3 min
Metasploit
Good-bye msfpayload and msfencode
Greetings all,
On behalf of the Metasploit's development teams, I'd like to officially announce
the decision of deprecating msfpayload and msfencode. Also starting today, we no
longer support or accept patches for these two utilities. On June 8th 2015, the
elderly msfpayload and msfencode will retire from the Metasploit repository, and
replaced by their successor msfvenom. The tool msfvenom is the combination of
msfpayload and msfencode, and has been in testing for more than 3.5 years.
msfpayl
3 min
IT Ops
Community Packs for AWS: Out of the Box Dashboards, Alerts, & Queries
We recently released Logentries Community Packs
, dynamic JSON files that (when uploaded into Logentries
) automatically create Saved queries, Dashboards and Alerts.
The true power of these packs is that anyone can create, modify and share them.
We called them Community Packs because we want to offer different Communities a
“pack” of log analysis features customized for their specifi
5 min
IT Ops
Keepalived and HAProxy in AWS: An Exploratory Guide
We’re going to explore high availability and load balancing using Keepalived
and HAProxy .
Keepalived is a routing software designed to provide simple and robust
facilities for load balancing and high-availability to Linux systems and
Linux-based infrastructures.
HAProxy is an open source load balancer/reverse proxy generally used for load
balancing web services, but also has the functionality to load balance TCP
traffic.
Together, Keepali
6 min
IT Ops
ES6: Javascript in Harmony: An Overview of New Language Features
ECMAScript 6 brings powerful new capabilities and some tasty syntactical sugar
to the ubiquitous Javascript language, as it continues to grab an ever
increasing slice of developer mindshare.
Now that the ES6 feature set is frozen and just minor refinements will be
made over the coming months, much of this new functionality has already landed
in modern browsers, and will continue to roll out with each new browser update.
For the impatient, there are also now several excellent precompile / polyf
3 min
Authentication
Patch CVE-2014-6324 To Avoid A Complete Domain Rebuild When UserInsight Detects Its Exploit
On Tuesday, November 18th, Microsoft released an out-of-band security patch
affecting any Windows domain controllers that are not running in Azure. I have
not yet seen any cute graphics or buzzword names for it, so it will likely be
known as MS14-068, CVE-2014-6324, or "that Kerberos vulnerability that is being
exploited in the wild to completely take over Windows domains" because it rolls
off the tongue a little better.
There is a very informative description of the vulnerability, impact, and
5 min
Antivirus
Finding and Protecting mission-critical assets with ControlsInsight
ControlsInsight helps organizations measure how well critical security controls
are deployed and configured throughout the enterprise. Yet, as hard you may
try, it's extremely difficult to protect every asset on your network perfectly,
and it's often necessary to prioritize "misson-critical" assets that store
important or sensitive business data. Clearly, securing the laptop computer of
Sally, the chief financial officer, is much more important than securing Joe the
intern's laptop, which prob
3 min
IT Ops
How to Implement JSON Formatting of IIS for Analytics and Troubleshooting
Previously, we wrote about setting up a Windows environment
to log JSON formatted logs
using our Windows Agent or our DataHub. Now we’ll tackle IIS
.
IIS, like Windows, has a unique log format that makes it difficult to read,
parse, and garner useful information. The log is a flat file that has a
line-per-web hit; similar to Apache or Nginx. But, it’s not as easy to format
intoJSON as Apache and Nginix
4 min
IT Ops
For the Love of Code: Why We Use JSHint for Static Code Analysis
As developers, we all strive for clean, readable, and easy to refactor code;
but, unfortunately, this doesn’t always happen.
No matter how great a developer you are, or what language you’re coding in;
problems caused by bugs inevitably spring up like weeds in the grass. These
problems are exasperated by poorly organized and poorly written code. Once
quality starts to drop, even the cleanest high-quality code in your project
begins to be affected, until you’re left with a jumbled mess of (and ha
5 min
Metasploit
R7-2014-18: Hikvision DVR Devices - Multiple Vulnerabilities
Rapid7 Labs has found multiple vulnerabilities in Hikvision
DVR (Digital Video Recorder) devices such as
the DS-7204 and other models in the same product series that allow a remote
attacker to gain full control of the device. More specifically, three typical
buffer overflow vulnerabilities were discovered in Hikvision's RTSP request
handling code: CVE-2014-4878, CVE-2014-4879 and CVE-2014-4880. This blog post
serves as disclosure of the technical details for th
2 min
Nexpose
Why that CVSS score? HTTP TRACE vulnerability-your questions answered
Recently we saw that there were some questions on Twitter about the HTTP TRACE
vulnerability check in Nexpose, specifically around the CVSS score. Thank you
@digininja , @tautology0
, and @raesene for
raising this issue - we love to hear from our users and appreciate honest
feedback on our solutions. Questions like these cause us to challenge our own
assumptions and reasoning, which is always a healthy pr
1 min
Patch Tuesday
Patch Tuesday, November 2014
Patch Tuesday came in hot this month with 15 advisories, of which 4 are listed
as critical. Hate to point it out, but this was originally advertised as 16
with 5 critical, but the patch for MS14-068 apparently isn't ready for prime
time yet. Hopefully the decision to hold it back was based on both the testing
and an assessment of risk.
The top patching priority is definitely going to be MS14-064, which is under
active exploitation in the wild and may be related, at least superficially, to
las
2 min
Nexpose
Nexpose API: SiteSaveRequest and IP Addresses vs Host Names
With the release of Nexpose 5.11.1
we made some changes
under the hood that improved scan performance and scan integration performance.
As a result of those changes, the rules applied to using SiteSaveRequest in API
1.1 became stricter, which may have caused issues for some users. In the past
this "worked" for the most part, though there were certainly side effects
observable in the Web interface after the fact. Since these issues were not
a
2 min
Patch Tuesday
SChannel and MS14-066, another Red Alert?
This has been a busy Patch Tuesday for Microsoft. Of the fourteen bulletins,
four of which were deemed critical, MS14-066
has been getting
significant attention. This vulnerability, CVE-2014-6321
, affects
Windows Secure Channel (SChannel)
and was discovered privately by Microsoft through an in
3 min
IT Ops
JSON Formatting of Windows Events: It's Hot!
It seems like everyone in DevOps has been talking about JSON recently – JSON is
hot!
Logentries has written a few posts covering this topic, coveringWhat is JSON
, Common Problems Solved with JSON
, and our Exporting as JSON
. However we thought it
would be beneficial to dive into some more specific applications. We already
wrote about a few, namely JSON a
3 min
Cloud Infrastructure
Securing the Shadow IT: How to Enable Secure Cloud Services for Your Business
You may fear that cloud services jeopardize your organization's security. Yet,
your business relies on cloud services to increase its productivity. Introducing
a policy to forbid these cloud services may not be a viable option. The better
option is to get visibility into your shadow IT
and to enable your business to
use it securely to increase productivity and keep up with the market.
Step one: Find out which cloud services your organization is u