<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog &#187; Advanced Threats</title>
	<atom:link href="http://www.networkforensics.com/category/advanced-threats/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Fri, 03 Sep 2010 18:48:14 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.1</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Using the Ponemon Advanced Threat Study</title>
		<link>http://www.networkforensics.com/2010/07/09/ponemon-study/</link>
		<comments>http://www.networkforensics.com/2010/07/09/ponemon-study/#comments</comments>
		<pubDate>Fri, 09 Jul 2010 21:52:10 +0000</pubDate>
		<dc:creator>Eddie Schwartz</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[eddie schwartz]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=341</guid>
		<description><![CDATA[Knowledge of what’s really happening on your network is critical if you are responsible for the protection of your organization’s information assets.  Depending upon where you work and what you believe about both the capabilities of your security team and those of the adversary, you live somewhere on the spectrum of “really concerned about advanced [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/07/09/ponemon-study/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>They are watching you&#8230;and your security vendors.</title>
		<link>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/</link>
		<comments>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/#comments</comments>
		<pubDate>Sun, 30 May 2010 13:32:43 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Gumblar]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Martuz]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[bluehost]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[godaddy]]></category>
		<category><![CDATA[hacked]]></category>
		<category><![CDATA[hostgator]]></category>
		<category><![CDATA[network solutions]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[wordpress]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=309</guid>
		<description><![CDATA[If you&#8217;ve ever seen me, or any of the NetWitness crew, speak on malware, advanced threats or the current threat environment, you&#8217;ll generally hear more than one recurring theme, one of which is:
Your anti-virus solution isn&#8217;t working like you think it is.
This is occurring for a variety of reasons and is ultimately the result of a business-based [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Network detection of x86 buffer overflow shellcode</title>
		<link>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/</link>
		<comments>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/#comments</comments>
		<pubDate>Sun, 16 May 2010 17:32:54 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Breach]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[flex parser]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=297</guid>
		<description><![CDATA[Overview
This technique can detect overflow exploits against software running on the x86 platform, meaning it applies to Windows, Unix, and Mac shellcode. It not only works independently of OS, but it also works for finding both stack and heap based overflows. Most interestingly, it catches most forms of polymorphic shellcode as well. (Actually, it exceeds [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Cyberwar Or Not Cyberwar? And Why That is The Question</title>
		<link>http://www.networkforensics.com/2010/03/26/cyberwar-or-not-cyberwar-and-why-that-is-the-question/</link>
		<comments>http://www.networkforensics.com/2010/03/26/cyberwar-or-not-cyberwar-and-why-that-is-the-question/#comments</comments>
		<pubDate>Fri, 26 Mar 2010 13:05:33 +0000</pubDate>
		<dc:creator>steve</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Leadership]]></category>
		<category><![CDATA[Amit Yoran]]></category>
		<category><![CDATA[Cyberwar]]></category>
		<category><![CDATA[Forbes.com]]></category>
		<category><![CDATA[Mike McConnell]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=271</guid>
		<description><![CDATA[Over the past two months, there has been a tremendous amount of chatter in the security community about the term ‘cyberwar’ and whether or not the US is engaged in a cyberwar.  Mike McConnell (former Director of National Intelligence) wrote a pointed op-ed for The Washington Post claiming that, “The United States is fighting [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/03/26/cyberwar-or-not-cyberwar-and-why-that-is-the-question/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Kneber Update</title>
		<link>http://www.networkforensics.com/2010/02/19/kneber-update/</link>
		<comments>http://www.networkforensics.com/2010/02/19/kneber-update/#comments</comments>
		<pubDate>Fri, 19 Feb 2010 18:05:25 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[kneber]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[zeus]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=207</guid>
		<description><![CDATA[There was a significant amount of coverage yesterday on research performed by NetWitness into a large set of stolen information recovered from a ZeuS botnet.  Some of the information, analysis, and commentary was very beneficial to the broader discussion of threats such as these.  There is, however, some information that we feel we should address.

Kneber [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/19/kneber-update/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>Move over China, here comes Russia</title>
		<link>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/</link>
		<comments>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 03:10:53 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[Cyberwar]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=187</guid>
		<description><![CDATA[While the world took pause to consider the implications of Operation Aurora, and Google lent considerable voice to the concept of Advanced and Persistent Threats (APT), we can ill-afford to believe even for a moment that they are alone in their sophistication or capability.   According to the FBI more than 100 nations have offensive [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>The (Smiling) Face of FUD</title>
		<link>http://www.networkforensics.com/2010/01/22/the-smiling-face-of-fud/</link>
		<comments>http://www.networkforensics.com/2010/01/22/the-smiling-face-of-fud/#comments</comments>
		<pubDate>Fri, 22 Jan 2010 07:24:27 +0000</pubDate>
		<dc:creator>Eddie Schwartz</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Regulatory]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[eddie schwartz]]></category>
		<category><![CDATA[fud]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=107</guid>
		<description><![CDATA[
We recently sent an opt-in email to our contact database talking about the significance of Operation Aurora and the continued ascendancy and lack of advanced threat prevention/detection in many government and commercial organizations.  We also offered a NetWitness proof-of-concept (POC) to security folks concerned about this issue.  And security people should be concerned.
A noted security [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/22/the-smiling-face-of-fud/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Finding Aurora (googlehack)</title>
		<link>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/</link>
		<comments>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/#comments</comments>
		<pubDate>Fri, 15 Jan 2010 15:56:42 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[adobe]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=95</guid>
		<description><![CDATA[I was helping a fortune customer yesterday determine if they were targeted by Operation Aurora.  From everything we know to date, they were not.  How do we know this?  We looked.  In 15 minutes or so, we looked back over the last 6 months of every bit and byte that has [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Competitor Hype and Bull &#8211; It&#039;s the Analytics Stupid!</title>
		<link>http://www.networkforensics.com/2009/10/28/competitor-hype-and-bull/</link>
		<comments>http://www.networkforensics.com/2009/10/28/competitor-hype-and-bull/#comments</comments>
		<pubDate>Wed, 28 Oct 2009 19:28:15 +0000</pubDate>
		<dc:creator>Eddie Schwartz</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[eddie schwartz]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=45</guid>
		<description><![CDATA[I was at the CSI show yesterday and was within earshot of one of our “competitors” who claimed that they were winning against NetWitness because they support 10Gbps and we do not.   I have heard this story frequently from this particular firm, and it’s a bunch of bull.
It amazes me that companies in this space, [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2009/10/28/competitor-hype-and-bull/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
