<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:admin="http://webns.net/mvcb/"
	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
	<channel>
		<title>Gunter Ollmann &#45; CircleID</title>
		<link>http://www.circleid.com/</link>
		<description>Postings from Gunter Ollmann on CircleID</description>
		<dc:language>en</dc:language>
		<dc:rights>Copyright 2013, unless where otherwise noted.</dc:rights>
		<dc:date>2013-05-07T14:04:00-08:00</dc:date>
		

		
		<item>
			<title> Bypassing Geo-Locked BYOD Applications (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20130507_bypassing_geo_locked_byod_applications</guid>
			<link>http://www.circleid.com/posts/20130507_bypassing_geo_locked_byod_applications</link>
			<description><![CDATA[In the wake of increasingly lenient bring your own device (BYOD) policies within large corporations, there's been a growing emphasis upon restricting access to business applications (and data) to specific geographic locations. Over the last 18 months more than a dozen start-ups in North America alone have sprung up seeking to offer novel security solutions in this space - essentially looking to provide mechanisms for locking application usage to a specific location or distance from an office, and ensuring that key data or functionality becomes inaccessible outside these prescribed zones. <a href="http://www.circleid.com/posts/20130507_bypassing_geo_locked_byod_applications">More...</a>]]></description>
			<dc:date>2013-05-07T14:04:00-08:00</dc:date>
		</item>
		
		<item>
			<title> SQL Injection in the Wild (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20130325_sql_injection_in_the_wild</guid>
			<link>http://www.circleid.com/posts/20130325_sql_injection_in_the_wild</link>
			<description><![CDATA[As attack vectors go, very few are as significant as obtaining the ability to insert bespoke code in to an application and have it automatically execute upon "inaccessible" backend systems. In the Web application arena, SQL Injection vulnerabilities are often the scariest threat that developers and system administrators come face to face with (albeit way too regularly). <a href="http://www.circleid.com/posts/20130325_sql_injection_in_the_wild">More...</a>]]></description>
			<dc:date>2013-03-25T14:13:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Exploits, Curdled Milk and Nukes (Oh my!) (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20121220_exploits_curdled_milk_and_nukes_oh_my</guid>
			<link>http://www.circleid.com/posts/20121220_exploits_curdled_milk_and_nukes_oh_my</link>
			<description><![CDATA[Throughout the second half of 2012 many security folks have been asking "how much is a zero-day vulnerability worth?" and it's often been hard to believe the numbers that have been (and continue to be) thrown around. For the sake of clarity though, I do believe that it's the wrong question... the correct question should be "how much do people pay for working exploits against zero-day vulnerabilities?" <a href="http://www.circleid.com/posts/20121220_exploits_curdled_milk_and_nukes_oh_my">More...</a>]]></description>
			<dc:date>2012-12-21T16:55:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Persistent Threat Detection on a Budget (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20121107_persistent_threat_detection_on_a_budget</guid>
			<link>http://www.circleid.com/posts/20121107_persistent_threat_detection_on_a_budget</link>
			<description><![CDATA[If there's one simple - high impact - thing you could do to quickly check whether your network has been taken over by a criminal entity, or uncover whether some nefarious character is rummaging through your organizations most sensitive intellectual property out of business hours, what would it be? In a nutshell, I'd look to my DNS logs. It's staggering to me how few security teams have gotten wise to regularly interrogating the logs from their recursive DNS servers. <a href="http://www.circleid.com/posts/20121107_persistent_threat_detection_on_a_budget">More...</a>]]></description>
			<dc:date>2012-11-07T12:11:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Nitol and 3322.org Takedown by Microsoft (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120913_nitol_and_3322org_takedown_by_microsoft</guid>
			<link>http://www.circleid.com/posts/20120913_nitol_and_3322org_takedown_by_microsoft</link>
			<description><![CDATA[Reading this morning's blog from Microsoft about "Operation b70" left me wondering a lot of things. Most analysts within the botnet field are more than familiar with 3322.org - a free dynamic DNS provider based in China known to be unresponsive to abuse notifications and a popular home to domain names used extensively for malicious purposes - and its links to several botnets around the world. <a href="http://www.circleid.com/posts/20120913_nitol_and_3322org_takedown_by_microsoft">More...</a>]]></description>
			<dc:date>2012-09-13T10:39:00-08:00</dc:date>
		</item>
		
