3 min
Thank You! Five Years of Metasploit at Rapid7
On October 20, 2009 -- five years ago today -- Rapid7 acquired Metasploit. At
the time, there was skepticism about the deal, and what it would mean for
Metasploit and the open source community. The skepticism was, of course, fair.
If Rapid7 was going to fund (and therefore, control) the development of the
Metasploit Framework, why would anyone contribute to it any more? Why give away
work product for free when Rapid7 is just going to turn around and sell it?
Today, Metasploit is still actively
4 min
IT Ops
4 Alerts You Need In Case System Events Stop Occurring
“Silence is golden”
This is not always true, especially when something you were expecting to happen*
doesn’t* happen.
However, this is true when you have a system or a service you are trying to
maintain and things stop happening or go quiet.
We recently developed a new service — Inactivity Alerting
— to help you with this
common challenge and, as you might expect, it fires alerts when there is noted
inactivity around a specific log or eve
2 min
Nexpose
Site Consolidation with the Nexpose Gem
The introduction of the scan export/import feature opens up the ability to merge
sites, at least through the Ruby gem.
Imagine a scenario where you had split up your assets into several sites, but
now you realize it would be easier to manage them if you just merge them into
one. Maybe you have duplicate assets across sites and that wasn't your intent.
The script below allows you to merge multiple sites into one. I replays the
scans from each site into the new one (in just a fraction of the amou
3 min
Vulnerability Disclosure
Block the POODLE's bite: How to scan for CVE-2014-3566
A severe vulnerability was disclosed in the SSL 3.0 protocol that significantly
jeopardizes the protocol's ability to secure communications. All versions of SSL
have been deprecated and its use should be avoided wherever possible. POODLE
(Padding Oracle On Downgraded Legacy Encryption) is the attack that exploits
this vulnerability and allows a hacker to potentially steal information by
altering communications between the SSL client and the server (MitM). Learn
more
about CVE-2014-3566
4 min
POODLE Unleashed: Understanding the SSL 3.0 Vulnerability
Three researchers from Google
have published findings about a vulnerability in SSL 3.0
, a cryptographic
protocol designed to provide secure communication over the internet. Although
SSL 3.0 is nearly 15 years old, it's still used all over the place – browsers,
VPNs, email clients, etc. In other words, this bug is pretty widespread.
Successful ex
2 min
Microsoft
October Patch Tuesday + Sandworm
Microsoft is back in fine form this month with eight upcoming advisories
affecting Internet Explorer, the entire Microsoft range of supported operating
systems, plus Office, Sharepoint Server and a very specific add on module to
their development tools called “ASP .NET MVC”. Originally nine advisories were
listed in the advance notice, but one of the vulnerabilities affecting Office
and the Japanese language IME was dropped for reasons unknown (the dropped
advisory was bulletin #4 in the advanc
1 min
Sandworm aka CVE-2014-4114
UPDATED: 2.30pm, ET, Tuesday, Oct 14.
There's another vulnerability with a clever name getting a lot of attention:
Sandworm aka
CVE-2014-4114.
This is not a cause for panic for the average system administrator or home
users, but you should take it seriously and patch any vulnerable systems ASAP.
While the reach is pretty broad because the vulnerability in question affects
all versions of the Windows operating system from Vista SP2 to Win
4 min
IT Ops
How to Format Nginx and Django Logs Using KVPs
Interested in learning a couple insider tips to gain more value from your
logs using additional structure?
Specifically, we will show how to easily introduce key-value pair (KVP) format
on Nginx and Django logs.
Of course, the approach is not restricted to those two types of logs, and can be
applied to numerous applications.
Previously, our Head of Product, Marc Concannon explained how logging
information in JSON format makes
it possible to leverag
3 min
IT Ops
Logs: The Most Fine-grained Data Source
As co-founder of Logentries I am often asked – “Why Logs?” And I have to admit,
upon first impression, ‘log management
and analytics’ does not seem like
the sexiest space 🙂 However at Logentries we are here to
redefine that space, to provide a solution to access, manage and understand your
log data that is easy to use, cost effective and intelligent (i.e. it does the
hard work so you don’t have to). But that being said it sti
3 min
Public Policy
Petition for Reform of the DMCA and CFAA
Here's the TL;DR:
Software now runs everything and all software has flaws, which means that we, as
consumers, are at risk. This includes YOU, and can impact your safety or quality
of life. Sign this petition to protect your right to information on how you are
exposed to risk:
https://petitions.whitehouse.gov/petition/unlock-public-access-research-software
-safety-through-dmca-and-cfaa-reform/DHzwhzLD
The petition
Last weekend a petition
8 min
Adventures in Empty UDP Scanning
One of the interesting things about security research, and I guess research in
general, is that all too often the only research that is publicized is research
that proves something or shows something especially amazing. Research that is
incomplete, where the original hypothesis or idea ends up being incorrect, or
that ends up at non-spectacular conclusions rarely ends up getting published. I
feel that this trend is doing a disservice to the research community because the
paths that the authors
2 min
IT Ops
How to Master the Installation of the Windows Agent
Over the past month we have been updating the LogentriesWindows Agent
to make it more powerful for our
growing customers needs. One particular area we felt needed updating was the
Command Line capabilities of the Windows Agent
.
Logentries is now proud to announce that you now have even more ways to install
our Windows Agent to your environment.
2 min
API
Scan Export/Import Using the nexpose-client Gem
The latest release (5.10.13) introduces a new feature into Nexpose, scan
exporting and importing. We're looking to address a need in air-gap
environments, where customers can have multiple consoles to address network
partitioning. This approach is not without its warts. For example, if you have
deleted assets from a site, this process will bring them back to life.
This post is going to walk through a pair of Ruby scripts using the
nexpose-client gem. The first script will export the site config
5 min
IT Ops
In the Log Management World: Are you a Fox or Hedgehog?
I’ve recently been reading Nate Silver’s book, “The Signal and the Noise.” In
the book, Silver looks at a number of areas where predictions have been made and
considers how successful they have been, as well as the reasons why they have
been accurate (or not).
I couldn’t help but draw the similarities how most companies use log management
tools today.
Silver’s particular interests are political forecasting (see
www.fivethirtyeight
2 min
Incident Detection
UserInsight Integrates with LogRhythm SIEM to Accelerate Incident Detection and Response
Rapid7 UserInsight finds the attacks you're missing by detecting and
investigating indications of compromised users from the endpoint to the cloud.
UserInsight now integrates with
LogRhythm, a leading Gartner-rated SIEMs in the industry. If you have already
integrated all of your data sources with LogRhythm, you can now configure
UserInsight to consume its data through LogRhythm, significantly simplifying
your UserInsight deployment.
UserInsight