3 min
IoT
ROCA: Vulnerable RSA Key Generation
In the KRACK-related and BadRabbit-related chaos of the past week and a half,
some people missed a less flashy vulnerability that nevertheless dug up key
long-term questions on IoT supply chains and embedded technology. The
Czech-based Center for Research on Cryptography and Security published research
last weekon a vulnerability (CVE-2017-15361) in the RSA key generation process
in a widely-used cryptographic software library found in Infineon secure chips.
Specifically:
“The algorithmic vulne
3 min
Malware
The BadRabbit Ransomware Attack: What You Need To Know
What’s Up?
Rapid7 has been tracking reports of an expanding ransomware campaign dubbed
BadRabbit. Russian news outlets and other organizations across Europe have
reported being victims of this malware and the “outbreak” is continuing to
spread.
The BadRabbit attackers appear to have learned some lessons from previous
outbreaks earlier this year and have both limited the external spreading
capabilities of the ransomware as well as made the payments a bit harder for
researchers, responders and au
6 min
Phishing
NCSAM Security Crash Diet, Week 3: Privacy and Backups
In week three of Rapid7's NCSAM 'Security Crash Diet' series, our cybersleuth 'Olivia' tests practical advice on privacy (think location-sharing) and has a few scary moments with backups.
2 min
Metasploit Weekly Wrapup
Metasploit Wrapup: Oct. 20, 2017
Exploits for hours. Gather 'round with a pocket full of shells.
8 min
5 Wrong Lessons From Equifax, and the Missed Opportunity of OWASP
Much ink has been spilled on the Equifax breach, along with plenty of
(well-deserved) public excoriation of all responsible parties, starting from the
top.
However, quantity is no substitute for quality, and certainly not when it comes
to tech journalism. Oftentimes, the content of such articles is dictated by the
need for attention: clickbait first, substance never. As a result, there’s a
missed opportunity to turn a disaster into a teachable moment.
What’s worse is that many people will
1 min
Komand
Everything You Need to Know About Building a Career in Security
Are you thinking about pursuing a career in security? Or have you already
started one, and you’re wondering what it will take to get to the next level?
Perhaps you have been in the security field for a long time, and it’s starting
to feel a little stale?
Regardless of where you are in your journey, we’ve put together a helpful guide
full of valuable information and real-world anecdotes about what it means to
pursue this dynamic and challenging vocation.
Free eBook: Defining Your Career Path as
5 min
Rapid7 Perspective
NCSAM Security Crash Diet, Week 2: Social and Travel
Rapid7 guinea pig 'Olivia' describes her efforts during week two of her security 'crash diet for National Cyber Security Awareness Month. This week focused on social sharing and travel security.
2 min
Guest Perspective
NIST Standards and Why They Matter
A primer on implementing NIST recommendations by guest author Matt Kelly
5 min
SIEM
SIEM Market Evolution And The Future of SIEM Tools
There’s a lot to be learned by watching a market like SIEM adapt as technology evolves, both for the attackers and the analysis.
3 min
InsightIDR
InsightIDR Now Supports Multi-Factor Auth and Data Archiving
InsightIDR is now part of the Rapid7 platform. Learn more about our platform vision and how it enables you to have the SIEM solution you've always wanted.
6 min
Vulnerability Management
The Wi-Fi KRACK Vulnerability: What You Need to Know
Everything you need to know about the recently disclosed KRACK vulnerability affecting Wi-Fi security protocols (WPA1 and WPA2).
2 min
Cybersecurity
NCSAM: How Hackable Are You?
Rapid7 partnered with The Today Show to offer a fun, fast self-assessment quiz to determine individual cybersecurity risk levels. How hackable are you?
2 min
Metasploit
Metasploit Wrapup: Metasploit 5 or Bust
What's coming down the pipeline for Metasploit? Brent Cook brings you October's first Metasploit wrap-up.
3 min
InsightVM
InsightVM in the Azure Marketplace
Step-by-step guide to using InsightVM to scan your assets in Microsoft's cloud.
4 min
Vulnerability Disclosure
R7-2017-08: BPC SmartVista SQL Injection Vulnerability
Important update: 2018/01/25
BPC informed Rapid7 that this vulnerability only impacted the specified version
of SmartVista Front-End (2.2.10, revision 287921), which had very limited
distribution. Once the vulnerability described below was discovered, BPC
released a patch on Jul 19, 2017, before the issuance of the public disclosure
by Rapid7 on Oct 17, 2017. We have no reason to believe that any other versions
of SmartVista Front-End are vulnerable to this issue. Rapid7 believed the issue
to st