		<item>
			<title> The Sportsmanship of Cyber-warfare (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120628_the_sportsmanship_of_cyber_warfare</guid>
			<link>http://www.circleid.com/posts/20120628_the_sportsmanship_of_cyber_warfare</link>
			<description><![CDATA[As a bit of a history buff I can't avoid a slight tingling of déjà vu every time I read some new story commenting upon the ethics, morality and legality of cyber-warfare/cyber-espionage/cyberwar/cyber-attack/cyber-whatever. All this rhetoric about Stuxnet, Flame, and other nation-state cyber-attack tools, combined with the parade of newly acknowledged cyber-warfare capabilities and units within the armed services of countries around the globe, brings to the fore so many parallels... Call me a cynic if you will, but when the parallels in history are so evident, we'd be crazy to ignore them. <a href="http://www.circleid.com/posts/20120628_the_sportsmanship_of_cyber_warfare">More...</a>]]></description>
			<dc:date>2012-06-28T12:07:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Botnet Metrics and Calibration (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120618_botnet_metrics_and_calibration</guid>
			<link>http://www.circleid.com/posts/20120618_botnet_metrics_and_calibration</link>
			<description><![CDATA[As ISP's continue to spin up their anti-botnet defenses and begin taking a more active role in dealing with the botnet menace, more and more interested parties are looking for statistics that help define both the scale of the threat and the success of the various tactics being deployed... To overcome this problem there are several initiatives trying to grapple with this problem at the moment.. Obviously, if every ISP was using the same detection technology, in the same way, at the same time, it wouldn't be such a difficult task. Unfortunately, that's not the case. <a href="http://www.circleid.com/posts/20120618_botnet_metrics_and_calibration">More...</a>]]></description>
			<dc:date>2012-06-18T11:44:00-08:00</dc:date>
		</item>
		
		<item>
			<title> A Closer Look at the Flame/Flamer/sKyWIper Malware (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120522_a_closer_look_at_the_flame_flamer_skywiper_malware</guid>
			<link>http://www.circleid.com/posts/20120522_a_closer_look_at_the_flame_flamer_skywiper_malware</link>
			<description><![CDATA[The world is abuzz this week with some flaming malware - well "Flame" is the family name if you want to be precise. The malware package itself is considerably larger than what you'll typically bump into on average, but the interest it is garnering with the media and antivirus vendors has more to do with the kinds of victims that have sprung up - victims mostly in the Middle East, including Iran - and a couple of vendors claiming the malware as being related to Stuxnet and Duku. <a href="http://www.circleid.com/posts/20120522_a_closer_look_at_the_flame_flamer_skywiper_malware">More...</a>]]></description>
			<dc:date>2012-05-30T00:31:00-08:00</dc:date>
		</item>
		
		<item>
			<title> The Antivirus Uncertainty Principle (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120524_the_antivirus_uncertainty_principle</guid>
			<link>http://www.circleid.com/posts/20120524_the_antivirus_uncertainty_principle</link>
			<description><![CDATA[The antivirus industry has been trying to deal with false positive detection issues for a long, long time - and it's not going to be fixed anytime soon. To better understand why, the physicist in me draws an analogy with Heisenberg's Uncertainty Principle - where, in its simplest distillation, the better you know where an atom is, the less likely you'll know it's momentum (and vice versa) - aka the "observer effect". <a href="http://www.circleid.com/posts/20120524_the_antivirus_uncertainty_principle">More...</a>]]></description>
			<dc:date>2012-05-24T10:49:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Rethinking Protection Technologies: A Change Has Occurred (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120516_rethinking_protection_technologies_a_change_has_occurred</guid>
			<link>http://www.circleid.com/posts/20120516_rethinking_protection_technologies_a_change_has_occurred</link>
			<description><![CDATA[Talking technical is easy. Distilling technical detail, complex threats and operation nuances down to something that can be consumed by people whose responsibility for dealing with cybercrime lays three levels below them in their organizational hierarchy is somewhat more difficult. Since so many readers here have strong technical backgrounds and often face the task of educating upwards within their own organizations, I figured I'd share 4 slides from my recent presentation that may be helpful in communicating how the world has changed. <a href="http://www.circleid.com/posts/20120516_rethinking_protection_technologies_a_change_has_occurred">More...</a>]]></description>
			<dc:date>2012-05-16T14:12:00-08:00</dc:date>
		</item>
		
