<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Nart Villeneuve</title>
	<atom:link href="http://www.nartv.org/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.nartv.org</link>
	<description>Internet Censorship Explorer</description>
	<lastBuildDate>Sat, 20 Jun 2009 09:40:57 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Iran DDOS 2</title>
		<link>http://www.nartv.org/2009/06/20/iran-ddos-2/</link>
		<comments>http://www.nartv.org/2009/06/20/iran-ddos-2/#comments</comments>
		<pubDate>Sat, 20 Jun 2009 09:40:57 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[Hacktivism]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=683</guid>
		<description><![CDATA[I just read a great post by Jose Nazario   suggesting that there hasn&#8217;t been much evidence of the use of botnets. But the most interesting point he makes is where he points out that the site under attack could take offensive action against the people participating in these &#8220;refresh&#8221; style attacks: 
The attackers [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/06/20/iran-ddos-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Iran DDOS</title>
		<link>http://www.nartv.org/2009/06/16/iran-ddos/</link>
		<comments>http://www.nartv.org/2009/06/16/iran-ddos/#comments</comments>
		<pubDate>Tue, 16 Jun 2009 16:32:23 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[Hacktivism]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=675</guid>
		<description><![CDATA[There have been a variety of good reports (zdnet, sans, fp ) on the DDOS campaigns targeting Iranian sites after the election. However, one of the things I&#8217;ve noticed is the tendency to characterize this as something relatively new. But this has been happening for at least a decade!  See, http://www.fraw.org.uk/download/ehippies/archive/op-01.html , http://www.fraw.org.uk/download/ehippies/archive/op-01a.html, http://www.thing.net/~rdom/ecd/archives.html
I [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/06/16/iran-ddos/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>pwn3d botnets</title>
		<link>http://www.nartv.org/2009/05/05/pwn3d-botnets/</link>
		<comments>http://www.nartv.org/2009/05/05/pwn3d-botnets/#comments</comments>
		<pubDate>Tue, 05 May 2009 14:08:43 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[Featured]]></category>
		<category><![CDATA[Worms/Viruses/Botnets]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=628</guid>
		<description><![CDATA[Two recent reports have been published that document how the C&#038;C servers of two large botnets were accessed by researchers. The first comes from Finjan which discovered a botnet, dubbed Hexzone,  with 1.9 million infected hosts. (Also see Jose Nazario&#8217;s post on this.)  The second report documents the exploitation of the Torpig botnet [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/05/05/pwn3d-botnets/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Lots of Stuff</title>
		<link>http://www.nartv.org/2009/05/04/lots-of-stuff/</link>
		<comments>http://www.nartv.org/2009/05/04/lots-of-stuff/#comments</comments>
		<pubDate>Mon, 04 May 2009 14:43:45 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=622</guid>
		<description><![CDATA[CIPAV &#8211; docs 1, 2, 3 &#8212; Because suspects are increasingly using tools to mask their IP address the FBI now uses a &#8220;computer and internet protocol address verifier&#8221; to identify a suspect&#8217;s IP (as well as additional info) . It appears to work be levergaing various &#8220;drive-by&#8221; exploits. On a worrying note, the first [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/05/04/lots-of-stuff/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>&#8220;Debunking&#8221; GhostNet</title>
		<link>http://www.nartv.org/2009/05/01/debunking-ghostnet/</link>
		<comments>http://www.nartv.org/2009/05/01/debunking-ghostnet/#comments</comments>
		<pubDate>Fri, 01 May 2009 19:31:12 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[InfoWar]]></category>
		<category><![CDATA[Worms/Viruses/Botnets]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=598</guid>
		<description><![CDATA[If by &#8220;debunking&#8221; you mean &#8220;validating&#8221; the GhostNet report you should listen to Paul Ducklin from Sophos discuss GhostNet in this interview. To be fair to Ducklin, I think that his comments are pretty much spot on but the host appears to be confused  between our GhostNet report and the &#8220;Snooping Dragon&#8221; report by [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/05/01/debunking-ghostnet/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Tor Website blocked at My Hotel</title>
		<link>http://www.nartv.org/2009/04/21/tor-website-blocked-at-my-hotel/</link>
		<comments>http://www.nartv.org/2009/04/21/tor-website-blocked-at-my-hotel/#comments</comments>
		<pubDate>Tue, 21 Apr 2009 11:55:59 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[DNS]]></category>
		<category><![CDATA[Filtering Technology]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=615</guid>
		<description><![CDATA[
My hotel uses OpenDNS to block access to the Tor website. Google Translate is also blocked. They are categorized as &#8220;Proxy/anonymizer&#8221;. This is one of the most annoying things about filtering. I just wanted to quickly translate some text from Russia to English and then read the Tor blog and &#8230;.

