Tag Archives: ir

Dumping Dropbox…

I’m deleting my Dropbox account in favor of Jungle Disk.  First, the fact that Dropbox is able to view my plaintext data if I don’t encrypt it before uploading (with Truecrypt etc) worries me. Second there was a local exploit … Continue reading

Posted in news, security | Tagged , , | 1 Comment

Free FEMA National Incident Mgmt System (NIMS) online training courses

The Federal Emergency Management Agency which did the wonderful job with Hurricane Katrina and whose ex-directory now admits he should have asked for help earlier offers some great online courses.  The courses I noticed are around the Incident Command System (ICS) … Continue reading

Posted in news | Tagged , | Leave a comment

Computer Forensics practice

You’ve just finished receiving digital forensics training or acquired a new tool (FTK, Encase, Sleuth).  Now what?  You’re waiting for some real cases to crack.  In the meantime, over on the SANS Forensics blog, Ken Pryor has posted an excellent … Continue reading

Posted in forensics, news | Tagged , | Leave a comment

REMnux: Distro for Reversers

Lenny Zeltser, SANS Instructor, has released a customized distribution targeted at malware reverse engineers.  From the REMnux page: REMnux is designed for running services that are useful to emulate within an isolated laboratory environment when performing behavioral malware analysis. As … Continue reading

Posted in forensics, malware, news, security | Tagged , , | Leave a comment

win32 memory capture & analysis cheat sheet

A high level overview to perform live memory captures and analysis: capture memory via moonsol’s win32dd parse memory snapshot with mandiant’s memoryze analyze results via audit viewer or analyze using the volatility framework — neatly packaged in SAN’S Sift Workstation

Posted in forensics, malware, microsoft, pentest, security | Tagged , | Leave a comment

(Tool) FireShark: Aid for web incident response

The tool of the day is FireShark, a free web analysis tool.  This is great to have in your toolbox for IR.  FireShark will generate a mind map of a given webpage — think of it being a graphical representation … Continue reading

Posted in forensics, news, security | Tagged , | Leave a comment