This post was authored by Nick Biasini and edited by Joel Esler
Over the last several months Talos researchers have been monitoring a massive exploit kit campaign that is utilizing hijacked registrant accounts to create large amounts of subdomains for both initial redirection and exploitation. This campaign has been largely attributed to Angler Exploit Kit with fileless exploits serving various malicious payloads.
The use of hijacked accounts lead to a larger research project into the use of hijacked registrant accounts. During this research the earliest examples were found from a 2011 campaign with sporadic usage until December 2014. Since December 2014 more than 75% of the subdomain activity has occurred indicating a major shift in approach. This behavior has been covered before which discussed some of the older campaigns as well as the hosting indicators (ASN) of the groups making use of the subdomains.
Read More »
Tags: angler, domain shadowing, exploit kit, Talos, Threat Research
2014 was a terrible year for corporate data breaches. If there is to be any silver lining, information security professionals must draw lessons from the carnage. A good place to start is to identify common denominators.
Several of the most damaging incidents started with phishing emails into office (or contractor) networks. Social engineering has gotten so sophisticated and targeted, we can hardly blame the employees (sometimes high-level executives) for clicking on legitimate-looking links. Once an attacker establishes his credentials as the compromised employee, he potentially can gain access to whatever that employee uses. One attacker got in through a corporate software development network that was not sufficiently segregated from other critical networks. In other cases, disgruntled employees with access to valuable customer data were involved.
Clearly, employee access controls are critical. If we can improve these systems, we will go a long way toward securing our networks. This is not as easy as it sounds, however. When information security teams restrict access or revoke privileges, they get pushback. They become obstructionists, bad cops, bureaucrats. To be fair, we really do run the risk of strangling teamwork, erecting stovepipes, and throttling collaboration. How do we construct robust user access controls without being the bad guys?
Read More »
Tags: access control, data breaches, phishing, security, social engineering
If you’re an experienced malware reverse engineer, exploit developer, response specialist, intel analyst, or looking to start your career in security, Talos might be the place for you. We have a number of positions open in Columbia, Maryland; Austin, Texas; San Jose, California; and San Francisco, California. If you are open to relocation to one of those areas, have the right skills, and share some of our beliefs below then applying for one of our numerous positions might be for you.
For those not familiar with Talos, it is Cisco’s premier Threat Intelligence organization that supports all of Cisco’s security portfolio. Detecting and preventing threats that target Cisco customers is our job, and given Cisco’s security footprint and breadth of product portfolio we can engage those threats from Cloud to Core.
It does however, take a special type of individual to join Talos, so give the list below a look and see if your beliefs match up with our distinctive culture. Read More »
Tags: jobs, Talos, Threat Research
The portals that your employees and guests use for enterprise mobility and guest access are a reflection of your company brand and putting your best foot forward means customizing them for a better user experience. The challenge is that customization often requires someone with knowledge of HTML, Java, CSS, and even jQuery skills – in addition to having design skills to properly feature content.
While Cisco offers brand new, out-of-the-box customization with Cisco Identity Services Engine (ISE) 1.3, we wanted to give customers the ability to do much more – so we’ve introduced a new, web-based tool called the ISE Portal Builder that we demo’d at Cisco Live! in Milan, Italy. The show attendees who came by our booth and attended private showings were really amazed by the capabilities offered and they recognized that the ISE Portal Builder enabled almost anyone to build a beautiful guest, BYOD, profile, sponsor, or MDM portal in minutes at no additional cost.
While we already improved the ISE 1.3 ability to quickly model workflows and do basic customization, utilizing the ISE Portal Builder designers can choose from a suite of templates, or create their own using a drag-and-drop page creator. In addition, we’ve made it easy to import, layout, and manage images and other displayed files. You can add advertisements and banners in different places, and even add them into a rotating carousel. You can select up to 17 languages and even create a custom portal for each!
To access the tool go to http://isepb.cisco.com and register using your CCO ID.
Tags: cisco live, Cisco Live Europe, Cisco Live Milan, security
Registration is now open for the upcoming FIRST Technical Colloquium May 4-6, 2015 at Cisco Systems in Amsterdam, Netherlands. Please contact us at email@example.com for any questions. The event already has an exciting preliminary program covering:
- Attacks Against Cloud Server Honeypots
- Emerging Threats – The State of Cyber Security
- Cisco IOS and IOS-XE Integrity Assurance
- CIIP and NIS Directives and Their Implication for CERTs – Recent German Activities
- APT Attack & Mobile Threats – MyCERT Case Studies
- Challenges in Applied Threat Intelligence
- SSHCure: Flow-Based Compromise Detection Using NetFlow/IPFIX
- Next Level Red Team vs. Blue Team
As well as many more current issues facing the incident response community! Learn how organizations operationalize intelligence to mitigate and detect advanced threats, and listen to war stories from front line incident responders and managers.
The event’s line-up includes notables from KPMG, IBM, CERT, Cisco, MyCERT, Alertlogic, and many others. Looking forward to a great TC in Amsterdam!
Jeff Bollinger and Matt Valites
Tags: FIRST, security