<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>mcwresearch.com &#187; Intrusion Detection/Prevention</title>
	<atom:link href="http://mcwresearch.com/archives/category/intrusion-detectionprevention/feed" rel="self" type="application/rss+xml" />
	<link>http://mcwresearch.com</link>
	<description>Things I think I've thought about</description>
	<lastBuildDate>Mon, 28 Dec 2009 22:10:04 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3</generator>
<xhtml:meta xmlns:xhtml="http://www.w3.org/1999/xhtml" name="robots" content="noindex" />
		<item>
		<title>Interesting Bittorrent client</title>
		<link>http://mcwresearch.com/archives/623</link>
		<comments>http://mcwresearch.com/archives/623#comments</comments>
		<pubDate>Mon, 24 Mar 2008 16:27:10 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[BitTorrent]]></category>
		<category><![CDATA[World Of Warcraft]]></category>
		<category><![CDATA[WoW]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/623</guid>
		<description><![CDATA[One of my HIPS rules specifically blocks any access to a *.torrent file, for obvious reasons. Going through my HIPS logs today, I see the following event: The process &#8216;C:\World of Warcraft\BackgroundDownloader.exe&#8217; (as user [SNIP]) attempted to access &#8216;C:\Documents and Settings\[SNIP]\Local Settings\Temporary Internet Files\Content.IE5\Y7YR4USA\WoW-2.3.3.7799-x86-Win-enUS-BKGND[1].torrent&#8217;. The attempted access was a write (operation = WRITE). The operation [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/623/feed</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>The conquerer of AV?</title>
		<link>http://mcwresearch.com/archives/602</link>
		<comments>http://mcwresearch.com/archives/602#comments</comments>
		<pubDate>Thu, 07 Feb 2008 21:54:05 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[AV sucks]]></category>
		<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[A1000]]></category>
		<category><![CDATA[Antivirus]]></category>
		<category><![CDATA[Nemean]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/602</guid>
		<description><![CDATA[CSOonline.com has a good article about some emergent technology (the A1000) designed to create rules dynamically to detect malware. There isn&#8217;t a lot of information on the technology yet but it seems that it does have strong roots in IDS tech, which is exactly what I&#8217;ve been hoping will happen to AV. It sounds like [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/602/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The Defense Protocol</title>
		<link>http://mcwresearch.com/archives/585</link>
		<comments>http://mcwresearch.com/archives/585#comments</comments>
		<pubDate>Sat, 19 Jan 2008 16:05:59 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/585</guid>
		<description><![CDATA[Over the course of several years I&#8217;ve written a lot about network security and effective strategies. Mostly I&#8217;ve kept this blog, a sort of journal, as my own documentation. But as the popularity of blogs grew, my intentions morphed more towards a contribution to the community. The aim of this document is to wed all [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/585/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>My Black Tuesday Routine</title>
		<link>http://mcwresearch.com/archives/555</link>
		<comments>http://mcwresearch.com/archives/555#comments</comments>
		<pubDate>Wed, 10 Oct 2007 16:20:52 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[Patch-Tuesday]]></category>
		<category><![CDATA[IPS]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/555</guid>
		<description><![CDATA[I&#8217;ve spent the last two or three years focusing the lion&#8217;s share of my security energy on implementing proactive measures to reduce our dependence on Microsoft patches. To wit, here is what my Black Tuesday routine looks like: Tuesday &#8211; I usually wait for the ISC to publish their overview, which is easily digested. I [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/555/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Micro defense in depth</title>
		<link>http://mcwresearch.com/archives/486</link>
		<comments>http://mcwresearch.com/archives/486#comments</comments>
		<pubDate>Mon, 11 Jun 2007 16:51:56 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Big Yellow]]></category>
		<category><![CDATA[Bots]]></category>
		<category><![CDATA[Defense In Depth]]></category>
		<category><![CDATA[Firewall]]></category>
		<category><![CDATA[IPS]]></category>
		<category><![CDATA[IRCBot]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/486</guid>
