3 min
InsightIDR
How to Troubleshoot Slow Network Issues With Network Traffic Analysis
In this blog, we discuss how to troubleshoot slow network issues with Network Traffic Analysis.
3 min
Project Sonar
The Internet of Gas Station Tank Gauges -- Final Take?
In early 2015, HD Moore performed one of the first publicly accessible research
related to Internet-connected gas station tank gauges, The Internet of Gas
Station Tank Gauges .
Later that same year, I did a follow-up study that probed a little deeper in
The
Internet of Gas Station Tank Gauges — Take #2
. As part of that
study, we were attempting to see if the exposure of these devic
3 min
Incident Detection
Introspective Intelligence: Understanding Detection Techniques
To provide insight into the methods devised by Rapid7, we'll need to revisit the
detection methods implemented across InfoSec products and services and how we
apply data differently. Rapid7 gathers volumes of threat intelligence on a daily
basis - from new penetration testing tools, tactics, and procedures in
Metasploit, vulnerability detections in Nexpose, and user behavior anomalies in
InsightIDR. By continuously generating, refining and applying threat
intelligence, we enable more robust dete
1 min
Automation and Orchestration
A Guide on Security Automation Best Practices
Ask three different security teams what is holding them back from faster
time-to-response and chances are you’ll get three different answers:
1. Manual, time-intensive processes
2. Lack of integrated tools
3. Lack of development resources
All of these problems exist across both big and small companies in any industry,
from healthcare to finance to e-commerce. But in a digital world where attacks
are both prevalent and pervasive, defenders always need to be a step (if not
two) ahead.
This i
6 min
Research
The Data Science Process at Rapid7
Data Science is more than just math. A successful Data Science team and
successful Data Science projects require relationships with outside teams, clear
communication, as well as good decision making, problem solving and critical
thinking abilities. Thus, when we talk about Data Science at Rapid7, we talk
about the Data Science Process our teams use to take a Data Science project from
inception to completion, where math and analysis are important, but not the only
aspects of the project.
What a
4 min
Metasploit
Metasploitable3: An Intentionally Vulnerable Machine for Exploit Testing
Test Your Might With The Shiny New Metasploitable3
Today I am excited to announce the debut of our shiny new toy - Metasploitable3
.
Metasploitable3 is a free virtual machine that allows you to simulate attacks
largely using Metasploit .
It has been used by people in the security industry for a variety of reasons:
such as training for network exploitation, exploit development, software
testing, techn
4 min
Vulnerability Disclosure
R7-2016-24, OpenNMS Stored XSS via SNMP (CVE-2016-6555, CVE-2016-6556)
Stored server cross-site scripting (XSS) vulnerabilities in the web application
component of OpenNMS via the Simple Network
Management Protocol (SNMP). Authentication is not required to exploit.
Credit
This issue was discovered by independent researcher Matthew Kienow
, and reported by Rapid7.
Products Affected
The following versions were tested and successfully exploited:
* OpenNMS version 18.0.0
* OpenNMS version 18.0.1
Ope
4 min
IT Ops
Goodbye to the VCR: Rewinding Down Memory Lane
The VHS tape was a thing of a magic that is alien in the world of on-demand
media. It represented a promise of entertainment. A promise only realized when
loading the tape into the player and pressing the play button. There was an air
of excitement around every video, and you could never be entirely certain about
what the video contained.
I was reminded of the mystique of the VCR just this month when I read about its
final demise. Funai Electric, the last major manufacturer of VCR players,
6 min
Rapid7 Perspective
Conflicting perspectives on the TLS 1.3 Draft
In the security industry, as in much of life, a problem we often face is that of
balance. We are challenged with finding the balance between an organization's
operational needs and the level of security that can be implemented. In many
situations an acceptable, if less than optimal, solution can be found but there
are cases where this balance cannot be achieved. I recently saw a case of this
on the
mailing list of the IETF
5 min
CIS Controls
Using CIS Controls To Stop Your Network From Falling in With the Wrong Crowd
Earlier this month Kyle Flaherty wrote a post
on the Rapid7 Community Blog about how Rapid7 came out on top for coverage of
the Center for Internet Security (CIS) Top 20 Security Controls
. In light of recent DDoS events I'd like
to take a little time to discuss at a high level what the controls are, how they
would help, and what organizations can do to improve th
9 min
Project Sonar
Project Sonar Study of LDAP on the Internet
The topic of today's post is a Rapid7 Project Sonar
study of publicly accessible LDAP services on
the Internet. This research effort was started in July of this year and various
portions of it continue today. In light of the Shadowserver Foundations's
recent announcement regarding the
availability relevant reports we thought it would be a good time to make some of
our results public. The study was originally intended to be a
3 min
Nexpose
Patch Tuesday, November 2016
November
continues a long running trend with Microsoft's products where the majority of
bulletins (7) address remote code execution (RCE), closely followed by elevation
of privilege (6) and security feature bypass (1). All of this month's critical
bulletins are remote code execution vulnerabilities, affecting a variety of
products and platforms including Edge, Internet Explorer, Exchange, Microsoft
Office, Office Services and
3 min
Project Lorelei
Election Day: Tracking the Mirai Botnet
by Bob Rudis , Tod Beardsley , Derek
Abdine & Rapid7 Labs Team
What do I need to know?
Over the last several days, the traffic generated by the Mirai family of botnets
has changed. We've been tracking the
ramp-up and draw-down patterns of Mirai botnet members and have seen the peaks
associated with each reported large scale and micro attack since the DDoS attack
against Dyn, Inc. We've tracked over 360,000 uniqu
4 min
Komand
The 5 Security Processes That Should Be Automated
According to CSO Online, the average time it takes a security team of a
mid-sized company to respond to a successful attack is 46 days
. This includes time spent manually investigating the incident, analyzing the
data, jumping between unintegrated systems during triage, and coordinating the
response. And while there are many reasons for slow incident response times,
manu
4 min
Automation and Orchestration
How to Use OpenVAS to Audit the Security of Your Network (1/2)
Synopsis
The Open Vulnerability Assessment System
(OpenVAS), is a Free/Libre
software product that can be used to audit the security of an internal corporate
network and find vulnerabilities in a free and automated fashion. It is a
competitor to the well known Nessus vulnerability scanning tool. Analyzing the
results from tools like Nessus or OpenVAS is an excellent first step for an IT
security team working to c