<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog &#187; network forensics</title>
	<atom:link href="http://www.networkforensics.com/category/network-forensics/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Tue, 21 Jun 2011 22:54:21 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1</generator>
	<div id='fb-root'></div>
					<script>
						window.fbAsyncInit = function()
						{
							FB.init({appId: null, status: true, cookie: true, xfbml: true});
						};
						(function()
						{
							var e = document.createElement('script'); e.async = true;
							e.src = document.location.protocol + '//connect.facebook.net/en_US/all.js';
							document.getElementById('fb-root').appendChild(e);
						}());
					</script>	
						<item>
		<title>Using WinDbg to Begin Reverse Engineering Unknown Malware from Memory</title>
		<link>http://www.networkforensics.com/2011/06/13/using-windbg-to-begin-reverse-engineering-unknown-malware-from-memory/</link>
		<comments>http://www.networkforensics.com/2011/06/13/using-windbg-to-begin-reverse-engineering-unknown-malware-from-memory/#comments</comments>
		<pubDate>Mon, 13 Jun 2011 03:03:46 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[PE EXE files]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=788</guid>
		<description><![CDATA[Part Two in a multi-part series on holistic, multi-disciplinary analysis and reversing. &#160; The last post, &#8220;Mutex Analysis: The Canary in the Coal Mine,&#8221; started off showing to use mutexes to discover malware that is difficult to locate using more traditional methods and tools. We used a live compromised system for the example and the [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/06/13/using-windbg-to-begin-reverse-engineering-unknown-malware-from-memory/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Mutex Analysis: The Canary in the Coal Mine (and Discovering New Families of Malware?)</title>
		<link>http://www.networkforensics.com/2011/06/11/mutex-analysis-the-canary-in-the-coal-mine-and-discovering-new-families-of-malware/</link>
		<comments>http://www.networkforensics.com/2011/06/11/mutex-analysis-the-canary-in-the-coal-mine-and-discovering-new-families-of-malware/#comments</comments>
		<pubDate>Sat, 11 Jun 2011 10:34:40 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[hacked]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=755</guid>
		<description><![CDATA[Part One in a multi-part series on holistic, multi-disciplinary analysis and reversing. This post is based on a presentation I gave at the last Thotcon, but was really prompted by a case from a couple days ago. It&#8217;s an interesting example of how the same disciplined methodologies for finding malicious traffic on the network also [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/06/11/mutex-analysis-the-canary-in-the-coal-mine-and-discovering-new-families-of-malware/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Network Forensics and Reverse Engineering Part 2 – A deeper dive into real JavaScript analysis and reverse engineering</title>
		<link>http://www.networkforensics.com/2011/01/12/network-forensics-and-reverse-engineering-part-2-%e2%80%93-a-deeper-dive-into-real-javascript-analysis-and-reverse-engineering/</link>
		<comments>http://www.networkforensics.com/2011/01/12/network-forensics-and-reverse-engineering-part-2-%e2%80%93-a-deeper-dive-into-real-javascript-analysis-and-reverse-engineering/#comments</comments>
		<pubDate>Wed, 12 Jan 2011 03:36:14 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[Decompile]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Reverse Engineering]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=699</guid>
		<description><![CDATA[Introduction In our first post in the forensics and reversing series, we examined why HTTP gzip content encoding is a larger and more serious problem than most people realize. We’ll use the end of the first post as a starting point for analysis in this post. It also serves as an example of something far [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/01/12/network-forensics-and-reverse-engineering-part-2-%e2%80%93-a-deeper-dive-into-real-javascript-analysis-and-reverse-engineering/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Network Forensics and Reversing Part 1 &#8211; gzip web content, java malware, and a little JavaScript</title>
		<link>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/</link>
		<comments>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/#comments</comments>
		<pubDate>Sun, 14 Nov 2010 16:52:32 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Decompile]]></category>
		<category><![CDATA[Java malware]]></category>
		<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[NetWitness Rules]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Obfuscated traffic]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=526</guid>
