<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Casaba Security</title>
	<atom:link href="http://www.casabasecurity.com/blog/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.casabasecurity.com/blog</link>
	<description>Building and breaking software and robots</description>
	<lastBuildDate>Tue, 25 May 2010 19:32:01 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Watcher 1.4.0 released</title>
		<link>http://www.casabasecurity.com/blog/2010/05/watcher-1-4-0-released/</link>
		<comments>http://www.casabasecurity.com/blog/2010/05/watcher-1-4-0-released/#comments</comments>
		<pubDate>Tue, 25 May 2010 19:32:01 +0000</pubDate>
		<dc:creator>Chris Weber</dc:creator>
				<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[Watcher]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=213</guid>
		<description><![CDATA[A new update to the Watcher passive Web-vulnerability scanner has been released.  Based on user feedback we&#8217;ve built out the Wiki documentation on Codeplex with more details about the issues identified by each Watcher check.  Inside the tool, a reference is now included as a link back to the Wiki.  I hope [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/05/watcher-1-4-0-released/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Watcher 1.3.0 released</title>
		<link>http://www.casabasecurity.com/blog/2010/02/watcher-1-3-0-released/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/watcher-1-3-0-released/#comments</comments>
		<pubDate>Thu, 25 Feb 2010 17:40:59 +0000</pubDate>
		<dc:creator>Chris Weber</dc:creator>
				<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[TFS]]></category>
		<category><![CDATA[VIEWSTATE]]></category>
		<category><![CDATA[Watcher]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=203</guid>
		<description><![CDATA[A new update to the Watcher passive vulnerability detection and security testing tool has been released.  Watcher is an open source addon to the Fiddler Web proxy that aids developers, auditors, and penetration testers in finding Web-application security issues as well as hot-spots for deeper review. Among other things, we&#8217;ve added new checks to [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/watcher-1-3-0-released/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries. (Part 3)</title>
		<link>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 18:04:51 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Code Review]]></category>
		<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Nebulous]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=188</guid>
		<description><![CDATA[Renaming parts of the assembly.
So I promised this last week, but I&#8217;ve been busy on a new project. Below is some code that shows renaming of methods. This is a solution to renaming classes within namespaces. It iterates over each namespace renaming classes from class1 -&#62; classN. This is more useful for human readability and [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries. (Part 2)</title>
		<link>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-2/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-2/#comments</comments>
		<pubDate>Thu, 04 Feb 2010 23:53:14 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscated]]></category>
		<category><![CDATA[Microsoft CCI]]></category>
		<category><![CDATA[Reversing]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=171</guid>
		<description><![CDATA[So yesterday I talked a about using CCI to remove attributes from .Net binaries. Specifically the SupressIldasm attribute. I promised I&#8217;d put up some more code highlighting the framework&#8217;s benefits. So some more detail on the binary I&#8217;m working with. It has been ran through Babel -&#62; Netz -&#62; Babel again. My goals have been [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-2/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries.</title>
		<link>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/</link>
		<comments>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/#comments</comments>
		<pubDate>Wed, 03 Feb 2010 20:01:51 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=152</guid>
		<description><![CDATA[We had an issue recently crop up with an obfuscated .Net binary. I’ve been meaning to spend more time reversing .Net protected binaries so I start looking in it. Unfortunately everything I was reading on the forums and internet seemed difficult. Having recently read a little about Microsoft’s CCI framework, I thought this might be [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Getting Around Conditionally Banned APIs When Using Microsoft&#8217;s banned.h Header File</title>
		<link>http://www.casabasecurity.com/blog/2009/12/getting-around-conditionally-banned-apis-when-using-microsofts-banned-h-header-file/</link>
		<comments>http://www.casabasecurity.com/blog/2009/12/getting-around-conditionally-banned-apis-when-using-microsofts-banned-h-header-file/#comments</comments>
		<pubDate>Tue, 08 Dec 2009 23:42:28 +0000</pubDate>
		<dc:creator>Ramsey Dow</dc:creator>
				<category><![CDATA[Development]]></category>
		<category><![CDATA[SDL]]></category>

