Low Hanging Fruit
We spend a lot of time watching what is going on in the world. One of the advantages of having a customer-based intelligence sharing program as well as a distribution of our own sensors in the wild is that we are able to watch as threats change. When new threats come into play,
Razorback Appliance - Getting Started
With the recent release of Razorback 0.4.1 we decided to update the Virtual Appliance image to this release. The target audience for the appliance is people that want to test drive the system without going though the process of installing the system and its dependencies. You ca
A FABULOUS policy rule
Lots of people in the security space are familiar with the blog of Brain Krebs, a former Washington Post network security writer and one of a tiny number of IT security journalists who actually gets it. If you're not following him on Twitter (@briankrebs), you should be. Esp
ClamAV vs. Content IQ Test, part 1
This is the first in a series of blog posts about the Content IQ Test. A few days ago, we came across a test whose purpose is to gauge a security system's ability to detect client-side attacks. The Content IQ Test consists of detecting a set of test files that contain, at va
An Exploit Kit Was Sent To You
Unless you've got the world's best spam filter, you've probably seen one of the latest spam techniques used by malware-dropping bad guys: what appears to be an automated email informing you that a multi-function scanner/copier was used to send you a document. It's
Agile Security
Up until this past year, I had never included any marketing materials in my slides. It never seemed to fit in with a technical presentation, even though I always believed in the Sourcefire product line's ability to defend our customers in the face of a rapidly changing lands
Razorback 0.4.1 released
The Razorback team has released version 0.4.1 (yeah, we would have released 0.4, but we found some critical bugs that we really needed to fix before general release). You can find the new version of Razorback here: http://sfi.re/zQQOQ4. We've done a lot of work both on the
Android.Counterclank: Malware or Adware?
This weekend I noticed a ComputerWorld article titled "Massive Android malware op may have infected 5 million users". After reading, it seemed to be exactly the sort of thing many people have been suggesting - an increasingly large-scale outbreak of malicious activity i
A New Hope
Rep. Mike Rogers (R-MI) and Rep. Dutch Ruppersberger (D-MD) know a secret: The Federal government is REALLY good at watching people, much better than, say, the private sector. So they asked themselves (at least they did in my mind), "Why not share some of that information