<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog &#187; Network Visbility</title>
	<atom:link href="http://www.networkforensics.com/category/network-visbility/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Tue, 21 Jun 2011 22:54:21 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1</generator>
	<div id='fb-root'></div>
					<script>
						window.fbAsyncInit = function()
						{
							FB.init({appId: null, status: true, cookie: true, xfbml: true});
						};
						(function()
						{
							var e = document.createElement('script'); e.async = true;
							e.src = document.location.protocol + '//connect.facebook.net/en_US/all.js';
							document.getElementById('fb-root').appendChild(e);
						}());
					</script>	
						<item>
		<title>Finding injection attacks by looking for injection attacks is a fail</title>
		<link>http://www.networkforensics.com/2011/06/21/finding-injection-attacks-by-looking-for-injection-attacks-is-a-fail/</link>
		<comments>http://www.networkforensics.com/2011/06/21/finding-injection-attacks-by-looking-for-injection-attacks-is-a-fail/#comments</comments>
		<pubDate>Tue, 21 Jun 2011 01:53:00 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[code]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[injection]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Obfuscated traffic]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=820</guid>
		<description><![CDATA[I tend to be an opponent of looking for bad stuff by using &#8220;known bad dictionaries&#8221; like IP lists, signatures, etc. I tend to soapbox about how you can find far more known and unknown bad stuff by employing a methodology of separating out &#8220;presumed good&#8221; stuff, and examining outliers. Check out any of the [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/06/21/finding-injection-attacks-by-looking-for-injection-attacks-is-a-fail/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Network Forensics and Reversing Part 1 &#8211; gzip web content, java malware, and a little JavaScript</title>
		<link>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/</link>
		<comments>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/#comments</comments>
		<pubDate>Sun, 14 Nov 2010 16:52:32 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Decompile]]></category>
		<category><![CDATA[Java malware]]></category>
		<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[NetWitness Rules]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Obfuscated traffic]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=526</guid>
		<description><![CDATA[Something I’ve found unsettling for some time now is the drastically increased usage of gzip as a Content-Encoding transfer type from web servers. By default now, Yahoo, Google, Facebook, Twitter, Wikipedia, and many other organizations compress the content they send to your users. From that list alone, you can infer that most of the HTTP [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/11/14/network-forensics-and-reversing-part-1-gzip-web-content-java-malware-and-a-little-javascript/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>It&#8217;s Malware!</title>
		<link>http://www.networkforensics.com/2010/10/18/its-malware/</link>
		<comments>http://www.networkforensics.com/2010/10/18/its-malware/#comments</comments>
		<pubDate>Mon, 18 Oct 2010 12:33:46 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Breach]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[zeus]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=461</guid>
		<description><![CDATA[Zeus is evolving. In regards to a new release, one Anti-Virus vendor recently noted: “[the new exe] uses techniques designed to avoid automatic heuristics-based detection.” The discussion then proceeds to examine how the exe is different from previous versions of the malware. Should we be alarmed that Zeus is getting so sophisticated that it evades [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/10/18/its-malware/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Tracking the &#8220;Here You Have&#8221; Worm</title>
		<link>http://www.networkforensics.com/2010/09/10/tracking-the-here-you-have-worm/</link>
		<comments>http://www.networkforensics.com/2010/09/10/tracking-the-here-you-have-worm/#comments</comments>
		<pubDate>Fri, 10 Sep 2010 15:59:59 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=420</guid>
		<description><![CDATA[If you&#8217;ve kept a view on security news in the past 24 hours, you may have noticed some press around a new email worm spreading on corporate networks.   Dubbed the &#8220;Here You Have&#8221; worm, it is a good case study on how to manage emerging threats with your NetWitness technology.  You can find additional [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/09/10/tracking-the-here-you-have-worm/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Leveraging Custom Actions in NetWitness Investigator</title>
		<link>http://www.networkforensics.com/2010/08/30/leveraging-custom-actions-in-netwitness-investigator/</link>
		<comments>http://www.networkforensics.com/2010/08/30/leveraging-custom-actions-in-netwitness-investigator/#comments</comments>
		<pubDate>Mon, 30 Aug 2010 17:19:33 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[pentesting]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=393</guid>
		<description><![CDATA[One of the lesser-known features that was recently introduced in NetWitness Investigator are Custom Actions.   Have you ever been analyzing a pcap in Investigator and thought &#8220;I wish there was an easy way to push this information into another system&#8230;&#8221;.   Custom Actions is a flexible extension system that will allow you to do [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/08/30/leveraging-custom-actions-in-netwitness-investigator/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Network detection of x86 buffer overflow shellcode</title>
		<link>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/</link>
		<comments>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/#comments</comments>
		<pubDate>Sun, 16 May 2010 17:32:54 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Breach]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[flex parser]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=297</guid>
		<description><![CDATA[Overview This technique can detect overflow exploits against software running on the x86 platform, meaning it applies to Windows, Unix, and Mac shellcode. It not only works independently of OS, but it also works for finding both stack and heap based overflows. Most interestingly, it catches most forms of polymorphic shellcode as well. (Actually, it [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Move over China, here comes Russia</title>
		<link>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/</link>
		<comments>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 03:10:53 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[Cyberwar]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=187</guid>
		<description><![CDATA[While the world took pause to consider the implications of Operation Aurora, and Google lent considerable voice to the concept of Advanced and Persistent Threats (APT), we can ill-afford to believe even for a moment that they are alone in their sophistication or capability.   According to the FBI more than 100 nations have offensive [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>IDS Legacy is Institutionalized Failure</title>
		<link>http://www.networkforensics.com/2010/01/26/ids-legacy-is-institutionalized-failure/</link>
		<comments>http://www.networkforensics.com/2010/01/26/ids-legacy-is-institutionalized-failure/#comments</comments>
		<pubDate>Tue, 26 Jan 2010 19:40:00 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[fud]]></category>
		<category><![CDATA[ids]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=77</guid>
		<description><![CDATA[The news is rife with discussions about systemic failures in the intelligence community.  It is a good thing we do not judge information security on the same scale of success.  I know of not a SINGLE enterprise network that is not being repeatedly compromised with a deluge of malicious code.  Can you imagine a world [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/26/ids-legacy-is-institutionalized-failure/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Finding Aurora (googlehack)</title>
		<link>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/</link>
		<comments>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/#comments</comments>
		<pubDate>Fri, 15 Jan 2010 15:56:42 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[adobe]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=95</guid>
		<description><![CDATA[I was helping a fortune customer yesterday determine if they were targeted by Operation Aurora. From everything we know to date, they were not. How do we know this? We looked. In 15 minutes or so, we looked back over the last 6 months of every bit and byte that has left that company, and [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>A Bucket of Sand?</title>
		<link>http://www.networkforensics.com/2010/01/11/a-bucket-of-sand/</link>
		<comments>http://www.networkforensics.com/2010/01/11/a-bucket-of-sand/#comments</comments>
		<pubDate>Mon, 11 Jan 2010 18:08:44 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=72</guid>
		<description><![CDATA[Did NetWitness actually release a new product that consists of a bucket filled with sand? The answer is yes, but the real question is why? We released B.O.S. in an attempt to sound the wake-up call… Organizations can no longer afford to rely so heavily on perimeter based technologies, on signatures for identification of threats [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/11/a-bucket-of-sand/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>

