Posts by Rapid7

4 min Automation and Orchestration

How to Use OpenVAS to Audit the Security of Your Network (1/2)

Synopsis The Open Vulnerability Assessment System [http://www.openvas.org/index.html] (OpenVAS), is a Free/Libre [https://www.gnu.org/philosophy/free-sw.html] software product that can be used to audit the security of an internal corporate network and find vulnerabilities in a free and automated fashion. It is a competitor to the well known Nessus vulnerability scanning tool. Analyzing the results from tools like Nessus or OpenVAS is an excellent first step for an IT security team working to c

3 min IT Ops

Widely-used Android App Leaks MS Exchange Credentials

In October, Rapid7 researchers [https://community.rapid7.com/community/infosec/blog/2016/10/11/r7-2016-21-nine-folders-certificate-validation-vulnerability-cve-2016-2533] uncovered a significant vulnerability in the Nine mobile application [https://play.google.com/store/apps/details?id=com.ninefolders.hd3&hl=en] for Android. Baldly stated, this app leaks Microsoft Exchange user credentials, plus mail envelopes and attachments, mailbox synchronization data, caleandar entries and tasks to attac

4 min IT Ops

Overview of 'online' algorithm using Standard Deviation example

Here at Logentries [https://logentries.com/centralize-log-data-automatically/?le_trial=online_algorithm-logentries_blog-post_cta-create_trial&utm_campaign=online_algorithm&utm_source=logentries_blog&utm_medium=post_cta&utm_content=create_trial] we are constantly adding to the options for analysing log generated data. The query language ‘LEQL’ [https://logentries.com/resources/how-to-videos/building-a-query/] has a number of statistical functions and a recent addition has been the new Standard

5 min IT Ops

Logging OwnTracks to Logentries

A previous blog [/2016/10/07/logging-mosquitto-server-logs-from-raspberry-pi-to-logentries/] showed how MQTT logs can be sent to Logentries for storage, analysis and how those logs can be to alert on potential MQTT security threats, as well as to store and visualize sensor data. This blog follows that by showing how to build a fully connected IoT system composed of the OwnTracks iOS app as an MQTT publisher, a Raspberry Pi with Mosquitto embedded as an MQTT messaging broker and Logentries as

5 min IT Ops

Logging Mosquitto Server logs (from Raspberry Pi) to Logentries

The Internet is evolving and part of this is the emerging Internet of Things (IoT). IoT allows us to use the Internet to seamlessly connect the cyberspace and real world using physical sensors at huge scale, allowing us to gather and analyze the data across many domains. It is estimated that there will be 20 billion Things connected to the Internet by 2020, generating an enormous amount of data. A previous blog post [/2016/05/17/raspberry-pi-logs-and-iot-sending-pi-log-and-sensor-data-to-loge

3 min Komand

How Security Orchestration and Automation Saves up to 83% of Time Spent Investigating Alerts

You have the tools to detect and notify your team about security threats. You’ve hired the best security practitioners who know what an effective security posture looks like. You’re all set to stop attackers from compromising your systems. Just one more thing: How can you maximize the value of these resources, especially in the face of complex threats and a huge volume of alerts? While processes can go a long way in harmonizing your tools and personnel to accelerate tedious tasks such as alert

3 min Automation and Orchestration

Cross Site Scripting (XSS) Attacks

Synopsis Cross Site Scripting (XSS) Attacks [https://www.rapid7.com/fundamentals/cross-site-scripting/] are the second category of the three largest web attacks used today. Here, we’ll set up a node server to demonstrate an XSS attack, see browser based XSS prevention, and finally discuss what further exploits exist based on this attack. Setup Here’s our normal, tiny node server to demonstrate XSS. Create the file server.js as follows: var http = require('http'); var url = require('url');

7 min Komand

Defender Spotlight: Mike Arpaia of Kolide

Welcome to Defender Spotlight! In this monthly blog series, we interview cybersecurity defenders of all varieties about their experience working in security operations. We’ll inquire about their favorite tools, and ask advice on security topics, trends, and other know-how. In this edition, we spoke with Mike Arpaia, the Co-Founder and CSO of Kolide [https://kolide.co/]. Mike is the original creator of osquery [https://osquery.io/], which he created, open-sourced, and widely deployed while work

6 min Automation and Orchestration

SQL Injection Attacks

Synopsis Let’s examine, understand, and learn how to prevent one of the most common attacks [https://www.rapid7.com/fundamentals/types-of-attacks/] people use to ‘hack’ websites, SQL injection attacks [https://www.rapid7.com/fundamentals/sql-injection-attacks/]. Setup We’ll start by setting up an ultra-lightweight PHP page (server side) connected to a MySQL database, simulating a web application. We need mysql and php. On macOS: $ brew install mysql && brew install php On Linux: Install m

4 min Komand

The Komand Tech Stack: Why We Chose Our Technology

Choosing a technical stack that fits your organization's needs can be tough. When choosing the technology to build your product, there are a few things to consider: * The experience of the team * The impact on recruiting efforts (e.g., how easy will it be to find these skills) * The ability to execute fast and to maintain quality We took all of these points into heavy consideration when choosing the Komand tech stack. Below is a breakdown of what we chose, why we

5 min IT Ops

Moving away from MVC

In of all my years as a software engineer, trying new libraries, frameworks and paradigms has been such a pleasure especially in web development. Even before the well known javascript libraries, web development was based on backend apps which render heavy html code within css and some js code. Frameworks such as spring, .NET MVC, django and rails helped us with abstractions and predone tasks increasing development speed and quality (reuse principles). But, it was not enough. Apps were getting

9 min Komand

Microservices – Please, don’t

This article originally appeared on Basho. [http://basho.com/posts/technical/microservices-please-dont/] It is adapted from a lightning talk Sean gave at the Boston Golang meetup in December of 2015. For a while, it seemed like everyone was crazy for microservices. You couldn’t open up your favorite news aggregator of choice without some company you had never heard of touting how the move to microservices had saved their engineering organization. You may have even worked for one of those compan

5 min Automation and Orchestration

Malware Attack Vectors

Synopsis You’re a malware writer. You’ve been tasked with infecting a remote computer, one that you have never seen before, have no physical contact with, and don’t have the IP address of. Maybe you have the email address of a user of that computer, or just the name of the facility in which that computer is stored. How do you proceed? Hopefully I’m not describing you or someone you know, but sometimes it can be helpful to consider the mindset of an adversary when devising defensive measures. In

3 min InsightIDR

3 Ways for Generating Reports on WAN Bandwidth Utilization

3 popular ways of getting visibility into WAN bandwidth monitoring, one of the most popular use cases for network traffic analysis.

13 min Automation and Orchestration

OSSEC Series: Configuration Pitfalls

Synopsis: OSSEC is a popular host intrusion and log analysis system. It’s a great tool, and when configured and customized properly it can be a very powerful and holistic addition to your environment. In this article I will list a number of problems I’ve encountered while using OSSEC over the years. Many of these are the result of incomplete documentation. The purpose of this article is to save you time if you’re having trouble getting things working while doing similar tasks. Pitfalls: A gro