<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/">
    <channel>
        <link xmlns="http://www.w3.org/2005/Atom" rel="hub" href="https://overblog.superfeedr.com"/>
        <link xmlns="http://www.w3.org/2005/Atom" rel="self" href="https://kareldjag.over-blog.com/rss" type="application/rss+xml"/>
        <title><![CDATA[SECURITY OVERFLOW]]></title>
        <link>https://kareldjag.over-blog.com/</link>
        <generator>Overblog - https://www.over-blog.com</generator>
        <description><![CDATA[actualit&eacute; de la s&eacute;curit&eacute; informatique]]></description>
                    <item>
    <title><![CDATA[HARDENING WINDOWS HOST Part 4: ACCOUNTS AND RIGHTS MANAGEMENTS]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-6649283.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-6649283.html</guid>
    <pubDate>Sun, 20 May 2007 19:14:37 +0200</pubDate>
    <description><![CDATA[Introduction With the release of Vista, many home users are certainly wondering if the migration from XP to Vista is absolutely necessary.As claims the VOX POPULI : "Vista is an evolution, not a revolution".Hardening the system makes XP as secure as Vista.Since... ]]></description>
        <dc:creator><![CDATA[kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[PERSONAL HIPS: THE TOP LIST]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-3470338.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-3470338.html</guid>
    <pubDate>Mon, 07 Aug 2006 22:32:03 +0200</pubDate>
    <description><![CDATA[The greater part of these products have already been linked in the previous article.Therefore, only products that have not been listed yet are linked. As it often changes (freewares become paid), only paid softwares with or without a free limited versions... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[IDS For HOME USERS]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-2381843.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-2381843.html</guid>
    <pubDate>Sat, 08 Apr 2006 16:00:45 +0200</pubDate>
    <description><![CDATA[Intrusion detection is a large subject, and concerns mostly organizations.It's also important to note that IDS are supplanted by IPS/NIPS. Therefore we'll focus here only on IDS available for home users and Windows systems. First of all, the user must... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[HIPS tests news]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-2150489.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-2150489.html</guid>
    <pubDate>Tue, 14 Mar 2006 19:57:30 +0100</pubDate>
    <description><![CDATA[I've quite finished the methodology. I've decided to choose a real-life infection approach; and consequently, it means more time for searching malwares and less time for blogging... In the first part of the methodology, the self-protection is tested (process,... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[Volunteers for HIPS tests]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1925750.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1925750.html</guid>
    <pubDate>Mon, 20 Feb 2006 00:00:00 +0100</pubDate>
    <description><![CDATA[I'm looking for volunteers for testing HIPS white list such as DefenseWall, GesWall, AntiExecutable and PrevX (as Zorro PC Protector is in french language only, then i've choosed it for the test). The volunteers (2 per product is enough) must: -have an... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[AN OVERVIEW OF PERSONAL DESKTOP/HOST IPS 2]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1841115.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1841115.html</guid>
    <pubDate>Mon, 13 Feb 2006 18:40:00 +0100</pubDate>
    <description><![CDATA[Other similar products These products monitors some system's area like the registry in order to detect malwares behaviours. They're not integrated (for most of them) at the core of the system (kernel) and then do not operate at a low level: except for... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[AN OVERVIEW OF PERSONAL DESKTOP/HOST IPS]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1693696.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1693696.html</guid>
    <pubDate>Sun, 12 Feb 2006 00:43:00 +0100</pubDate>
    <description><![CDATA[AN OVERVIEW OF PERSONAL DESKTOP/HOST INTRUSION PREVENTION SYSTEMS We have seen previously that a line defense with only a firewall and an antivirus is not enough in consideration of the evolution of threats.Products are available to palliate scanners... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[WHY YOU SHOULDN'T RUN ONLY WITH AN ANTIVIRUS + FIREWALL AND WHY A PROACTIVE PROTECTION IS NECESSARY]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1649851.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1649851.html</guid>
    <pubDate>Wed, 25 Jan 2006 00:00:00 +0100</pubDate>
    <description><![CDATA[In this first article we’ll just show that the couple scanner (antivirus/antitrojan/antispyware) + Firewall is not sufficient to mitigate security risks for home users. Then we'll review and list available Desktop/Host Intrusion Prevention Systems designed... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[ADVANCED INTEGRITY CHECKERS]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1482539.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1482539.html</guid>
