4 min
IT Ops
Goodbye to the VCR: Rewinding Down Memory Lane
The VHS tape was a thing of a magic that is alien in the world of on-demand
media. It represented a promise of entertainment. A promise only realized when
loading the tape into the player and pressing the play button. There was an air
of excitement around every video, and you could never be entirely certain about
what the video contained.
I was reminded of the mystique of the VCR just this month when I read about its
final demise. Funai Electric, the last major manufacturer of VCR players,
4 min
Komand
The 5 Security Processes That Should Be Automated
According to CSO Online, the average time it takes a security team of a
mid-sized company to respond to a successful attack is 46 days
[http://www.csoonline.com/article/2989302/cyber-attacks-espionage/average-business-spends-15-million-battling-cybercrime.html]
. This includes time spent manually investigating the incident, analyzing the
data, jumping between unintegrated systems during triage, and coordinating the
response. And while there are many reasons for slow incident response times,
manu
4 min
Automation and Orchestration
How to Use OpenVAS to Audit the Security of Your Network (1/2)
Synopsis
The Open Vulnerability Assessment System [http://www.openvas.org/index.html]
(OpenVAS), is a Free/Libre [https://www.gnu.org/philosophy/free-sw.html]
software product that can be used to audit the security of an internal corporate
network and find vulnerabilities in a free and automated fashion. It is a
competitor to the well known Nessus vulnerability scanning tool. Analyzing the
results from tools like Nessus or OpenVAS is an excellent first step for an IT
security team working to c
3 min
IT Ops
Widely-used Android App Leaks MS Exchange Credentials
In October, Rapid7 researchers
[https://community.rapid7.com/community/infosec/blog/2016/10/11/r7-2016-21-nine-folders-certificate-validation-vulnerability-cve-2016-2533]
uncovered a significant vulnerability in the Nine mobile application
[https://play.google.com/store/apps/details?id=com.ninefolders.hd3&hl=en] for
Android. Baldly stated, this app leaks Microsoft Exchange user credentials, plus
mail envelopes and attachments, mailbox synchronization data, caleandar entries
and tasks to attac
4 min
IT Ops
Overview of 'online' algorithm using Standard Deviation example
Here at Logentries
[https://logentries.com/centralize-log-data-automatically/?le_trial=online_algorithm-logentries_blog-post_cta-create_trial&utm_campaign=online_algorithm&utm_source=logentries_blog&utm_medium=post_cta&utm_content=create_trial]
we are constantly adding to the options for analysing log generated data. The
query language ‘LEQL’
[https://logentries.com/resources/how-to-videos/building-a-query/] has a number
of statistical functions and a recent addition has been the new Standard
5 min
IT Ops
Logging OwnTracks to Logentries
A previous blog
[/2016/10/07/logging-mosquitto-server-logs-from-raspberry-pi-to-logentries/]
showed how MQTT logs can be sent to Logentries for storage, analysis and how
those logs can be to alert on potential MQTT security threats, as well as to
store and visualize sensor data. This blog follows that by showing how to build
a fully connected IoT system composed of the OwnTracks iOS app as an MQTT
publisher, a Raspberry Pi with Mosquitto embedded as an MQTT messaging broker
and Logentries as
5 min
IT Ops
Logging Mosquitto Server logs (from Raspberry Pi) to Logentries
The Internet is evolving and part of this is the emerging Internet of Things
(IoT). IoT allows us to use the Internet to seamlessly connect the cyberspace
and real world using physical sensors at huge scale, allowing us to gather and
analyze the data across many domains. It is estimated that there will be 20
billion Things connected to the Internet by 2020, generating an enormous amount
of data.
A previous blog post
[/2016/05/17/raspberry-pi-logs-and-iot-sending-pi-log-and-sensor-data-to-loge
3 min
Komand
How Security Orchestration and Automation Saves up to 83% of Time Spent Investigating Alerts
You have the tools to detect and notify your team about security threats. You’ve
hired the best security practitioners who know what an effective security
posture looks like. You’re all set to stop attackers from compromising your
systems.
Just one more thing: How can you maximize the value of these resources,
especially in the face of complex threats and a huge volume of alerts?
While processes can go a long way in harmonizing your tools and personnel to
accelerate tedious tasks such as alert
3 min
Automation and Orchestration
Cross Site Scripting (XSS) Attacks
Synopsis
Cross Site Scripting (XSS) Attacks
[https://www.rapid7.com/fundamentals/cross-site-scripting/] are the second
category of the three largest web attacks used today. Here, we’ll set up a node
server to demonstrate an XSS attack, see browser based XSS prevention, and
finally discuss what further exploits exist based on this attack.
Setup
Here’s our normal, tiny node server to demonstrate XSS.
Create the file server.js as follows:
var http = require('http');
var url = require('url');
7 min
Komand
Defender Spotlight: Mike Arpaia of Kolide
Welcome to Defender Spotlight! In this monthly blog series, we interview
cybersecurity defenders of all varieties about their experience working in
security operations. We’ll inquire about their favorite tools, and ask advice on
security topics, trends, and other know-how.
In this edition, we spoke with Mike Arpaia, the Co-Founder and CSO of Kolide
[https://kolide.co/].
Mike is the original creator of osquery [https://osquery.io/], which he created,
open-sourced, and widely deployed while work
6 min
Automation and Orchestration
SQL Injection Attacks
Synopsis
Let’s examine, understand, and learn how to prevent one of the most common
attacks [https://www.rapid7.com/fundamentals/types-of-attacks/] people use to
‘hack’ websites, SQL injection attacks
[https://www.rapid7.com/fundamentals/sql-injection-attacks/].
Setup
We’ll start by setting up an ultra-lightweight PHP page (server side) connected
to a MySQL database, simulating a web application.
We need mysql and php. On macOS:
$ brew install mysql && brew install php
On Linux:
Install m
4 min
Komand
The Komand Tech Stack: Why We Chose Our Technology
Choosing a technical stack that fits your organization's needs can be tough.
When choosing the technology to build your product, there are a few things to
consider:
* The experience of the team
* The impact on recruiting efforts (e.g., how easy will it be to find these
skills)
* The ability to execute fast and to maintain quality
We took all of these points into heavy consideration when choosing the Komand
tech stack. Below is a breakdown of what we chose, why we
5 min
IT Ops
Moving away from MVC
In of all my years as a software engineer, trying new libraries, frameworks and
paradigms has been such a pleasure especially in web development. Even before
the well known javascript libraries, web development was based on backend apps
which render heavy html code within css and some js code. Frameworks such as
spring, .NET MVC, django and rails helped us with abstractions and predone tasks
increasing development speed and quality (reuse principles). But, it was not
enough. Apps were getting
9 min
Komand
Microservices – Please, don’t
This article originally appeared on Basho.
[http://basho.com/posts/technical/microservices-please-dont/] It is adapted from
a lightning talk Sean gave at the Boston Golang meetup in December of 2015.
For a while, it seemed like everyone was crazy for microservices. You couldn’t
open up your favorite news aggregator of choice without some company you had
never heard of touting how the move to microservices had saved their engineering
organization. You may have even worked for one of those compan
5 min
Automation and Orchestration
Malware Attack Vectors
Synopsis
You’re a malware writer. You’ve been tasked with infecting a remote computer,
one that you have never seen before, have no physical contact with, and don’t
have the IP address of. Maybe you have the email address of a user of that
computer, or just the name of the facility in which that computer is stored. How
do you proceed?
Hopefully I’m not describing you or someone you know, but sometimes it can be
helpful to consider the mindset of an adversary when devising defensive
measures. In