HD Moore Chief Security Officer Rapid7

Rapid7, a leading provider of IT security risk management software, has announced the availability of the new release of Metasploit Pro, which introduces advanced capabilities to simulate social engineering attacks. With Metasploit 4.5, security professionals can now gain visibility into their organization’s exposure to phishing attacks through user-based and technical threat vectors, and introduce the necessary controls to manage the risk.

Phishing is often the initial attack vector of a data breach and experts estimate that “more than 500 million phishing e-mails appear in user inboxes every day.”[1] These kinds of attacks result in financial losses of several billion dollars per year[2], so it is critical that security professionals gain visibility into this risk in their organization and introduce appropriate controls.

“Many organizations already conduct end-user trainings and implement technical security controls to protect their data, but it’s hard to know how effective these measures are, or even if you’re focusing on the right things,” said HD Moore, chief architect of Metasploit and chief security officer for Rapid7. “Metasploit assesses the effectiveness of these measures, and provides metrics and management for each step in the chain of compromise to help you reduce your risk.”

Defenders can set up social engineering campaigns that will send simulated phishing emails to employees across the organization. The results indicate areas to focus on for training or mitigations. For example, a click-through on an email points to a lack in security awareness, whereas an exploited browser indicates a technical problem. Users who fall victim to the simulated phishing emails can be redirected to an online training, where they can learn to spot and correctly handle phishing emails in the future. Alternatively, administrators can consult the Metasploit social engineering report to follow up with individuals by email or in person. Reports contain both overview statistics and details about the risk level of each user and host.

“It’s amazing what a little security awareness can do versus the considerable time, money and effort required to clean up infected machines. And that’s before you even consider the impact of compromised data,” said Otis Bishop, security consultant for Crosslin Technologies. “Phishing emails do not discriminate and are frequently the first foot in the door for an attacker, but a little bit of education can go a very long way in terms of company resources and email use. When you look at it in this light, it’s easy to see the significant value of Metasploit, which enables us to measure our clients’ exposure, deliver targeted training, and track the results.”

Additionally, Metasploit 4.5 enables defenders to quickly and easily set up fake websites to emulate real phishing attacks. Security professionals just need to enter the URL of the site they want to clone and Metasploit automatically changes forms to capture user input, adding client-side exploits if desired. Security professionals can also test end-user security awareness by creating malicious files on USB flash drives that can be left in the company parking lot or restrooms as bait. Metasploit’s social engineering functionality can also be used for penetration testing engagements to compromise one or more computers as a starting point for a more comprehensive security assessment.

Metasploit Pro’s social engineering reports go above and beyond alternative penetration testing solutions by providing conversion rates, such as how many people clicked through a phishing email, how many entered username and password on a fake website, and how many systems were compromised. It enables organizations to track and trend the effectiveness of their security programs. Only Metasploit Pro provides advice on how to address risk at each step in the social engineering funnel. With its community of 175,000 users, security researchers and open source contributors, Metasploit provides the most recent attack vectors and a realistic picture or your organization’s exposure.

The software is part of Rapid7’s comprehensive IT security risk management suite used by organizations to gain contextual visibility into and manage risk associated with information technology, users and threats.

Rapid7 is a leading provider of IT security risk management software. Its integrated vulnerability management and penetration testing products, Nexpose and Metasploit, and mobile risk management solution, Mobilisafe, enable defenders to gain contextual visibility and manage the risk associated with the IT environment, users and threats relevant to their organization. Rapid7's simple and innovative solutions are used by more than 2,000 enterprises and government agencies in more than 65 countries, while the Company's free products are downloaded more than one million times per year and enhanced by more than 175,000 members of its open source security community. Rapid7 has been recognized as one of the fastest growing security companies by Inc. Magazine and as a "Top Place to Work" by the Boston Globe. Its products are top rated by Gartner®, Forrester® and SC Magazine. The Company is backed by Bain Capital and Technology Crossover Ventures.

[1] Dr Dobbs: http://www.drdobbs.com/security/why-phish-should-not-be-treated-as-spam/240001777

[2] Carnegie Mellon: http://repository.cmu.edu/cgi/viewcontent.cgi?article=1011&context=cylab