<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog &#187; Breach</title>
	<atom:link href="http://www.networkforensics.com/category/breach/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Tue, 21 Jun 2011 22:54:21 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1</generator>
	<div id='fb-root'></div>
					<script>
						window.fbAsyncInit = function()
						{
							FB.init({appId: null, status: true, cookie: true, xfbml: true});
						};
						(function()
						{
							var e = document.createElement('script'); e.async = true;
							e.src = document.location.protocol + '//connect.facebook.net/en_US/all.js';
							document.getElementById('fb-root').appendChild(e);
						}());
					</script>	
						<item>
		<title>Network Forensics and Reversing Part 1 &#8211; gzip web content, java malware, and a little JavaScript</title>
		<link>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/</link>
		<comments>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/#comments</comments>
		<pubDate>Sun, 14 Nov 2010 16:52:32 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Decompile]]></category>
		<category><![CDATA[Java malware]]></category>
		<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[NetWitness Rules]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Obfuscated traffic]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=526</guid>
		<description><![CDATA[Something I’ve found unsettling for some time now is the drastically increased usage of gzip as a Content-Encoding transfer type from web servers. By default now, Yahoo, Google, Facebook, Twitter, Wikipedia, and many other organizations compress the content they send to your users. From that list alone, you can infer that most of the HTTP [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>It&#8217;s Malware!</title>
		<link>http://www.networkforensics.com/2010/10/18/its-malware/</link>
		<comments>http://www.networkforensics.com/2010/10/18/its-malware/#comments</comments>
		<pubDate>Mon, 18 Oct 2010 12:33:46 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[zeus]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=461</guid>
		<description><![CDATA[Zeus is evolving. In regards to a new release, one Anti-Virus vendor recently noted: “[the new exe] uses techniques designed to avoid automatic heuristics-based detection.” The discussion then proceeds to examine how the exe is different from previous versions of the malware. Should we be alarmed that Zeus is getting so sophisticated that it evades [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/10/18/its-malware/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Network detection of x86 buffer overflow shellcode</title>
		<link>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/</link>
		<comments>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/#comments</comments>
		<pubDate>Sun, 16 May 2010 17:32:54 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Breach]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[flex parser]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=297</guid>
		<description><![CDATA[Overview This technique can detect overflow exploits against software running on the x86 platform, meaning it applies to Windows, Unix, and Mac shellcode. It not only works independently of OS, but it also works for finding both stack and heap based overflows. Most interestingly, it catches most forms of polymorphic shellcode as well. (Actually, it [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Hackers Swipe Information on Job Seekers From Monster.Com</title>
		<link>http://www.networkforensics.com/2009/01/26/hackers-swipe-information-on-job-seekers-from-monstercom/</link>
		<comments>http://www.networkforensics.com/2009/01/26/hackers-swipe-information-on-job-seekers-from-monstercom/#comments</comments>
		<pubDate>Mon, 26 Jan 2009 20:57:49 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Network Visbility]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=7</guid>
		<description><![CDATA[For the second time in 18 months, Monster.Com has suffered a massive security breach.  In both cases, user account information was stolen, along with the email addresses and names of job seekers.  When this happened in August of 2007, 1.3 Million accounts were taken when an employee of the company divulged his credentials via a [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2009/01/26/hackers-swipe-information-on-job-seekers-from-monstercom/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