		<description><![CDATA[Something I’ve found unsettling for some time now is the drastically increased usage of gzip as a Content-Encoding transfer type from web servers. By default now, Yahoo, Google, Facebook, Twitter, Wikipedia, and many other organizations compress the content they send to your users. From that list alone, you can infer that most of the HTTP [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Bredolab Takedown – Just the tip of the Iceberg</title>
		<link>http://www.networkforensics.com/2010/11/04/bredolab-takedown-%e2%80%93-just-the-tip-of-the-iceberg/</link>
		<comments>http://www.networkforensics.com/2010/11/04/bredolab-takedown-%e2%80%93-just-the-tip-of-the-iceberg/#comments</comments>
		<pubDate>Thu, 04 Nov 2010 12:06:59 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=487</guid>
		<description><![CDATA[This post discusses the Bredolab trojan and the findings from a 3-month NetWitness investigation which clearly show that Bredolab is much, much more than an advanced trojan threat. Bredolab is actually part of a multi-faceted profit center leveraging dynamic techniques to stay ahead of detection systems such as anti-virus and serve multiple constituencies' criminal activities.]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/11/04/bredolab-takedown-%e2%80%93-just-the-tip-of-the-iceberg/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>It&#8217;s Malware!</title>
		<link>http://www.networkforensics.com/2010/10/18/its-malware/</link>
		<comments>http://www.networkforensics.com/2010/10/18/its-malware/#comments</comments>
		<pubDate>Mon, 18 Oct 2010 12:33:46 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[zeus]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=461</guid>
		<description><![CDATA[Zeus is evolving. In regards to a new release, one Anti-Virus vendor recently noted: “[the new exe] uses techniques designed to avoid automatic heuristics-based detection.” The discussion then proceeds to examine how the exe is different from previous versions of the malware. Should we be alarmed that Zeus is getting so sophisticated that it evades [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/10/18/its-malware/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Network detection of x86 buffer overflow shellcode</title>
		<link>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/</link>
		<comments>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/#comments</comments>
		<pubDate>Sun, 16 May 2010 17:32:54 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Breach]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[flex parser]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=297</guid>
		<description><![CDATA[Overview This technique can detect overflow exploits against software running on the x86 platform, meaning it applies to Windows, Unix, and Mac shellcode. It not only works independently of OS, but it also works for finding both stack and heap based overflows. Most interestingly, it catches most forms of polymorphic shellcode as well. (Actually, it [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>A Bucket of Sand?</title>
		<link>http://www.networkforensics.com/2010/01/11/a-bucket-of-sand/</link>
		<comments>http://www.networkforensics.com/2010/01/11/a-bucket-of-sand/#comments</comments>
		<pubDate>Mon, 11 Jan 2010 18:08:44 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=72</guid>
		<description><![CDATA[Did NetWitness actually release a new product that consists of a bucket filled with sand? The answer is yes, but the real question is why? We released B.O.S. in an attempt to sound the wake-up call… Organizations can no longer afford to rely so heavily on perimeter based technologies, on signatures for identification of threats [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/11/a-bucket-of-sand/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>The Power of Realtime Network Forensics &#8211; Advanced Malware Detection</title>
		<link>http://www.networkforensics.com/2009/11/27/the-power-of-realtime-deep-packet-inspection/</link>
		<comments>http://www.networkforensics.com/2009/11/27/the-power-of-realtime-deep-packet-inspection/#comments</comments>
		<pubDate>Fri, 27 Nov 2009 13:28:59 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=53</guid>
		<description><![CDATA[Hey gang&#8230;Alex here&#8230;writing from the NetWitness Labs&#8230; At NetWitness, our focus is on providing analytics, and we are constantly looking at new ways to apply our unique analytics to the realm of content development.  We know that we have really cool technology and want to showcase that as well as push the envelope of what [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2009/11/27/the-power-of-realtime-deep-packet-inspection/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