    <pubDate>Fri, 13 Jan 2006 00:22:00 +0100</pubDate>
    <description><![CDATA[In a previous article, we've reviewed some free integrity checkers. On this article, we'll focus in advanced ones (paid for most of them). Integrity checking for change detection is an important feature for security softwares, especially in intrusion... ]]></description>
        <dc:creator><![CDATA[kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[ABUSE SHIELD]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1148950.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1148950.html</guid>
    <pubDate>Thu, 12 Jan 2006 00:00:00 +0100</pubDate>
    <description><![CDATA[AbuseShield " Globesoft AbuseShield" is a comprehensive tool for monitoring and controlling your desktop or server environments so that only the software you specify can run. AbuseShield also monitor file system activities.This means that even if you,... ]]></description>
        <dc:creator><![CDATA[kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[FAQ sur l'EXPLOIT relatif aux images WMF]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1534239.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1534239.html</guid>
    <pubDate>Fri, 06 Jan 2006 14:03:00 +0100</pubDate>
    <description><![CDATA[FAQ pour l'exploit WMF (récent) Cette page est une simple traduction de la faq originale (I SC.SANS.org ). D'autres traductions de cette faq sont disponibles dans d'autres langues. * Pourquoi cette faille est si importante? La vulnérabilité WMF utilise... ]]></description>
        <dc:creator><![CDATA[KARELDJAG]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[WINDOWS ROOTKITS COUNTERMEASURES Part 4 and End: Windows Rootkits Prevention]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1232530.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1232530.html</guid>
    <pubDate>Tue, 20 Dec 2005 15:30:00 +0100</pubDate>
    <description><![CDATA[ROOTKITS PREVENTION MEASURES: The more interesting method for avoiding rootkits or mitigating risks of infection is to apply prevention measures. Most of these methods requires to use only Windows as the first line defense. ***HARDEN WINDOWS: This step... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[WINDOWS ROOTKITS COUNTERMEASURES Part 3: Windows Rootkits Detection]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1232492.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1232492.html</guid>
    <pubDate>Tue, 20 Dec 2005 15:17:00 +0100</pubDate>
    <description><![CDATA[If we consider the IDS mantra ( "that which cannot be detected should be prevented; that which cannot be prevented should be detected."), prevention and detection countermeasures must be applied. A rootkit, much more than most other malwares, is a sign... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[WINDOWS ROOTKITS DETECTION SECTION 2]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1328084.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1328084.html</guid>
    <pubDate>Tue, 20 Dec 2005 14:25:00 +0100</pubDate>
    <description><![CDATA[WINDOWS ROOTKIT DETECTION PART 2: ***Microsoft Tools: -Micosoft Removal Tool: It scans the system for the most prevalent malawares. HackerDefender is the only rootkit included on its database. If MRT detects easily the rootkit, the removal is not done... ]]></description>
        <dc:creator><![CDATA[KARELDJAG]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[ Profiling a rootkit: Hacker Defender Section 2]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1247301.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1247301.html</guid>
    <pubDate>Sun, 18 Dec 2005 19:32:00 +0100</pubDate>
    <description><![CDATA[Registry Tracking with RegMon: 2712 56.77157974 hxdef100.exe:448 OpenKey HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionshxdef100.exe NOT FOUND 2713 56.77293015 hxdef100.exe:448 OpenKey HKLMSystemCurrentControlSetControlTerminal... ]]></description>
        <dc:creator><![CDATA[kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[WINDOWS ROOTKITS  COUNTERMEASURES Part 2: Profiling a Rootkit: HackerDefender]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1021863.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1021863.html</guid>
    <pubDate>Sat, 17 Dec 2005 00:00:00 +0100</pubDate>
    <description><![CDATA[HackerDefender is the rootkit that which is the most used in the wild. It was included in the threats list of the Microsoft Removal tool this year. HackerDefender or HxDef is the favourite rootkit of Script-Kiddies for many reasons: -light (199 ko for... ]]></description>
        <dc:creator><![CDATA[kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[WINDOWS ROOTKITS FREE COUNTERMEASURES Part 1: Introduction to Rootkits]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-895476.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-895476.html</guid>