		<description><![CDATA[I had another laptop get partially compromised by the Big Yellow worm, which attacks Symantec Antivirus. I learned my lesson after the first compromise by locking down the HIPS rules to the point of specifying the IP&#8217;s of our SAV servers being the only IP&#8217;s allowed to talk through the HIPS to the SAV. Unfortunately, [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/486/feed</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Things that make you go hmmm&#8230;</title>
		<link>http://mcwresearch.com/archives/481</link>
		<comments>http://mcwresearch.com/archives/481#comments</comments>
		<pubDate>Tue, 29 May 2007 10:55:12 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/481</guid>
		<description><![CDATA[I just read a fantastic post by David Chris Hoff on his Rational Security blog, where he discusses the ongoing debate about where the focus of security should be; the network or the host. Its a great read and only slightly long but with good reason. He&#8217;s packed in a lot of good points that [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/481/feed</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>Evaluating malware from a network perspective</title>
		<link>http://mcwresearch.com/archives/469</link>
		<comments>http://mcwresearch.com/archives/469#comments</comments>
		<pubDate>Wed, 02 May 2007 03:55:38 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[AV sucks]]></category>
		<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Botnets]]></category>
		<category><![CDATA[Bots]]></category>
		<category><![CDATA[IPS]]></category>
		<category><![CDATA[IRCBot]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/469</guid>
		<description><![CDATA[A few days ago, my HIPS software blue-screened three separate machines after an update. Fearing a problem with the HIPS software, I disabled it on all three machines while I troubleshot them. Today while looking through my HIPS log like a good sec analyst, I see an interesting event logged on one of the hosts. [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/469/feed</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Make them fight YOUR fight</title>
		<link>http://mcwresearch.com/archives/461</link>
		<comments>http://mcwresearch.com/archives/461#comments</comments>
		<pubDate>Wed, 18 Apr 2007 15:24:28 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/461</guid>
		<description><![CDATA[Bejtlich over at Tao Security has a good post today about making the bad guys fight your fight, or as he puts it, fight your strengths. At the end he asks how others force the fight, so I figure I&#8217;ll chime in. IPS/IDS While IPS/IDS is certainly evadable by a skilled attacker, it adds to [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/461/feed</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Windows DNS/RPC Vulnerability</title>
		<link>http://mcwresearch.com/archives/458</link>
		<comments>http://mcwresearch.com/archives/458#comments</comments>
		<pubDate>Sat, 14 Apr 2007 14:18:03 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Hardening]]></category>
		<category><![CDATA[IPS]]></category>
		<category><![CDATA[Zero-Day]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/458</guid>
		<description><![CDATA[Just wanted to point everyone to this post that details how to disable the vulnerable RPC service on your DNS servers and domain controllers. As I&#8217;ve said in the past, RPC will be a target for the foreseeable future. RPC is essential to Windows&#8217; networking and thus essential to protect. If you have hosts exposed [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/458/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>When IPS isn&#8217;t enough (Windows DNS zero day)</title>
		<link>http://mcwresearch.com/archives/457</link>
		<comments>http://mcwresearch.com/archives/457#comments</comments>
		<pubDate>Fri, 13 Apr 2007 14:56:35 +0000</pubDate>
		<dc:creator>Michael</dc:creator>
				<category><![CDATA[Intrusion Detection/Prevention]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://mcwresearch.com/archives/457</guid>
		<description><![CDATA[Yesterday I blogged about how useful IPS tech is and today I&#8217;m going to blog about how it isn&#8217;t enough. How&#8217;s that for being conflicted! Microsoft is warning folks of a DNS Vulnerability with a twist; port 53 isn&#8217;t vulnerable. The attack vector is RPC, which according to Erratasec puts a kink in IPS inspection. [...]]]></description>
		<wfw:commentRss>http://mcwresearch.com/archives/457/feed</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
	</channel>
</rss>

