Tag: Cisco’s | SpinSafe

Cisco’s Talos security bods predict new wave of Excel Hell • The Register

December 21, 2022/in Computer Security

It took a few years and one temporary halt, but in July Microsoft finally began blocking certain macros by default in Word, Excel, and PowerPoint, cutting off a popular attack vector for those who target users of Microsoft’s Windows OS and Office suite.

While recent versions of Office block Visual Basic for Applications (VBA) macros by default, older versions of the suite and its component programs remain enormously prevalent.

Blocking macros therefore won’t deter cybercriminals from targeting Microsoft’s signature productivity applications. They’ll just have to find other options.

A report released on Tuesday by researchers from Cisco’s Talos threat intelligence group dissected one: XLL files in Excel.

Microsoft describes XLL files as “a type of dynamic link library (DLL) file that can only be opened by Excel”. They exist to let third-party apps add extra functionality to the spreadsheet.

Miscreants have used XLLs in attacks for several years, with the first malicious samples submitted to VirusTotal in mid-2017.

“For quite some time after that, the usage of XLL files is only sporadic and it does not increase significantly until the end of 2021, when commodity malware families such as Dridex and Formbook started using it,” Vanja Svajcer, outreach researcher for Talos, wrote in the report.

“Currently a significant number of advanced persistent threat actors and commodity malware families are using XLLs as an infection vector and this number continues to grow.”

Those high-profile groups include APT10, a China-linked gang also known as Chessmaster, Potassium, and menuPass that has used XLLs to inject the Anel Backdoor malware. TA410, a cyberespionage group also known as Cicada or Stone Panda, is another user. DoNot, another APT group, and Fin7, a Russia-based organization are also admirers. Fin7 earlier this year began using XLLs sent…

Source…

Gee Rittenhouse And Cisco’s Vision To Democratize Security

July 16, 2021/in Computer Security

Cisco’s Gee Rittenhouse.

Cisco

When one thinks of Cisco, it is typically in regard to networking infrastructure and the associated products, software and services. However, I wanted to learn more about the company’s focus on security, an area where I have recently expanded my coverage as an analyst. The other day I had the opportunity to speak with Gee Rittenhouse, who leads Cisco’s Security Business Group as General Manager and Senior Vice President. During our one-on-one, we discussed several topics, including his overall vision for security, three critical priorities for Cisco’s SecureX portfolio and Cisco’s contributions to the global cybersecurity community.

Deep experience forged in the cloud and security

Before jumping into our conversation, it is helpful to know Mr. Rittenhouse’s background. In total, he has been at Cisco for over a decade, heading up the security division for the last five years, and the Cloud and Virtualization Group for the seven years prior to that. This is an impressive pedigree for his position, given how cloudified and virtualized in nature connectivity is today. Furthermore, these days it is delivered increasingly as a service with integrated security, such as Secure Access Service Edge (SASE). Before Cisco, Mr. Rittenhouse served as president of Bell Labs that capped a nearly fifteen-year total tenure with Alcatel-Lucent. As far as education goes, he holds a Ph.D. in electrical engineering and computer science from the esteemed Massachusetts Institute of Technology.

A vision rooted in three key priorities

During our conversation, Mr. Rittenhouse shared his overall vision for Cisco’s security portfolio. At the heart of it all, Cisco’s goal is to reduce the complexity of deploying and managing security within the enterprise. This is no easy task. There is considerable research that supports the fact that the average midsized to large company often manages more than thirty or more security endpoint solutions. These offerings come in the form of firewalls, antivirus, virtual private networking (VPN), web filtering, threat hunting, active defense and many others.

Cisco aims to “democratize security” making it…

Source…