    <pubDate>Sun, 04 Dec 2005 14:15:33 +0100</pubDate>
    <description><![CDATA[PRESENTATION: In this article, we'll try to provide free prevention and detection measures against the most common Windows rootkits. Currently, many effective free and paid anti-rootkits security softwares are available on the market, even if Windows... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[ALL-SEEING EYE]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1061426.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1061426.html</guid>
    <pubDate>Sun, 06 Nov 2005 00:00:00 +0100</pubDate>
    <description><![CDATA[All-SEEING Eye All -Seeing Eye is another Desktop Intrusion Prevention System designed to monitor several system's areas : -processes, -loading dlls, -services/drivers, -Browser Helper Objects (BHO), -ActiveX, -HostFile, -Winsock LSP, -registry keys,... ]]></description>
        <dc:creator><![CDATA[kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[ARTICLES COMING SOON]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-1061491.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-1061491.html</guid>
    <pubDate>Sun, 23 Oct 2005 00:00:00 +0200</pubDate>
    <description><![CDATA[*Manage User Accounts and Apply policy restrictions. *Windows Rootkits Free Countermeasures: -Introduction to Rootkits, -HackerDefender in action, -Free Countermeasures. *HIPS test: 2 products. *An overview of HIPS based on white list. *Limitations of... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[FILES MONITORS]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-895815.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-895815.html</guid>
    <pubDate>Sat, 24 Sep 2005 00:00:00 +0200</pubDate>
    <description><![CDATA[Sometimes an user can need to see what changes have been made by a software installation or to monitor some files and folders for suspect activity prevention. In this case, files monitoring softwares are very helpful. L'utilisateur a parfois besoin de... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[Hardening Windows Part 3: Closing critical ports]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-813593.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-813593.html</guid>
    <pubDate>Sat, 10 Sep 2005 00:00:00 +0200</pubDate>
    <description><![CDATA[Closing critical ports/Fermer les ports critiques Disclaimer: Close only ports that which are not necessary in your configuration. For a single computer only used to surf (no Messenger and so on), only port 80 is required. Avertissement: Fermez uniquement... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[Hardening Windows Host part 2 : WINDOWS SERVICES CONFIGURATION]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-701073.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-701073.html</guid>
    <pubDate>Sat, 20 Aug 2005 00:00:00 +0200</pubDate>
    <description><![CDATA[Windows comes with unnecessary services which require to be configured properly to gain memory resources and to increase the security level. The configuration depends on each environment, that's why we can't define recommended rules for any user: it must... ]]></description>
        <dc:creator><![CDATA[Kareldjag]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[INTEGRITY/HASHES/CHECKSUM Utilities]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-656733.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-656733.html</guid>
    <pubDate>Sun, 07 Aug 2005 00:00:00 +0200</pubDate>
    <description><![CDATA[Here we're only interested in Integrity verification tools, not in more advanced integrity host protection. Ici nous ne nous intéresserons qu'aux utilitaires de vérification d'intégrité, non aux systèmes plus évolués de protection par intégrité. Ditmar... ]]></description>
        <dc:creator><![CDATA[Kareldjag aka Michel]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[PODIUM and OVERALL]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-447659.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-447659.html</guid>
    <pubDate>Mon, 25 Jul 2005 00:00:00 +0200</pubDate>
    <description><![CDATA[PODIUM ProcessGuard (PG) VS System Safety Monitor (SSM) VS Viguard NB. the secure mode (administrator for SSM, "blocking new and changed applications" for PG) is not enabled. Viguard with critical files protection (Windows\System32, INI etc). ***Rootkit... ]]></description>
        <dc:creator><![CDATA[Kareldjag aka Michel]]></dc:creator>
    </item>
                    <item>
    <title><![CDATA[FILES in USED REMOVERS]]></title>
    <link><![CDATA[https://kareldjag.over-blog.com/article-617493.html]]></link>
    <guid>https://kareldjag.over-blog.com/article-617493.html</guid>
    <pubDate>Sat, 23 Jul 2005 00:00:00 +0200</pubDate>
    <description><![CDATA[We sometimes need to delete some files that are very hard to delete because they're in used or protected. It's often the case for infections by virus and others malwares or for an incomplete unistallation. These utilities are very helful in this case.... ]]></description>
        <dc:creator><![CDATA[Kareldjag aka Michel]]></dc:creator>
    </item>
            </channel>
</rss>

