Slashdot Mirror
Metasploit Project Sold To Rapid7
ancientribe writes "The wildly popular, open-source Metasploit penetration testing tool project has been sold to Rapid7, a vulnerability management vendor, paving the way for a commercial version of Metasploit to eventually hit the market. HD Moore, creator of Metasploit, was hired by Rapid7 and will continue heading up the project. This is big news for the indie Metasploit Project, which now gets full-time resources. Moore says this will translate into faster turnaround for new features. Just what a commercial Metasploit product will look like is still in the works, but Rapid7 expects to keep the Metasploit penetration testing tool as a separate product with 'high integration' into Rapid7's vulnerability management products."
Even names are in high-definition these days.
get off my lawn.
In my day we had to use smoke signals to exploit a neighbor's abacus. And you know what, we liked it.
Now you have your fancy audio couplers and wireless networks.
"If still these truths be held to be
Self evident."
-Edna St. Vincent Millay
Sold to a company, What wut!?
This seems positive so far and they are making all the right noises (hiring Egypt full time onto the project is a really good sign). Both Snort and Wireshark got much better after commercial backing.
Rapid7, who are incredible jerks at least in terms of aggressive cold-call sales people. There are periodic rounds of complaining about them on one of the lists I'm on. We can't stand those guys.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Now that this software is run by a company with assets what are risk that they will get sued out of existence by some company who wrote bad code?
to penetrate the N.S.A's data mining project hosted by
Google's 10 million servers.
Yours In Ashgabat,
K. Trout
I'd like to buy sendmail and apt-get. How much would those two cost me?
I am not clear on how open-source projects get "sold" to commercial entities. I understand how companies can use open source but I don't understand how companies buy and sell open-source programs.
Can someone smarter than me lay out, in business terms, how this works? Was Metasploit a corporation? If so, what kind? Was it an S-corp? C-Corp? LLC? LLP? What were the mechanics of the sale? What approvals were needed from what stakeholders? etc, etc. Basically, I want to know about the buyers and the sellers and less about the actual product.
It seems odd to me that "someone" would benefit financially by selling the work of an open-source program. Wouldn't you need to compensate all contributors (which I am sure is a nightmare)? If not, I am in the wrong biz. Instead, I should start an open-source program, get other people to contribute, and then sell it for my own personal gain.
I could be wrong but I don't think that is allowed, right? So how does all this work? Or am I hopelessly naive?....
You are right, it gets used by script kiddies.
That is EXACTLY why I use it regularly to make sure it doesn't work for them. I can quickly scan a host and see what they may be able to take advantage of.
What do you do? How do you know that you've installed every patch. MS doesn't even TELL you about ever patch, let alone include them in Windows Update. Does all of your other software auto update as well? Do you have some mystical application that makes sure you never make a configuration mistake that opens an exploit? My IIS servers don't return customized version information, is it just supposed to look at that and know what it really translates to and what patches I have installed on it.
You sir, are not a system admin. You may be employed as one, but you certainly shouldn't be. The mere thought that patching is enough by itself is retarded. Assuming that you have perfect configurations that never change and will be safe forever after you set them up is retarded. Pretty much no matter how you look at it, your argument is one of extreme lack of experience.
Every high security environment in the world does penetration testing, as do lower security environments who would rather be safe than sorry. Banks, the government, health care providers to name a few, ALL do penetration testing, both by software, and social engineering, all the way down to trying to actually break into a physical location.
Fuck you and your arrogant ignorance about security, come back to us when you get out of pointy-headed-boss-school or secretary school, whichever you happen to be in.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
It's used mainly by crackers to comprise websites. Fuck this tool and fuck the arrogant script kiddies padding their resumes with it. This software has no legitimate purpose.
Sounds like the righteous anger of someone who left some back doors open for a few script kiddies in his time, and got burned by it.
How do you know that you've installed every patch. MS doesn't even TELL you about ever patch, let alone include them in Windows Update.
First of all, no serious business is using Windows as a server. Sorry but you just discredited yourself with that alone. Again, let's say you find out some exploit works on your box... is there a patch? If yes, why wasn't it already patched? Did you really need to hack yourself just so you could be made aware of a public patch? If so, I think you're the one that needs to be kept away from important computers. If there isn't a patch, what are you going to do, shut down the service? All non-essential services should already be taken down. Anything left has to stay up and you're SOL anyways.
Every high security environment in the world does penetration testing, as do lower security environments who would rather be safe than sorry. Banks, the government, health care providers to name a few, ALL do penetration testing, both by software, and social engineering, all the way down to trying to actually break into a physical location.
Look, you can't even read. I wasn't making an argument against penetration testing. I'm making an argument against script kiddie tools posing as pentesting tools. Pentests can and should be done, often and well. That's not the same as trying to exploit an unpatched box. The only people interested in that are script kiddies.
If you're doing your job right, metasploit serves no legitimate purpose. If you're some dumbass that has to hack himself just to be made aware of public patches then by all means, continue being a dumbass.
>> How do you know that you've installed every patch. MS doesn't even TELL you about ever patch, let alone include them in Windows Update.
