All Posts

Petition for Reform of the DMCA and CFAA

Here's the TL;DR: Software now runs everything and all software has flaws, which means that we, as consumers, are at risk. This includes YOU, and can impact your safety or quality of life. Sign this petition to protect your right to information on how you are exposed to risk: https://petitions.whitehouse.gov/petition/unlock-public-access-research-software -safety-through-dmca-and-cfaa-reform/DHzwhzLD The petition Last weekend a petition

8 min

Adventures in Empty UDP Scanning

One of the interesting things about security research, and I guess research in general, is that all too often the only research that is publicized is research that proves something or shows something especially amazing. Research that is incomplete, where the original hypothesis or idea ends up being incorrect, or that ends up at non-spectacular conclusions rarely ends up getting published. I feel that this trend is doing a disservice to the research community because the paths that the authors

2 min IT Ops

How to Master the Installation of the Windows Agent

Over the past month we have been updating the LogentriesWindows Agent to make it more powerful for our growing customers needs. One particular area we felt needed updating was the Command Line capabilities of the Windows Agent . Logentries is now proud to announce that you now have even more ways to install our Windows Agent to your environment.

2 min API

Scan Export/Import Using the nexpose-client Gem

The latest release (5.10.13) introduces a new feature into Nexpose, scan exporting and importing. We're looking to address a need in air-gap environments, where customers can have multiple consoles to address network partitioning. This approach is not without its warts. For example, if you have deleted assets from a site, this process will bring them back to life. This post is going to walk through a pair of Ruby scripts using the nexpose-client gem. The first script will export the site config

5 min IT Ops

In the Log Management World: Are you a Fox or Hedgehog?

I’ve recently been reading Nate Silver’s book, “The Signal and the Noise.” In the book, Silver looks at a number of areas where predictions have been made and considers how successful they have been, as well as the reasons why they have been accurate (or not). I couldn’t help but draw the similarities how most companies use log management tools today. Silver’s particular interests are political forecasting (see www.fivethirtyeight

2 min Incident Detection

UserInsight Integrates with LogRhythm SIEM to Accelerate Incident Detection and Response

Rapid7 UserInsight finds the attacks you're missing by detecting and investigating indications of compromised users from the endpoint to the cloud. UserInsight now integrates with LogRhythm, a leading Gartner-rated SIEMs in the industry. If you have already integrated all of your data sources with LogRhythm, you can now configure UserInsight to consume its data through LogRhythm, significantly simplifying your UserInsight deployment. UserInsight

2 min Authentication

Protect Your Service Accounts: Detecting Service Accounts Authenticating from a New Host

IT professionals set up service accounts to enable automated processes, such as backup services and network scans. In UserInsight, we can give you quick visibility into service accounts by detecting which accounts do not have password expiration enabled. Many UserInsight subscribers love this simple feature, which is available the instant they have integrated their LDAP directory with UserInsight. In addition, UserInsight has several new ways to detect compromised service accounts. To do their

3 min IT Ops

Heroku Buttons Rock!

As one of Heroku’s beta users I had the chance to check out the new Heroku button gallery last week. I must say I was very pleasantly surprised. Over the past few years, it’s fair to say Heroku have nailed their PAAS offering. They are one of the few PAAS providers to truly succeed in providing developers both an easy to deploy platform, and a full ecosystem of add ons. This allows you as a developer to get on with what you do best. Yes, you can actually spend you

2 min SIEM

Get HP ArcSight Alerts on Compromised Credentials, Phishing Attacks and Suspicious Behavior

If you're using HP ArcSight ESM as your SIEM, you can now add user-based incident detection and response to your bag of tricks. Rapid7 is releasing a new integration between Rapid7 UserInsight and HP ArcSight ESM , which enables you to detect, investigate and respond to security threats targeting a company's users more quickly and effectively. HP ArcSight is

3 min IT Ops

Logging from PHP Web Frameworks like Laravel

So what is Laravel ? Laravel is a relatively new MVC web framework for PHP that was released in 2012. It’s also the most popular PHP project on Github at the time of this post. Like many web frameworks, Laravel boasts an easy learning-curve to get an app up and running. This was certainly the case when I used it. While this post is focusing on logging in Laravel, its applicable to other php web frameworks, like Symfony2

2 min Vulnerability Disclosure

UserInsight Gets the All-Clear for ShellShock and Helps Detect Attackers on Your Network

If you're in security, you've likely already heard about the ShellShock vulnerability (aka Bash Bug, CVE-2014-6271, and CVE-204-7169). We have reviewed how ShellShock is being exploited, and the disclosed vectors are not applicable to our UserInsight deployment, yet we're following the security community's lead around patching all of our systems. In case other systems on your network have been compromised, you should be extra vigilant about suspicio

3 min Vulnerability Disclosure

Bash the bash bug: Here's how to scan for CVE-2014-6271 (Shellshock)

__ A severe vulnerability was disclosed in bash that is present on most Linux, BSD, and Unix-like systems, including Mac OS X. The basis of this vulnerability (nicknamed Shellshock) is that bash does not stop processing after the function definition, leaving it vulnerable to malicious functions containing trailing commands. Common Vulnerabilities and Exp

5 min API

Working with reports and exports via the RPC API

The Metasploit RPC API provides a straightforward, programmatic way to accomplish basic tasks with your Metasploit Pro instance. Two of the key capabilities are export generation to backup your data and report generation to summarize and share your findings. The RPC API docs are currently undergoing a major overhaul and are a bit out of date for reports and export generation. This post will provide all the examples and configuration options you need to get running. Setting up a client to make t

5 min IT Ops

Cloud Platforms vs. On-Prem - A Guide for the Rest of Us

Working for Cloud based businesses for the greater part of a decade now, one question invariably comes up: “Why should I move my data to the cloud?” There are always a few objections that come up as well. Following-up on a previous blog post where we discussed the business benefits of cloud computing , this will be a discussion on the most common objections and how to have a conversation around cloud and on-premise envir

1 min Metasploit

New "show missing" Command in msfconsole

Hello, Metasploiters! Just wanted to update y'all on a new feature in msfconsole that *hopefully* should make vgrepping through module options a little easier. Show empty required options The new command is show missing, and all it does is show empty required options. Instead of looking through a long list of options and picking out the required ones that haven't been set, just run show missing, and a list of unset required