Rapid7 Community Blog

IIRC articles have been posted on HN about this but I don't recall what they were exactly. Also not sure how accurate this [1] is and if it reflects actual security/breaches/... per user, but it does give an indication the OP's feeling might be correct, seeing statements like In 2015, according to the NVD, OSX had the most vulnerabilities, followed by Windows 2012 and Ubuntu Linux. And here [2] it's also at the top and Windows 10 is mentioned as well, but it was quite young then. Similar in 2016 [3] [1] https://community.rapid7.com/community/infosec/blog/2016/04/20/using-t… [2] https://venturebeat.com/2015/12/31/software-with-the-most-vulnerabilit… [3] https://www.cybrnow.com/10-most-vulnerable-os-of-2016/

I can tell you we're trustworthy, but I hear where you're coming from. :) With that said, you can use Metasploit for this too - we just wanted to make a really easy checker for those that wanted a quick OK/NO GO and didn't want to deal with setting Metasploit up. Metasploit docs here: https://community.rapid7.com/community/metasploit/blog/2013/01/10/expl…

My Macbook kernel panics and force-reboots itself because of a bug in some newer Firefox browser feature(s) which are used by a JS-based GBA emulator which was trending on HN yesterday. I can consistently duplicate the kernel panic by resizing the browser window while the emulator is running. I've never in my life experienced such a catastrophic bug from a Flash demo. At worst, such a devastating bug has a decent chance of harboring its own RCE which has yet to be discovered or disclosed; at best, it's one of the most extreme local DOS attacks that a webpage could possibly launch against a client. Just because it's much more trendy to bash Adobe than it is to bash Firefox doesn't mean that Firefox's problems are nonexistent. Firefox RCE found on January 20, 2015: https://community.rapid7.com/community/metasploit/blog/2015/03/23/r7-2… Firefox RCE found on February 25, 2015: https://msisac.cisecurity.org/advisories/2015/2015-018.cfm Firefox RCE found on March 1, 2015: https://www.mozilla.org/en-US/security/advisories/mfsa2015-39/ Firefox RCE found on April 22, 2015: https://msisac.cisecurity.org/advisories/2015/2015-046.cfm etc. Pot calling the kettle black.

Which part, specifically? The only restriction on the EAR I see that applies is that on encryption, and Part 742.15(b) provides an explicit exception for software where the source is publicly available. That's why, for example, non-US citizens must request a special license to download the paid Metasploit version but can download the open source version freely[1]. [1] https://community.rapid7.com/community/infosec/blog/2015/06/13/respons…

The idea of crawling for S3 content has been around for a while (see this post from 2011 https://digi.ninja/blog/whats_in_amazons_buckets.php for one example). Also google can end up indexing content in places like S3 or Azure file stores if there's a link there from another piece of content that it indexes. (for example https://community.rapid7.com/community/infosec/blog/2013/03/27/1951-op…

That's a pretty easy path to find targets, full details tweeted to you daily. And probably high rate of success, as somebody already felt the need to pastebin it. I worry about unprotected S3 buckets too. There's probably a Twitter bot coming soon for those: https://community.rapid7.com/community/infosec/blog/2013/03/27/1951-op…

What I miss in this article in using MDM to harden an iOS devices in the first place. Eg. you can prevent the ability to make backups [0] diminishing that as a route to exfiltrate information. Secondly an always-on VPN [1] to a fixed IP address prevents network information leakage from the moment the device is turned on the first time. A quick search resulted in these two links but I didn't hit a comprehensive guide, other than Apples MDM docs, combining this travel guide combined with iOS MDM hardening. [0] https://community.rapid7.com/community/infosec/blog/2015/11/26/reduced… [1] http://www.howtogeek.com/218851/how-to-enable-always-on-vpn-on-an-ipho…

Even wget can (and does) have critical vulnerabilities: https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2…

blogspam for https://community.rapid7.com/community/infosec/blog/2015/12/20/cve-201… already discussed here: https://news.ycombinator.com/item?id=10768720 and http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-th… see https://news.ycombinator.com/item?id=10762929

It is likely in response to this: https://community.rapid7.com/community/metasploit/blog/2015/06/05/avai…

Localization, localization, localization. Tighten up the security for tiny islands within the organization. Don't just do perimeter defense [1] and don't give a single computer access to thousands of other computers. Don't route and don't monitor everyone's emails through a single server. Use end-to-end encrypted email and ephemeral messages, as Schneier says. Something like Kobeissi's new Peerio tool would've helped Sony and MPAA from having embarrassing emails leak out (not that I wasn't glad to see them leak out). [1] - https://community.rapid7.com/community/infosec/blog/2015/01/07/the-son… [2] - https://peerio.com/

An entirely different RCE in wget today: https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2…

Be more specific. At this moment, if you signup, and setup your VPN, you'll get instant access to Metasploitable2 ( http://metasploitable.ctf )where you can train and test. About Metasploitable2, you can read here https://community.rapid7.com/docs/DOC-1875

Check your internal IP as well, some models are only vulnerable on the LAN. Metasploit has a check module for this, and will also get you a shell: https://community.rapid7.com/community/metasploit/blog/2014/01/17/news…

Google is wrong IMO: there is no need to have such workaround. In rails we had similar problem https://community.rapid7.com/community/metasploit/blog/2013/12/29/remo… and fixed it by adding request.xhr? check on server side. while(1) is ugly solution to currently non-existing problem.

I remember freaking out when I first read HDM's post on the Digi devices[0] because I have a ton of the Digi devices deployed at electrical substations for a customer (electric utility). They are connected to the cellular networks and have public IP addresses. Fortunately, I was rewarded for being paranoid and doing everything I could to lock these devices down pre-deployment as none of them were vulnerable to these attacks. It was certainly a stressful day as I checked each of them one by one, though. [0]: https://community.rapid7.com/community/metasploit/blog/2013/04/23/seri…

Setting wifi passwords would be a good start, but then you'd still have to address the security flaws in wps[1] and upnp[2][pdf]. [1]: http://code.google.com/p/reaver-wps/ [2]: https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596…

The metasploit folks put a pen-tester's guide to finding Rails-running targets on their own blog here: https://community.rapid7.com/community/metasploit/blog/2013/01/10/expl… In addition to common port numbers and stuff like redmine, their tipoffs include looking for Rails-style session cookies, and HTTP response headers emitted by Rails or support machinery. These include "X-Rack-Cache:" and the "X-Powered-By:" header that Phusion Passenger tosses in even if you've configured Apache itself to leave version numbers and component identifiers out of the response. (I'm not sure there's any better way to suppress this stuff than adding mod_headers to the Apache config and using "Header unset")

Looks like there's blog post about the whitepaper [1] which is a bit more informative without reading the PDF, and this was already discussed [2] via an arstechnica article. [1] https://community.rapid7.com/community/infosec/blog/2013/01/29/securit… [2] http://news.ycombinator.com/item?id=5137353

Basically, instant shell access to all unpached RoR 2.x and 3.x, for everyone. This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This module has been tested across multiple versions of RoR 3.x and RoR 2.x From the update here https://community.rapid7.com/community/metasploit/blog/2013/01/09/seri… - https://news.ycombinator.com/item?id=5035023

Isn't this blogspam? The original source is https://community.rapid7.com/community/infosec/blog/2012/12/06/skynet-…

In addition to 7 which was already mentioned, Rapid7 says they've successfully tested it against Ubuntu 10.04 and OSX 10.7.4 as well. https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets… Errata Sec claims it's working on a fully-patched Ubuntu 12.04, provided you're using the official Java package instead of the default OpenJRE. OSX 10.8.1 has also been confirmed. http://erratasec.blogspot.com/2012/08/new-java-0day.html

Original article: https://community.rapid7.com/community/infosec/blog/2012/06/11/its-tim… Note that the analysis is based on a de-duplicated list of hashes - and it is not a frequency analysis of how many people use passwords. Instead, it is an analysis of how many cracked passwords contain certain strings. "link" is not the most common password, as the Forbes article claims, but instead, the most common substring in unique cracked passwords.

HD Moore posted on the Rapid7 blog some of the technical details: https://community.rapid7.com/community/solutions/metasploit/blog/2012/…

This is called DLL Hijacking and it's a class of flaws that gained prominence on Windows earlier this year. Although I would say that Mandiant discussed the issue first, it was only after HDM practically described the WebDAV and other remote exploit vectors that people started taking it seriously. https://community.rapid7.com/community/infosec/blog/2010/08/23/applica… http://blogs.msdn.com/b/david_leblanc/archive/2008/02/20/dll-preloadin… http://www.n00bz.net/blog/2010/9/15/dll-hijacking-with-metasploit-expr…

I followed what you meant and understand baseband management controllers are more similar to IME in terms of risk profile. They're not (generally?) on-chip though, so it's at least up to individual OEMs, and purchasers have slightly more options (if slim). Agree it's not widely enough recognised either though. There's some coverage at least: https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+turned+%22… http://arstechnica.com/security/2013/08/remote-admin-tool-imperils-ser… https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_… https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-pe… https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html http://www.websecuritywatch.com/authentication-bypass-vulnerability-in… http://fish2.com/ipmi/itrain.pdf

An obvious place for a backdoor is in remote management CPUs embedded in the network card. http://www.ssi.gouv.fr/IMG/pdf/csw-trustnetworkcard.pdf Network cards which support RMCP/IPMI protocol are obvious points of attack. They can reboot machines, download boot images, install a new OS, patch memory, emulate a local console, and control the entire machine. CERT has some warnings: https://www.us-cert.gov/ncas/alerts/TA13-207A If there's a default password in a network card, that's a backdoor. Here's a list of the default passwords for many common systems: https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-pe… "admin/admin" is popular. The network card stores passwords in non-volatile memory. If anyone in the supply chain gets hold of the network card briefly, they can add a backdoor by plugging the card into a chassis for power, connecting a network cable, and adding a extra user/password of their own using Linux "ipmitool" running on another machine. The card, when delivered to the end user, now has a backdoor installed. If you have any servers you're responsible for, try connecting with IPMI and do a "list" command to see what users are configured. If you find any you didn't put there, big problem. CERT warns that, if you use the same userid/password for multiple machines in your data center, discarded boards contain that password. So discarded boards must be shredded.

That's some pretty wild speculation. As for "boiling down to calling setSecurityManager(null)" you are forgetting to point out how it was achieved via obscure calls to an instrumentation and management api: https://community.rapid7.com/community/metasploit/blog/2013/02/25/java… Their head of security spoke recently about this topic, so I guess they will have to "fire and sue" him: http://www.computerworld.com/s/article/9236230/Oracle_s_Java_security_… "The plan for Java security is really simple," said Java security lead Milton Smith during a conference call this week with Java user group leaders. "It's to get Java fixed up, number one, and then number two, to communicate our efforts widely. We really can't have one without the other. No amount of talking or smoothing over is going to make anybody happy. We have to fix Java." - See more at: http://www.computerworld.com/s/article/9236230/Oracle_s_Java_security_…