting report’ to help you put together your ideal fantasy team. Bookmark this, because this is where you can find the latest and greatest and how each player partners with Cisco to bring you insights to action.

Cisco Big Data and Analytics Latest Content

Continue reading “Big Data and Analytics Touchdowns”

Authors

Renee Yao

No longer at Cisco

Avatar

Reuseable water bottle

“Be the change you wish to see in the world.” – Mahatma Gandhi

Many millennials like myself are looking for ways we can change the world. It’s one of the things that brought me to Cisco. Cisco changes the way we work, live, play, and learn – my mission as an individual is similar: change the way we waste.

I’ve always had a bit of an entrepreneurial spirit, so apart from my full-time job at Cisco, I am a DO School Fellow and run a social venture called packageless, which is my journey of living with less packaging and less waste.

Because I studied packaging as an undergrad, I know that our nation makes up 5% of the world’s population but generates about 40% of the world’s waste. This incentivized me to want to do something in regards to the unhealthy amount of trash we were planting into our planet.

Although I currently work in the IT division, I still try to live a packageless life and drive change wherever I am. My first 3 months at Cisco were filled with the traditional orientation activities, but also figuring out how Cisco is currently reducing its waste, and finding opportunities to improve the current system. I’ve chatted with amazing individuals who work on Cisco Sustainability, and found groups such as Pack it Green and Cisco Recycling that take ownership of decreasing our waste and handling it responsibly.

Chrstine Liu

While Cisco has set several sustainability programs in place, my “new eye” as a new hire has noticed quite a few potential areas for behavioral change as a working individual: there’s room for all of us to improve the amount of waste we create. So in light of the fact that the average American produces about 5 pounds of waste every day, here are three simple tips of how to change the way you waste at work:

  1. Bring your own water bottle, mug or thermos.
    If you buy just one cup of coffee or tea in a disposable cup every day, you’ll end up creating about 23 lbs of waste in one year. Cisco offers its employees convenient paper cups for water and hot beverages, but it doesn’t take too much of an extra effort to bring your own bottle to work. And hey, a bottle or thermos will be sure to prevent coffee spills on that work laptop of yours.
  1. Pack lunch in a reusable container, or enjoy a sit-down meal at the Cisco Café with a friend rather than getting it to-go at your desk.
    In 2012, 7 million tons of solid waste was attributed to one-time use plates and cups. It’s simple to order to-go, but how many of us end up sitting in the restaurant we’re visiting anyway? Go ahead and find a fellow coworker to sit down and have lunch with, whether it be at the Cisco Café with reusable plates and utensils, a nice restaurant, or with your own packed lunch. Life’s too short to not take lunch breaks.
  1. If you use paper towels, learn to make the most of them.
    This 4 minute TED talk puts it nicely. There is a right way to use a single paper towel efficiently: shake excess water from your hands first, fold the paper towel in half for optimum absorbency, wipe, and find a recycle bin! This is definitely a better alternative than pulling out 3-4 paper towels that are quickly used and crumpled into the waste bin.

The reason why I chose Cisco as a company is now becoming clearer: I find that I can be my packageless self and explore outlets for creating change, such as writing these few tips for you all here.

It’s been barely 100 days here as a new hire, but life at Cisco has been only encouraging for my entrepreneurial efforts, vision for driving impact, and passions for a more sustainable world. I feel so privileged to work at a company that aims to transform our society for the better, and I hope that we too, as individuals, can follow that same model of wanting to be the change we wish to see in this world.

Join the Cisco team and make your own change.

Authors

Christine Liu

IT Analyst at Cisco Systems

Cisco CVC IT

Avatar

One of the common topics of debate in data management circles has been – do Big Data solutions replace traditional database solutions? The industry trends show that it will not, but instead the two will coexist and complement each other.

Following this theme of coexistence, two years ago we at Cisco shared our vision of integrating with platforms such as SAP HANA and Hadoop. As you would already know, SAP HANA is an in-memory database, built for transactional, analytical, and application logic processing while with Hadoop from the Apache software foundation is designed for  large scale data management and distributed data processing that can analyze massive amounts of diverse datasets. Combing SAP HANA with Hadoop can bring new dimension to data analytics. Our new integration shows how a shared infrastructure and unified management architecture delivers simpler and scalable implementations at a lower cost of ownership.

Last year, we announced our partnership and commitment to SAP HANA Vora – an Apache Spark-based execution framework for interactive memory analytics on Hadoop. SAP HANA Vora on the Cisco UCS and ACI offers unified administration across SAP HANA and Hadoop distributions, role- and policy-based automation, full active- active redundancy, high performance and exceptional scalability needed to support growing business demands.

Today, we are happy to announce the availability of a Cisco Validated Design (CVD), Cisco UCS Integrated Infrastructure for Big Data and Cisco ACI for SAP HANA Vora, that provides step by step design guidelines that have been comprehensively tested and documented to help ensure faster, more reliable and predictable deployments at a lower total cost of ownership.

Additional Information  

Authors

Raghunath Nambiar

No Longer with Cisco