<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog</title>
	<atom:link href="http://www.networkforensics.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Tue, 21 Jun 2011 22:54:21 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1</generator>
	<div id='fb-root'></div>
					<script>
						window.fbAsyncInit = function()
						{
							FB.init({appId: null, status: true, cookie: true, xfbml: true});
						};
						(function()
						{
							var e = document.createElement('script'); e.async = true;
							e.src = document.location.protocol + '//connect.facebook.net/en_US/all.js';
							document.getElementById('fb-root').appendChild(e);
						}());
					</script>	
						<item>
		<title>Finding injection attacks by looking for injection attacks is a fail</title>
		<link>http://www.networkforensics.com/2011/06/21/finding-injection-attacks-by-looking-for-injection-attacks-is-a-fail/</link>
		<comments>http://www.networkforensics.com/2011/06/21/finding-injection-attacks-by-looking-for-injection-attacks-is-a-fail/#comments</comments>
		<pubDate>Tue, 21 Jun 2011 01:53:00 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[code]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[injection]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Obfuscated traffic]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=820</guid>
		<description><![CDATA[I tend to be an opponent of looking for bad stuff by using &#8220;known bad dictionaries&#8221; like IP lists, signatures, etc. I tend to soapbox about how you can find far more known and unknown bad stuff by employing a methodology of separating out &#8220;presumed good&#8221; stuff, and examining outliers. Check out any of the [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/06/21/finding-injection-attacks-by-looking-for-injection-attacks-is-a-fail/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Using WinDbg to Begin Reverse Engineering Unknown Malware from Memory</title>
		<link>http://www.networkforensics.com/2011/06/13/using-windbg-to-begin-reverse-engineering-unknown-malware-from-memory/</link>
		<comments>http://www.networkforensics.com/2011/06/13/using-windbg-to-begin-reverse-engineering-unknown-malware-from-memory/#comments</comments>
		<pubDate>Mon, 13 Jun 2011 03:03:46 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[PE EXE files]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=788</guid>
		<description><![CDATA[Part Two in a multi-part series on holistic, multi-disciplinary analysis and reversing. &#160; The last post, &#8220;Mutex Analysis: The Canary in the Coal Mine,&#8221; started off showing to use mutexes to discover malware that is difficult to locate using more traditional methods and tools. We used a live compromised system for the example and the [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/06/13/using-windbg-to-begin-reverse-engineering-unknown-malware-from-memory/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Mutex Analysis: The Canary in the Coal Mine (and Discovering New Families of Malware?)</title>
		<link>http://www.networkforensics.com/2011/06/11/mutex-analysis-the-canary-in-the-coal-mine-and-discovering-new-families-of-malware/</link>
		<comments>http://www.networkforensics.com/2011/06/11/mutex-analysis-the-canary-in-the-coal-mine-and-discovering-new-families-of-malware/#comments</comments>
		<pubDate>Sat, 11 Jun 2011 10:34:40 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[hacked]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[trojan]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=755</guid>
		<description><![CDATA[Part One in a multi-part series on holistic, multi-disciplinary analysis and reversing. This post is based on a presentation I gave at the last Thotcon, but was really prompted by a case from a couple days ago. It&#8217;s an interesting example of how the same disciplined methodologies for finding malicious traffic on the network also [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/06/11/mutex-analysis-the-canary-in-the-coal-mine-and-discovering-new-families-of-malware/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Dissecting the CVE-2011-0611 Flash Player Zero Day &#8211; Part 1</title>
		<link>http://www.networkforensics.com/2011/04/13/dissecting-the-cve-2011-0611-flash-player-zero-day/</link>
		<comments>http://www.networkforensics.com/2011/04/13/dissecting-the-cve-2011-0611-flash-player-zero-day/#comments</comments>
		<pubDate>Wed, 13 Apr 2011 14:28:21 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[apt]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=738</guid>
		<description><![CDATA[Within the past few days,  We&#8217;ve seen the emergence of a new zero-day attack that involves flash files embedded into word documents.   These have purportedly been used in an attempt to compromise machines belonging to government-affiliated persons, as detailed here: http://krebsonsecurity.com/2011/04/new-adobe-flash-zero-day-being-exploited/ http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html As detailed in previous posts,  NetWitness tries to stay away from &#8220;signature&#8221; based [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/04/13/dissecting-the-cve-2011-0611-flash-player-zero-day/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ZeuS and SpyEye Merge!   Business as usual for NetWitness Users!</title>
		<link>http://www.networkforensics.com/2011/02/03/zeus-and-spyeye-merge-business-as-usual-at-netwitness/</link>
		<comments>http://www.networkforensics.com/2011/02/03/zeus-and-spyeye-merge-business-as-usual-at-netwitness/#comments</comments>
		<pubDate>Thu, 03 Feb 2011 18:19:17 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=725</guid>
