<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog &#187; malware</title>
	<atom:link href="http://www.networkforensics.com/tag/malware/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Tue, 21 Jun 2011 22:54:21 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1</generator>
	<div id='fb-root'></div>
					<script>
						window.fbAsyncInit = function()
						{
							FB.init({appId: null, status: true, cookie: true, xfbml: true});
						};
						(function()
						{
							var e = document.createElement('script'); e.async = true;
							e.src = document.location.protocol + '//connect.facebook.net/en_US/all.js';
							document.getElementById('fb-root').appendChild(e);
						}());
					</script>	
						<item>
		<title>They are watching you&#8230;and your security vendors.</title>
		<link>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/</link>
		<comments>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/#comments</comments>
		<pubDate>Sun, 30 May 2010 13:32:43 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[bluehost]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[godaddy]]></category>
		<category><![CDATA[Gumblar]]></category>
		<category><![CDATA[hacked]]></category>
		<category><![CDATA[hostgator]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Martuz]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network solutions]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[wordpress]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=309</guid>
		<description><![CDATA[If you&#8217;ve ever seen me, or any of the NetWitness crew, speak on malware, advanced threats or the current threat environment, you&#8217;ll generally hear more than one recurring theme, one of which is: Your anti-virus solution isn&#8217;t working like you think it is. This is occurring for a variety of reasons and is ultimately the result of [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Network detection of x86 buffer overflow shellcode</title>
		<link>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/</link>
		<comments>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/#comments</comments>
		<pubDate>Sun, 16 May 2010 17:32:54 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Breach]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[flex parser]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=297</guid>
		<description><![CDATA[Overview This technique can detect overflow exploits against software running on the x86 platform, meaning it applies to Windows, Unix, and Mac shellcode. It not only works independently of OS, but it also works for finding both stack and heap based overflows. Most interestingly, it catches most forms of polymorphic shellcode as well. (Actually, it [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Kneber Update</title>
		<link>http://www.networkforensics.com/2010/02/19/kneber-update/</link>
		<comments>http://www.networkforensics.com/2010/02/19/kneber-update/#comments</comments>
		<pubDate>Fri, 19 Feb 2010 18:05:25 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[kneber]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[zeus]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=207</guid>
		<description><![CDATA[There was a significant amount of coverage yesterday on research performed by NetWitness into a large set of stolen information recovered from a ZeuS botnet.  Some of the information, analysis, and commentary was very beneficial to the broader discussion of threats such as these.  There is, however, some information that we feel we should address. [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/19/kneber-update/feed/</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
		<item>
		<title>Move over China, here comes Russia</title>
		<link>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/</link>
		<comments>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 03:10:53 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[Cyberwar]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=187</guid>
		<description><![CDATA[While the world took pause to consider the implications of Operation Aurora, and Google lent considerable voice to the concept of Advanced and Persistent Threats (APT), we can ill-afford to believe even for a moment that they are alone in their sophistication or capability.   According to the FBI more than 100 nations have offensive [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>IDS Legacy is Institutionalized Failure</title>
		<link>http://www.networkforensics.com/2010/01/26/ids-legacy-is-institutionalized-failure/</link>
		<comments>http://www.networkforensics.com/2010/01/26/ids-legacy-is-institutionalized-failure/#comments</comments>
		<pubDate>Tue, 26 Jan 2010 19:40:00 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[fud]]></category>
		<category><![CDATA[ids]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=77</guid>
		<description><![CDATA[The news is rife with discussions about systemic failures in the intelligence community.  It is a good thing we do not judge information security on the same scale of success.  I know of not a SINGLE enterprise network that is not being repeatedly compromised with a deluge of malicious code.  Can you imagine a world [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/26/ids-legacy-is-institutionalized-failure/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Finding Aurora (googlehack)</title>
		<link>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/</link>
		<comments>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/#comments</comments>
		<pubDate>Fri, 15 Jan 2010 15:56:42 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[adobe]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Situational Awareness]]></category>

		<guid isPermaLink="false">http://www.netwitness.com/blog/?p=95</guid>
		<description><![CDATA[I was helping a fortune customer yesterday determine if they were targeted by Operation Aurora. From everything we know to date, they were not. How do we know this? We looked. In 15 minutes or so, we looked back over the last 6 months of every bit and byte that has left that company, and [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/01/15/finding-aurora-googlehack/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
	</channel>
</rss>