		<guid isPermaLink="false">58 at http://www.casabasecurity.com</guid>
		<description><![CDATA[This code sample makes use of banned.h, a Microsoft-supplied header file that deprecates dangerous CRT functions. Microsoft also poisons these functions on UNIX if you include banned.h there. This is a Good Thing, but what about the fact that they banned strlen? The banned API page states:
For critical functions, such as those accepting anonymous Internet [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2009/12/getting-around-conditionally-banned-apis-when-using-microsofts-banned-h-header-file/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Preventing Security Development Errors: Lessons Learned at Windows Live by Using ASP.NET MVC</title>
		<link>http://www.casabasecurity.com/blog/2009/11/preventing-security-development-errors-lessons-learned-at-windows-live-by-using-asp-net-mvc/</link>
		<comments>http://www.casabasecurity.com/blog/2009/11/preventing-security-development-errors-lessons-learned-at-windows-live-by-using-asp-net-mvc/#comments</comments>
		<pubDate>Mon, 23 Nov 2009 21:42:45 +0000</pubDate>
		<dc:creator>Chris Weber</dc:creator>
				<category><![CDATA[Code Review]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[MVC]]></category>

		<guid isPermaLink="false">57 at http://www.casabasecurity.com</guid>
		<description><![CDATA[Casaba had the opportunity to contribute to a new Microsoft paper regarding ASP.NET MVC security.  It&#039;s online through the  SDL pages, and here&#39;s the paper&#39;s direct link.  A short summary of the paper follows.
The SDL preaches &#039;secure by default&#039;. When Windows Live moved to ASP.Net MVC, they used that opportunity to build [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2009/11/preventing-security-development-errors-lessons-learned-at-windows-live-by-using-asp-net-mvc/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>On the Importance of Good Developer Documentation</title>
		<link>http://www.casabasecurity.com/blog/2009/11/on-the-importance-of-good-developer-documentation/</link>
		<comments>http://www.casabasecurity.com/blog/2009/11/on-the-importance-of-good-developer-documentation/#comments</comments>
		<pubDate>Fri, 20 Nov 2009 19:01:27 +0000</pubDate>
		<dc:creator>Ramsey Dow</dc:creator>
				<category><![CDATA[Development]]></category>
		<category><![CDATA[SDL]]></category>

		<guid isPermaLink="false">56 at http://www.casabasecurity.com</guid>
		<description><![CDATA[Programmers rely on documentation. It&#039;s how we learn to use APIs. Misusing APIs is a leading source of vulnerability. You might think that documentation is a cure to this ailment. Unfortunately, as someone who has been in software development for a long time, I can tell you that documentation quality is not always what it [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2009/11/on-the-importance-of-good-developer-documentation/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Use the Source, Luke!</title>
		<link>http://www.casabasecurity.com/blog/2009/10/use-the-source-luke/</link>
		<comments>http://www.casabasecurity.com/blog/2009/10/use-the-source-luke/#comments</comments>
		<pubDate>Tue, 20 Oct 2009 19:35:13 +0000</pubDate>
		<dc:creator>Ramsey Dow</dc:creator>
				<category><![CDATA[Development]]></category>
		<category><![CDATA[SDL]]></category>

		<guid isPermaLink="false">53 at http://www.casabasecurity.com</guid>
		<description><![CDATA[If there&#039;s one thing that I&#039;ve learned throughout the years as a programmer, it is not always safe to trust the documentation. In fact, there is an old saying, &#8220;Use the source, Luke!&#8221; When possible, you should do just that.
While looking over the CERT Secure C Coding Standard I noticed the following recommendation: ERR30-C. Set [...]]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2009/10/use-the-source-luke/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Unicode security vulnerabilities &#8211; presentation from Internationalization and Unicode Conference 33</title>
		<link>http://www.casabasecurity.com/blog/2009/10/unicode-security-vulnerabilities-presentation-from-internationalization-and-unicode-conference-33/</link>
		<comments>http://www.casabasecurity.com/blog/2009/10/unicode-security-vulnerabilities-presentation-from-internationalization-and-unicode-conference-33/#comments</comments>
		<pubDate>Tue, 20 Oct 2009 19:24:44 +0000</pubDate>
		<dc:creator>Chris Weber</dc:creator>
				<category><![CDATA[Unicode]]></category>
		<category><![CDATA[presentation]]></category>

		<guid isPermaLink="false">52 at http://www.casabasecurity.com</guid>
		<description><![CDATA[I&#039;m attaching my slides from the Unicode conference last week in San Jose, California.  I&#039;m getting much feedback for code-level action items.  Providing details for code review and static analysis is in the works, with a focus on major frameworks such as ICU, .NET, and Java.
You can  download the presentation here.
]]></description>
		<wfw:commentRss>http://www.casabasecurity.com/blog/2009/10/unicode-security-vulnerabilities-presentation-from-internationalization-and-unicode-conference-33/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