		<description><![CDATA[There has been a lot of talk over the past few months about the rumored merger of ZeuS and SpyEye, two popular banking trojans that have been used by cybercrimals to commit fraud against consumers and businesses. This is detailed in Brian Kreb’s blog here: http://krebsonsecurity.com/2011/02/revisiting-the-spyeyezeus-merger/ While ultimately this appeals to many people’s interest in [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/02/03/zeus-and-spyeye-merge-business-as-usual-at-netwitness/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Life at NetWitness&#8230;</title>
		<link>http://www.networkforensics.com/2011/01/21/life-at-netwitness/</link>
		<comments>http://www.networkforensics.com/2011/01/21/life-at-netwitness/#comments</comments>
		<pubDate>Fri, 21 Jan 2011 19:27:00 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=719</guid>
		<description><![CDATA[Sometimes &#8211; even I have to admit working at NetWitness is quite a unique experience.  Because of what we do, the company has a very open culture.  Our Internet connections always have various deployments of our products on them, and our engineering staff is encouraged to use them for monitoring.  Today I posted a couple [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/01/21/life-at-netwitness/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Network Forensics and Reverse Engineering Part 2 – A deeper dive into real JavaScript analysis and reverse engineering</title>
		<link>http://www.networkforensics.com/2011/01/12/network-forensics-and-reverse-engineering-part-2-%e2%80%93-a-deeper-dive-into-real-javascript-analysis-and-reverse-engineering/</link>
		<comments>http://www.networkforensics.com/2011/01/12/network-forensics-and-reverse-engineering-part-2-%e2%80%93-a-deeper-dive-into-real-javascript-analysis-and-reverse-engineering/#comments</comments>
		<pubDate>Wed, 12 Jan 2011 03:36:14 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[Decompile]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Reverse Engineering]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=699</guid>
		<description><![CDATA[Introduction In our first post in the forensics and reversing series, we examined why HTTP gzip content encoding is a larger and more serious problem than most people realize. We’ll use the end of the first post as a starting point for analysis in this post. It also serves as an example of something far [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/01/12/network-forensics-and-reverse-engineering-part-2-%e2%80%93-a-deeper-dive-into-real-javascript-analysis-and-reverse-engineering/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Welcome Back, Rustock.</title>
		<link>http://www.networkforensics.com/2011/01/10/welcome-back-rustock/</link>
		<comments>http://www.networkforensics.com/2011/01/10/welcome-back-rustock/#comments</comments>
		<pubDate>Mon, 10 Jan 2011 13:01:39 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=683</guid>
		<description><![CDATA[It seems that our holiday from rustock-generated spam is over. http://bits.blogs.nytimes.com/2011/01/06/spamming-declines-at-least-temporarily/?partner=rss&#038;emc=rss We monitor a number of botnets at NetWitness and check them occasionally for new information.  Since Rustock is in the news, we&#8217;ve paid close attention to it recently.   Sometime this morning, Rustock begain spamming again,  pushing viagra from shady .ru sites. Looking at the [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/01/10/welcome-back-rustock/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Cyber-Crime or Cyber-Espionage?</title>
		<link>http://www.networkforensics.com/2011/01/03/cyber-crime-or-cyber-espionage/</link>
		<comments>http://www.networkforensics.com/2011/01/03/cyber-crime-or-cyber-espionage/#comments</comments>
		<pubDate>Mon, 03 Jan 2011 17:54:03 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[kneber]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[zeus]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=606</guid>
		<description><![CDATA[Brian Krebs posted an article on his blog this morning that documents a recent spam attack on U.S. government employees that occurred around christmas time. http://krebsonsecurity.com/2011/01/white-house-ecard-dupes-dot-gov-geeks/ which has in-depth technical coverage at: http://contagiodump.blogspot.com/2011/01/general-file-information-file-card.html Using a very simple ruse of &#8220;Merry Christmas from the White House&#8221;, this message used the common &#8220;ecard&#8221; social engineering hook to [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2011/01/03/cyber-crime-or-cyber-espionage/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>VM Detection by In-The-Wild Malware</title>
		<link>http://www.networkforensics.com/2010/12/13/vm-detection-by-in-the-wild-malware/</link>
		<comments>http://www.networkforensics.com/2010/12/13/vm-detection-by-in-the-wild-malware/#comments</comments>
		<pubDate>Mon, 13 Dec 2010 09:03:15 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[code]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Malware Analysis]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=592</guid>
		<description><![CDATA[  Motivation   A large number of security researchers use Virtual Machines when analyzing malware and/or setting up both active and passive honeynets. There a numerous reasons for this, including: scalability, manageability, configuration and state snapshots, ability to run diverse operating systems, etc.. Malware that attempts to detect if it’s running in a Virtual Machine [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/12/13/vm-detection-by-in-the-wild-malware/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>

