1 min
Boston Globe Selects Rapid7 as a Top Place to Work
On Sunday the Boston Globe published its annual “Top Places to Work” rankings.
This was our first time participating in the list and I'm very proud to report
that Rapid7 placed #11 in the category for employers with less than 250
employees. I'd like to congratulate our amazing team, not just those in Boston,
but the entire Rapid7 family. The passion and commitment of our team is evident
across all our locations, with everyone contributing to the culture that makes
us successful. Congratulations
3 min
The Advanced Policy Engine
The Advanced Policy Engine is the new configuration compliance framework that
was created for the Nexpose 5.0 release.
Advanced? What makes it advanced?
Anyone can call anything "Advanced" these days. A lot of times it is hard to
tell if it is just marketing or a real improvement. Look at all of the cleaning
ads on television right now.
"Cleaner X cleans 30% then the our previous cleaner using our new Advanced
formula!!!"
Is it really improved? How did they measure the i
0 min
Metasploit
Metasploit Framework Featured on CNN: Phishing Made Simple
While browsing security related articles at CNN, I noticed this video of Eric
Fiterman demonstrating a phishing attack and some post exploitation techniques
with Metasploit Framework.
Video courtesy of:
2 min
Metasploit
PCI DIY: How to do an internal penetration test to satisfy PCI DSS requirement 11.3
If you're accepting or processing credit cards and are therefore subject to PCI
DSS, you'll likely be familiar with requirement 11.3, which demands that you
"perform penetration testing at least once a year, and after any significant
infrastructure or application upgrade or modification". What most companies
don't know is that you don't have to hire an external penetration testing
consultant - you can carry out the penetration test internally, providing you
follow some simple rules:
* Sufficie
3 min
Nexpose
Introducing Metasploit Community Edition!
The two-year anniversary of the Metasploit acquisition is coming up this week.
Over the last two years we added a ridiculous amount of new code to the open
source project, shipped dozens of new releases, and launched two commercial
products. We could not have done this without the full support of the security
community. In return, we wanted to share some of our commercial work with the
security community at large.
As of version 4.1 , we now include the Metasploit
2 min
Patch Tuesday
October 2011 Patch Tuesday
This month, Microsoft issued eight bulletins, addressing 23 vulnerabilities
across Microsoft Windows, Silverlight, .NET and Forefront product lines. Only
two bulletins were rated 'critical', and the rest were rated 'important'.
In terms of prioritizing patching, when I look at security vulnerabilities,
first I want to understand which ones can have the most widespread impact.
MS11-081is a cumulative update which affects Internet Explorer, so it relates to
both corporate and home users. These v
15 min
Metasploit
MonaSploit
Introduction
“Standalone exploits suck”.
egyp7 and bannedit
made this statement earlier this year at Bsides Vegas, and nullthreat
& yours truly
elaborated on this even more during our talk
at Derbycon 2011.
There are many reasons why writing Metasploit exploit modules and submitting
them to the Metasploit framework is a good idea. You're not only going to help
the
3 min
Market SIEMplification or More of the SEIM?
Last week was a busy M&A week for SIEM, with IBM announcing the acquisition of
Q1 Labs and McAfee acquiring Nitro Security. We've been watching this unfold
with interest as both SIEM companies are Rapid7 technology partners. We've had
SIEM integration for our vulnerability management solution Nexpose for some
time, and back in August we introduced APIs for integrating SIEM solutions in
version 4.0 of our professional penetration testing solution, Metasploit Pro.
Nitro Security was the first to
1 min
Metasploit
Metasploit, Scanners, and DNS
One of the awesome things about the Metasploit Framework (and Ruby in general)
is that there is a strong focus on avoiding code duplication. This underlying
philosophy is why we can manage a million-plus line code base with a relatively
small team. In this post, I want to share a recent change which affects how
hostnames with multiple A records are processed by modules using the Scanner
mixin.
Quite of a few of the web's "major" properties, such as google.com, return
multiple IP addresses when
2 min
In Memory of Jeff Berger
Last Thursday morning when I got to work I was devastated to learn that Jeff
Berger, our EVP of Engineering, had passed away unexpectedly the evening
before. It caught everyone who knew him by surprise: he had seemed perfectly
healthy until then. Just the day before, Jeff and I had been working together
and joking around about my new laptop like any other day in the office. I had
no idea that those hours together would be the last time I spent with Jeff. And
later that day and Friday, as I
1 min
Can I use compensating controls to resolve vulnerabilities found during a scan?
Resolving vulnerabilities found during a scan before a passing scan result can
be issued is not always immediately possible, and sometimes the only possible
solution is the use of a Compensating Control.
Compensating controls are not meant to be the de facto response to an identified
vulnerability. Compensating controls may only be employed if a true technical
limitation or business need prevents a vulnerability from being corrected. This
is most commonly the case for zero-day vulnerabiliti
1 min
PCI
What to do if your organization can't demonstrate four passing PCI internal or external scans
Two cases:
1) Your company is assessed for the first time:
Entities participating in their first ever PCI DSS assessment are only required
to demonstrate that the most recent scan result meets the criteria for a passing
scan, and there are policies and procedures in place for future quarterly scans,
to meet the intent of this requirement. So to be compliant with 11.2 the first
time you are assessed, you only need to demonstrate that the most recent scan is
a PASS.
2) Reassessment (from th
2 min
Microsoft
Microsoft September 2011 Patch Tuesday
This month, Microsoft issued five bulletins to address 15 vulnerabilities. All
of these bulletins are rated “important”; however, while there are no “critical”
bulletins this month, organizations should not downplay the vulnerabilities
being addressed. It's easy for organizations to gain a false sense of security
during a light patch month and sometimes an attitude of complacency towards
non-critical vulnerabilities is evident.
“Important” vulnerabilities may not give attackers the full roo
2 min
Morto: Another reason to secure local user accounts
A worm abusing the Remote Desktop service is making the rounds, currently named
Morto . This worm gains
access by trying a small number of weak passwords for the local Administrator
account. After compromising the server, the worm propogates using mapped shares
and provides remote access to the worm's creator. Most public reports involve
Morto gaining access to internet-facing servers, however it is likely that once
Morto is behind a firewa
2 min
Loyalty Cards vs. Privacy Concerns
Recently, I found a pile of loyalty cards from Staples, Office Depot, Best Buy,
Ralphs, Albertson's, Von's, CVS Pharmacy, Rite-Aid, Cost Plus World Market, Van
Heusen, and Panera Bakery. I had to ask myself, how often have these allegedly
“free” cards provided discounted merchandise or free stuff? Since I have yet to
receive a free big-screen TV from BestBuy, I wonder, as an information security
professional, why do I continue to accept the idea that I'm getting something
for nothing?
When stor