Pages

▼
Tuesday, August 24, 2010

It's those darned DLLs again...

›
There's been a lot (and I mean a LOT) of traffic on the interwebs lately regarding a vulnerability associated with how DLLs are loaded o...
13 comments:
Monday, August 16, 2010

Links

›
Who You Gonna Call? Tom Liston had a great post to the ISC blog a bit ago entitled I ncident Reporting - Liston's "How To" G...
1 comment:
Tuesday, August 03, 2010

Artifacts: Direct, indirect

›
In reviewing some of the available materials on Stuxnet, I've started to see somethings that got me thinking. Actually, what really got...
5 comments:
Saturday, July 31, 2010

Ugh

›
Sorry, I just don't what other title to use...I wasn't able to come up with something witty or pithy, because all I kept thinking wa...
11 comments:
Thursday, July 29, 2010

Exploit Artifacts redux, plus

›
As a follow-up to my earlier post where I discussed Stuxnet, I wanted to take a moment to update some of what's come out on this issue...

Updates

›
I haven't posted in a while, as I was on a mission trip with a team of wonderful folks involved in Compassion International . There was...
3 comments:

Do NOT go to Windows-ir.com

›
All, I get a lot of comments about links to a domain I used to own called windows-ir.com. I no longer have anything to do with that domain...
3 comments:
Saturday, July 17, 2010

Exploit Artifacts redux

›
I posted yesterday, and included some discussion of exploit artifacts, the traces left by an exploit, prior to the secondary download. When...
5 comments:
Thursday, July 15, 2010

Thoughts and Comments

›
Exploit Artifacts There was an interesting blog post on the MMPC site recently, regarding an increase in attacks against the Help and Supp...
11 comments:
Friday, July 09, 2010

SANS Forensic Summit Take-Aways

›
I attended the SANS Forensic Summit yesterday...I won't be attending today due to meetings and work, but I wanted to provide some follo...
7 comments:
Wednesday, July 07, 2010

More Timeline Stuff

›
I'll be at the SANS Forensic Summit tomorrow, giving a presentation on Registry and Timeline Analysis in the morning, and then partici...
3 comments:
Tuesday, July 06, 2010

Links

›
Malware in PDFs As a responder and forensic analyst, one of the things I'm usually very interested in (in part, because customers want t...
1 comment:
Saturday, July 03, 2010

Skillz Follow-up

›
Based on some of the events of the week, and in light of a follow-up post from Eric , I wanted to follow-up on my last blog post. Earlier th...
3 comments:
Monday, June 28, 2010

Skillz

›
Remember that scene from Napoleon Dynamite where he talks about having "skillz"? Well, analysts have to have skillz, right? I w...
3 comments:
Tuesday, June 22, 2010

Links and what not

›
Case Notes Chris posted on writing and maintaining case notes a bit ago, using Case Notes . One of the things that is sorely overlooked ma...
Sunday, June 20, 2010

Who's on...uh, at...FIRST?

›
I attended the FIRST conference in Miami last week. My employer is not a member of FIRST, but we were a sponsor, and we hosted the "G...
Thursday, June 10, 2010

Linkz

›
Analysis This post from the Digital Detective site discusses how to manually identify the time zone of a system from the image. This infor...
5 comments:

TSK/Open Source Conference

›
I have to say, when someone who's attended conferences sets out to create a conference, things tend to turn out pretty well. Aaron'...
6 comments:
Monday, June 07, 2010

Anti-forensics

›
The term "anti-forensics" is used sometimes to describe efforts attackers use in order to foil or frustrate the attempts of the go...
6 comments: