1 min
Apple
Apple Silicon Support on Insight Agent
We are pleased to announce the general availability of native support of Apple Silicon chips for the Rapid7 Insight Agent.
9 min
Vulnerability Disclosure
Vulntober: Multiple Mobile Browser Address Bar Spoofing Vulnerabilities
Today, we're announcing a coordinated vulnerability disclosure on a set of address bar spoofing vulnerabilities that affect a number of mobile browsers.
5 min
Exploits
macOS Keychain Security : What You Need To Know
If you follow the infosec twitterverse or have been keeping an eye on macOS news
sites, you’ve likely seen a tweet
[https://twitter.com/patrickwardle/status/912254053849079808] (with accompanying
video) from Patrick Wardle (@patrickwardle [https://twitter.com/patrickwardle])
that purports to demonstrate dumping and exfiltration of something called the
“keychain” without an associated privilege escalation prompt. Patrick also has a
more in-depth Q&A blog post [https://www.patreon.com/posts/14556
1 min
Microsoft
Cisco Enable / Privileged Exec Support
In Nexpose [https://rapid7.com/products/nexpose/] version 6.4.28, we are adding
support for privileged elevation on Cisco devices through enable command for
those that are running SSH version 2.
A fully privileged policy scan provides more accurate information on the
target's compliance status, and the ability to do so through enable password,
while keeping the actual user privilege low, adds an additional layer of
security for your devices. This allows our users to run fully privileged policy
3 min
Microsoft
Introducing Interactive Guides
Recently, Rapid7 took a step forward to deliver insight to our customers: our
vulnerability management solutions now include the ability to deliver
interactive guides. Guides are step-by-step workflows, built to deliver
assistance to users at the right time. Guides are concise and may be absorbed
with just a few clicks. They are available anytime on-demand within the user
interface, so you can quickly and easily find the information you need, as you
need it, where you will be applying it.
Here'
4 min
Microsoft
Attacking Microsoft Office - OpenOffice with Metasploit Macro Exploits
It is fair to say that Microsoft Office and OpenOffice are some of the most
popular applications in the world. We use them for writing papers, making slides
for presentations, analyzing sales or financial data, and more. This software is
so important to businesses that, even in developing countries, workers that are
proficient in an Office suite can make a decent living based on this skill
alone.
Unfortunately, high popularity for software also means more high-value targets
in the eyes of an at
4 min
Android
Pokemon Go, Security, and Obsolescence
Pokemon Go started it.
The crusty old house cell phone, which we had years ago ported from a genuine
AT&T land line to a T-Mobile account, suddenly caught the attention of my middle
son.
> "Hey Dad, can I use that phone to catch Pokemon at the park?"
"Sure! Have fun, and don't come back until sundown!"
A few minutes later, he had hunted down his first Pikachu, which apparently
required running around the block in Texas summer heat a few times. Sweat-soaked
but proud, he happily presented hi
5 min
Vulnerability Management
Using the National Vunerability Database to Reveal Vulnerability Trends Over Time
This is a guest post by Ismail Guneydas. Ismail Guneydas is senior technical
leader with over ten years of experience in vulnerability management, digital
forensics, e-Crime investigations and teaching. Currently he is a senior
vulnerability manager at Kimberly-Clark and an adjunct faculty at Texas A&M. He
has M.S. in computer science and MBA degrees.
2015 is in the past, so now is as good a time as any to get some numbers
together from the year that was and analyze them. For this blog post,
12 min
Apple
Reduced Annoyances and Increased Security on iOS 9: A Win Win!
Introduction
Early this year, I posted an article [/2015/02/26/the-gif-guide-to-ios-security]
on iOS Hardening that used animated GIFs to explain most of the recommended
settings.
Since then, iOS 9 was released, bringing along many new features
[http://www.apple.com/ca/ios/whats-new/], including better support for
Two-Factor Authentication, as iMessage and FaceTime now work without the need
for app-specific passwords, and as your trusted devices now automatically get
trusted when you authentic
2 min
Android
The Haves And Have-Nots in Device Security
Today's story
[http://arstechnica.com/tech-policy/2015/11/feds-explain-sort-of-why-they-really-want-data-on-seized-iphone-5s/]
about the ongoing issues law enforcement is running into with Apple's
encrypted-by-default design illustrates a major difference between the iPhone
and the Android security models. Encryption by default on older Apple devices
makes it impossible for anyone without the password to decrypt the phone. This,
in turn, becomes a problem for law enforcement, since it means tha
2 min
Windows
Metasploit Framework Open Source Installers
Rapid7 has long supplied universal Metasploit installers for Linux and Windows.
These installers contain both the open source Metasploit Framework as well as
commercial extensions, which include a graphical user interface, metamodules,
wizards, social engineering tools and integration with other Rapid7 tools. While
these features are very useful, we recognized that they are not for everyone.
According to our recent survey of Metasploit Community users, most only used it
for the open source comp
4 min
Apple
Weekly Metasploit Wrapup
Time for another weekly wrapup for Metasploit! Since it's been getting some play
in the news, I wanted to use this space to talk a little bit more about CERT's
recent advisory regarding hardcoded credentials on small office / home office
(SOHO) routers. You probably know it by it's decidedly non-poetic identifier,
VU#950576 [https://www.kb.cert.org/vuls/id/950576].
Hardcoded credentials are one of the most well-known common vulnerabilities for
SOHO routers from nearly every vendor. These are n
5 min
Apple
Top 10 list of iOS Security Configuration GIFs you can send your friends and relatives
Easily share these animated iOS Security tips with friends and relatives!
While iOS is generally considered to be quite secure, a few configuration items
can improve its security.
Some changes have very little functionality impact, while others are more
visible but probably only needed in specific environments.
This guide contains some of the most important, obvious ones, and contains a GIF
for each configuration step to be taken.
If you already know everything about iOS security, use this a
2 min
Haxmas
12 Days of HaXmas: RCE in Your FTP
This post is the sixth in a series, 12 Days of HaXmas, where we take a look at
some of more notable advancements and events in the Metasploit Framework over
the course of 2014.
It's been quite a year for shell bugs. Of course, we all know about Shellshock,
the tragic bash bug that made the major media news. Most of us heard about the
vulnerabilities in the command line tools wget, curl, and git (more on that last
one later on during HaXmas). But did you notice the FTP command bug? That
remains
2 min
Apple
Apple Releases Patch for Shellshock, May Still Be Vulnerable
Yesterday, Apple released security updates [http://support.apple.com/kb/HT6495]
that address two of the "Shellshock
[/2014/09/25/bash-ing-into-your-network-investigating-cve-2014-6271]" bash
vulnerabilities: CVE-2014-6271 and CVE-2014-7169. At the time of writing, the
updates are not available using Software Update on OS X. Instead, users should
download the package directly from Apple's web site to install it. Updates are
available for 10.7 [http://support.apple.com/kb/DL1767] (Lion), 10.8
[ht