		<item>
			<title> The Advanced Persistent Threats (APT) Deception (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/the_advanced_persistent_threats_apt_deception</guid>
			<link>http://www.circleid.com/posts/the_advanced_persistent_threats_apt_deception</link>
			<description><![CDATA[Most of the good thrillers I tend to watch have spies and assassins in them for some diabolical reason. In those movies you'll often find their target, the Archduke of Villainess, holed up in some remote local and the spy has to fake an identity in order to penetrate the layers of defense. Almost without exception the spy enters the country using a fake passport; relying upon a passport from any country other than their own... So, with that bit of non-fiction in mind, why do so many people automatically assume that cyber-attacks sourced from IP addresses within China are targeted, state-sponsored, attacks? <a href="http://www.circleid.com/posts/the_advanced_persistent_threats_apt_deception">More...</a>]]></description>
			<dc:date>2012-04-11T15:35:00-08:00</dc:date>
		</item>
		
		<item>
			<title> BYOD Woes and Worries (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120406_byod_woes_and_worries</guid>
			<link>http://www.circleid.com/posts/20120406_byod_woes_and_worries</link>
			<description><![CDATA[Like the scene of a movie in which a biblical character holds back the mighty sea and is about to release the tide against his foes, BYOD has become a force of nature poised to flood those charged with keeping corporate systems secure. Despite years of practice hardening systems and enforcing policies that restrict what can and can't be done within the corporate network, businesses are under increasing (if not insurmountable) pressure to allow a diversifying number of personal devices to connect to their networks and be used for business operations. <a href="http://www.circleid.com/posts/20120406_byod_woes_and_worries">More...</a>]]></description>
			<dc:date>2012-04-09T08:30:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Global Payments Breach Confirmation (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120402_global_payments_breach_confirmation</guid>
			<link>http://www.circleid.com/posts/20120402_global_payments_breach_confirmation</link>
			<description><![CDATA[This morning, Global Payments held a conference call with investors and analysts covering their earlier breach announcement and projected earnings. Global Payments had also released an update advisory yesterday stating that "the company believes that the affected portion of its processing system is confined to North America and less than 1,500,000 card numbers have been exported" and that only Track 2 card data may have been stolen. <a href="http://www.circleid.com/posts/20120402_global_payments_breach_confirmation">More...</a>]]></description>
			<dc:date>2012-04-02T11:27:00-08:00</dc:date>
		</item>
		
		<item>
			<title> The Take Away from Global Payments Breach (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120401_the_take_away_from_global_payments_breach</guid>
			<link>http://www.circleid.com/posts/20120401_the_take_away_from_global_payments_breach</link>
			<description><![CDATA[Global Payments, an Atlanta-based payment card processing firm, announced yesterday that they had suffered "unauthorized access into a portion of its processing system". Sometime in early March they uncovered the attack, and there are some indications that the breach occurred between January 21st and February 25th of this year... There are a number of unverified reports that a New York City street gang with Central American ties took control of "an administrative account that was not protected sufficiently". <a href="http://www.circleid.com/posts/20120401_the_take_away_from_global_payments_breach">More...</a>]]></description>
			<dc:date>2012-04-01T12:06:00-08:00</dc:date>
		</item>
		
		<item>
			<title> Kelihos Is Dead: Long Live Kelihos (Featured Blog)</title>
			<guid isPermaLink="true">http://www.circleid.com/posts/20120329_kelihos_is_dead_long_live_kelihos</guid>
			<link>http://www.circleid.com/posts/20120329_kelihos_is_dead_long_live_kelihos</link>
			<description><![CDATA[The King is dead. Long live the King! Or, given this week's events, should the phrase now be "Kelihos is dead. Long live Kelihos"? It is with a little amusement and a lot of cynicism that I've been watching the kerfuffle relating to the latest attempt to take down the Kelihos botnet. You may remember that a similar event ("Kelihos is dead") occurred late last year after Microsoft and Kaspersky took it on themselves to shut down the botnet known as Kelihos (or sometimes as Waledac 2.0 or Hlux). <a href="http://www.circleid.com/posts/20120329_kelihos_is_dead_long_live_kelihos">More...</a>]]></description>
			<dc:date>2012-03-29T21:41:00-08:00</dc:date>
		</item>
		
	</channel>
</rss>