Yes, in order to block [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/04/21/tor-website-blocked-at-my-hotel/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>When Hype is the Threat</title>
		<link>http://www.nartv.org/2009/04/13/hype-threat/</link>
		<comments>http://www.nartv.org/2009/04/13/hype-threat/#comments</comments>
		<pubDate>Mon, 13 Apr 2009 19:13:31 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[Critical Infrastructure]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=574</guid>
		<description><![CDATA[Articles like this  are very irritating. They are short of detail and long on hype. And when that hype focuses on the wrong threat, it becomes the threat itself. 
This WSJ article is a typical case. These stories are not new and the pop up from time to time usually focused on Russian or [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/04/13/hype-threat/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>GhostNet &amp; CasperNet</title>
		<link>http://www.nartv.org/2009/04/13/ghostnet-caspernet/</link>
		<comments>http://www.nartv.org/2009/04/13/ghostnet-caspernet/#comments</comments>
		<pubDate>Mon, 13 Apr 2009 15:00:43 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[InfoWar]]></category>
		<category><![CDATA[Worms/Viruses/Botnets]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=584</guid>
		<description><![CDATA[DarkVisitor picked up on some information in the GhostNet report that we didn&#8217;t really focus on &#8212; the email addresses and other information in the domain name registration records &#8212; and were able to track down the owner of the email address listed in the registry information associated with the control servers www.lookbytheway.net and www.macfeeresponse.org. [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/04/13/ghostnet-caspernet/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Symantec &amp; GhostNet</title>
		<link>http://www.nartv.org/2009/04/07/symantec-ghostnet/</link>
		<comments>http://www.nartv.org/2009/04/07/symantec-ghostnet/#comments</comments>
		<pubDate>Tue, 07 Apr 2009 15:44:54 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[InfoWar]]></category>
		<category><![CDATA[Worms/Viruses/Botnets]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=577</guid>
		<description><![CDATA[Symantec has put out a nice video demonstrating how gh0stRAT works. We gave the name &#8220;GhostNet&#8221; to the network of infected computers we uncovered because of the attackers&#8217; use of the gh0stRAT tool but it is important to bear in mind how the whole operation works as gh0stRAT is just one part of it. 
One [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/04/07/symantec-ghostnet/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>GhostNet Update</title>
		<link>http://www.nartv.org/2009/04/07/ghostnet-update/</link>
		<comments>http://www.nartv.org/2009/04/07/ghostnet-update/#comments</comments>
		<pubDate>Tue, 07 Apr 2009 15:00:00 +0000</pubDate>
		<dc:creator>nart</dc:creator>
				<category><![CDATA[InfoWar]]></category>
		<category><![CDATA[Worms/Viruses/Botnets]]></category>

		<guid isPermaLink="false">http://www.nartv.org/?p=575</guid>
		<description><![CDATA[Starting on March 30 2009 the GhostNet starting coming down. The attacker began removing the files and directories being used and then began to configure the domain names of some the control servers to point to 127.0.0.1. Files hosted on other (probably compromised) &#8220;command&#8221; servers also started disappearing at the same time.  It&#8217;ll be [...]]]></description>
		<wfw:commentRss>http://www.nartv.org/2009/04/07/ghostnet-update/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
