6 min
InsightIDR
Defense in Depth Using Deception Technology in InsightIDR
Today, we are diving into the four pieces of deception technology that Rapid7 offers through our incident detection and response tool, InsightIDR.
5 min
Research
DOUBLEPULSAR over RDP: Baselining Badness on the Internet
How many internet-accessible RDP services have the DOPU implant installed? How much DOPU-over-RDP traffic do we see being sprayed across the internet?
5 min
InsightIDR
Capture the Flag: Red Team vs. Cloud SIEM
Here's how InsightIDR fared in a recent Capture the Flag (CTF) meetup with a special blue-team element.
3 min
InsightIDR
Deception Technology in InsightIDR: Setting Up Honeypots
In order to overcome the adversary, we must first seek to understand. By
understanding how attackers operate, and what today’s modern network looks like
from an attacker’s perspective, it’s possible to deceive an attacker, or at
least have warning around internal network compromise. Today, let’s touch on a
classic deception technology
[https://www.rapid7.com/solutions/deception-technology/] that continues to
evolve: the honeypot.
Honeypots are decoy systems, deployed alongside production system
1 min
Honeypots
Whiteboard Wednesday: Your 6-Minute Recap of Q1 2018’s Threat Landscape
Gotten a chance to read Rapid7’s Quarterly Threat Report for 2018 Q1
[https://www.rapid7.com/info/threat-report/2018-q1-threat-report/]? If not (or
if you’re more of an auditory learner), we’ve put together a 6-minute recap
video of the major findings. In our Quarterly Threat Reports
[https://www.rapid7.com/info/threat-report/], our security researchers provide a
wide-angle view of the threat landscape by leveraging intelligence from the
Rapid7 Insight platform [https://www.rapid7.com/products/
2 min
Honeypots
Off the Chain! A Research Paper Observing Bitcoin Nodes on the Public Internet
Over the last several years, blockchain-based technologies have exploded in
growth. Lately it seems like blockchains are turning up everywhere, from
chicken
management systems
[https://www.bloomberg.com/news/features/2018-04-09/yes-these-chickens-are-on-the-blockchain]
to the next hot cryptocurrency
[https://medium.com/bitfwd/how-to-do-an-ico-on-ethereum-in-less-than-20-minutes-a0062219374]
.
Waves of new companies, products and applications exist, often in the form of
just wedging a blockcha
5 min
InsightIDR
How to Identify Attacker Reconnaissance on Your Internal Network
The most vulnerable moment for attackers is when they first gain internal access
to your corporate network. In order to determine their next step, intruders must
perform reconnaissance to scout available ports, services, and assets from which
they can pivot and gain access to customer databases, credit card data, source
code, and more. These initial moments are arguably your best opportunities to
catch attackers before critical assets are breached, but unfortunately, it can
be very challenging t
6 min
Research
WannaCry Update: Vulnerable SMB Shares Are Widely Deployed And People Are Scanning For Them (Port 445 Exploit)
WannaCry Overview
Last week the WannaCry ransomware worm, also known as Wanna Decryptor, Wanna
Decryptor 2.0, WNCRY, and WannaCrypt started spreading around the world, holding
computers for ransom at hospitals, government offices, and businesses. To recap:
WannaCry exploits a vulnerability in the Windows Server Message Block (SMB) file
sharing protocol. It spreads to unpatched devices directly connected to the
internet and, once inside an organization, those machines and devices behind the
firew
4 min
Honeypots
Apache Struts Vulnerability (CVE-2017-5638) Exploit Traffic
UPDATE - March 10th, 2017: Rapid7 added a check that works in conjunction with
Nexpose's web spider functionality. This check will be performed against any
URIs discovered with the suffix “.action” (the default configuration for Apache
Struts apps). To learn more about using this check, read this post
[/2017/03/15/using-web-spider-to-detect-vulnerable-apache-struts-apps-cve-2017-5638]
.
UPDATE - March 9th, 2017: Scan your network for this vulnerability
[https://www.rapid7.com/products/nexpose/d
8 min
Haxmas
12 Days of HaXmas: A HaxMas Carol
(A Story by Rapid7 Labs)
Merry HaXmas to you! Each year we mark the 12 Days of HaXmas [/tag/haxmas] with
12 blog posts on hacking-related topics and roundups from the year. This year,
we're highlighting some of the “gifts” we want to give back to the community.
And while these gifts may not come wrapped with a bow, we hope you enjoy them.
Happy Holi-data from Rapid7 Labs!
It's been a big year for the Rapid7 elves Labs team. Our nigh 200-node strong
Heisenberg Cloud honeypot network has enabled
4 min
Honeypots
Deception Technology: Can It Detect Intruders Earlier in their Attack Chain?
Every infosec conference is chatting about the Attack Chain, a visual mapping of
the steps an intruder must take to breach a network. If you can detect traces of
an attack earlier, you not only have more time to respond, but can stop the
unauthorized access to monetizable data and its exfiltration.
Even as attackers and pen-testers continue to evolve their techniques, the
Attack Chain continues to provide a great baseline framework to map out your
security detection program.
Many of today's
2 min
Cloud Infrastructure
[Cloud Security Research] Cross-Cloud Adversary Analytics
Introducing Project Heisenberg Cloud
Project Heisenberg Cloud is a Rapid7 Labs research project with a singular
purpose: understand what attackers, researchers and organizations are doing in,
across and against cloud environments. This research is based on data collected
from a new, Rapid7-developed honeypot framework called Heisenberg along with
internet reconnaissance data from Rapid7's Project Sonar
[https://sonar.labs.rapid7.com/?CS=blog].
Internet-scale reconnaissance with cloud-inspired a
4 min
Honeypots
Leverage Attackers' Need To Explore For Detection
When you examine the sanitized forensic analyses, threat briefings, and
aggregated annual reports, there are a two basic facts that emerge:
1. There are a lot of different attacker groups with access to the same
Internet as baby boomers and short-term contractors.
2. Most of them are proficient at user impersonation once on the network to
remain undetected for months.
In this reality, our organizations need to do more than just build defenses and
sit in waiting until known signature
3 min
InsightIDR
Detect Corporate Identity Theft with a New Intruder Trap: Honey Credentials
If you're only looking through your log files, reliably detecting early signs of
attacker reconnaissance can be a nightmare. Why is this important? If you can
detect and react to an intruder early in the attack chain, it's possible to kick
the intruder out before he or she accesses your critical assets. This is not
only good for you (no monetary data is stolen), but it's also critical because
this is the only time in the chain that the intruder is at a disadvantage.
Once an attacker has an i
6 min
Research
The Attacker's Dictionary
Rapid7 is publishing a report about the passwords attackers use when they scan
the internet indiscriminately. You can pick up a copy at booth #4215 at the RSA
Conference this week, or online right here
[https://information.rapid7.com/attackers-dictionary.html]. The following post
describes some of what is investigated in the report.
Announcing the Attacker's Dictionary
Rapid7's Project Sonar [https://sonar.labs.rapid7.com/] periodically scans the
internet across a variety of ports and protocols