> First of all, no serious business is using Windows as a server. Sorry but you just discredited yourself with that alone.
Good thing you're posting as AC so you can't discredit yourself by saying something stupid like that, right?
I'm Rocco. I'm the +5 Funny man.
Steve? Is that you?
It's not.
There will be a legal minefield now that a big company with lot's of money owns Metasploit now. I mean the Metasploit web site doesn't even have a privacy policy.
Security Nerd.
No, it's someone who lives in the real world, not their parents basement.
Whiny bitch.
I work for a hundred million dollar company that makes a substantial portion of its income doing "legitimate" penetration testing.
Our customers are Fortune 500 companies and the like.
It's a very useful toolset.
You would be surprised how many times a week I hear this story:
Security Admin: Upper management doesn't understand the risk these vulnerabilities pose and we can't get funding to get it fixed. We need it demonstrated through videos and screenshots, exactly what sort of damage can be done by a single attacker given 1 week to exploit this application.
So, we pop the app and create a presentation littered with examples of what might happen.
Then security gets funding and the bad guy doesn't get his way.
First of all, no serious business is using Windows as a server. Sorry but you just discredited yourself with that alone.
Huh?
I do security consulting in Fortune 1000 companies and I've never run into one yet that is a strict "no-MS" shop on the server side.
What the hell are you talking about?
Second, every large penetration testing organization that services these Fortune 1000 customers uses Metasploit as a small (very small) component of their toolset.
Our toolset is comprised of over 1000 different bits of software, but I've successfully used Metasploit on at least 10 different engagements in the last 6 months alone against Fortune 1000 (and similar sized) organizations.
I run into a number of environments where patching isn't practical, or isn't allowed.
Medical devices, for example. The kind that do IV-drip monitoring, or the kind that do blood chemistry analysis in a medical laboratory, are regulated by the FDA (I think) and CANNOT be patched. They rely on semi-annual service packs from the manufacturer that are usually 6 months out of date by the time they get FDA approval.
I have done several penetration tests against medical facilities this year and have found metasploit very helpful attacking both UNIX and Windows based systems in this category.
And frankly, even regular systems don't get patched in a large environment. I was in an environment a few weeks ago with over 100 server admins, and very strict rules about change management and patching. There had to be many rounds of testing on every new patch before it went into production and honestly, that wasn't happening. They were consistently running 9 months out of date on some servers. Additionally, they had several Windows NT Machines that hadn't been patched in many years. The security team needed someone to come in to demonstrate the importance of patching and try to accelerate that schedule. Metasploit was very useful in attacking systems, not only Windows, but all platforms.
I'll point out that the greatest number of vulnerabilities present in many server environments comes from Linux/Apache, so your shouting "ooooo Microsoft" seems a little infantile and inexperienced, in retrospect.
Methinks you are talking out your ass.
Do you write all of your own security tools? If not then kindly go fuck yourself.
First of all, no serious business is using Windows as a server. Sorry but you just discredited yourself with that alone.
I do work for fortune 200 companies. Every one of them I have worked at uses Windows for servers. This includes the likes of Boeing, HP, Capital One Bank, Bank of America, the London Stock Exchange, NASDAQ, Charles Schwab. HCA, Accenture, Ford, Toyota, and more. Most of them use IIS, SQL Server, and build .NET applications. Exchange and Active Directory are everywhere. MSFT servers, like it or not are pervasive in the business world. Not necessarily dominant, as big apps tend to get built on other platforms. But they are everywhere, running real systems that handle real money. You are the one discrediting yourself if you really don't know or believe this.
Smart sysadmins do their own penetration testing. We do. The higher ups make us use a CA product which doesn't work as well in my experience as the open source tools. It tends to be 6 months behind.
I was taught to respect my elders. The trouble is, it's getting harder and harder to find some.
[quote]What do you do? How do you know that you've installed every patch. MS doesn't even TELL you about ever patch, let alone include them in Windows Update. Does all of your other software auto update as well? Do you have some mystical application that makes sure you never make a configuration mistake that opens an exploit? My IIS servers don't return customized version information, is it just supposed to look at that and know what it really translates to and what patches I have installed on it.[/quote]
For this you use Secunia PSI.
> Do you write all of your own security tools? If not then kindly go fuck yourself.
You grow your own wheat and grind your own flour? And built your own CPU factory to make the CPU for your computer?
If you do everything yourself, you're certainly the one who should be "fucking yourself".
Seems more logical.
From Sneakers (1992):
Bank Secretary: So, people hire you to break into their places... to make sure no one can break into their places?
Martin Bishop: It's a living.
Bank Secretary: Not a very good one.
cpghost at Cordula's Web.
Actually, I do grow my own wheat and grind it. It is fun and healthy.
Since your remarks were totally outside of the context of the parent poster's posting and the subject being discussed, I will invite you to to shut the fuck up.
Ah so you're the sort who is already fucking himself.
Does all of your other software auto update as well?
Have you never heard of package management systems?
eix-sync && emerge -auDNtv world
Done. Man, you Windows guys are weird.
Any sufficiently advanced intelligence is indistinguishable from stupidity.