Wednesday, March 3, 2021
  • Setup menu at Appearance » Menus and assign menu to Top Bar Navigation
Advertisement
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News
No Result
View All Result
NikolaNews
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News
No Result
View All Result
NikolaNews
No Result
View All Result
Home Internet Security

Rapid7 launches AttackerKB, a service for crowdsourcing vulnerability assessments

April 15, 2020
in Internet Security
Rapid7 launches AttackerKB, a service for crowdsourcing vulnerability assessments
585
SHARES
3.3k
VIEWS
Share on FacebookShare on Twitter

Image: Rapid7

Cyber-security company Rapid7 launched today a new web service named AttackerKB, a web portal that crowdsources vulnerability assessments to help companies understand and prioritize which bugs need to be patched before others.

The service launched as a closed beta in January 2020 and enters today into a public beta preview.

You might also like

Microsoft account hijack vulnerability earns bug bounty hunter $50,000

Malaysia Airlines suffers data security ‘incident’ spanning nine years

Remote work: 5 things every business needs to know

The site’s primary purpose is to have infosec professionals review vulnerabilities and share the information with others, for free.

The community can then vote on reviews based on how useful the security flaw would be in the hands of an attacker. The more assessments and votes a vulnerability receives, the more dangerous it is considered, and companies can act to prioritize a patch.

Vulnerability assessments services like these are available today from many threat intelligence and analysis firms; however, most are available for pretty steep prices. AttackerKB comes to provide a community-driven crowdsourced alternative at no extra cost, for both large and small companies alike.

Helping fix vulnerability fatigue

In addition, the AttackerKB portal also comes to address another problem in the cyber-security industry — namely, vulnerability fatigue.

The number of security flaws disclosed each week and month has been on a constant rise for the past decade. Each day, security teams at large companies are bombarded by alerts of newly disclosed vulnerabilities.

When security teams learn of a new bug, they must verify if they have vulnerable equipment on their networks and then assess if the vulnerability is dangerous enough to justify planning a maintenance window, and shutting down operations while they test and deploy patches.

Such reviews take from minutes to hours and can clutter the already busy day of a security professional. In many cases, bugs are also overhyped by news sites or members of the infosec community, and security teams end up wasting their time looking into issues that while having high severity scores, are of little to no use to an attacker.

Rapid7’s new AttackerKB aims to solve this problem by having the larger infosec community review vulnerabilities from an attacker’s perspective (hence, the name Attacker KnowledgeBase), leveraging their own areas of expertise to do so.

“Just as an unnoticed bug may escape broad notice, a novel vulnerability that provokes a lot of concern and press coverage may still be relatively uninteresting from an attacker’s point of view (e.g., because the configuration required for exploitation is obscure and unlikely to be implemented in environments encountered on pen tests or red team engagements),” Brent Cook, senior manager of software engineering at Rapid7, told ZDNet in an email.

“AttackerKB strives to provide this qualitative perspective in addition to more objective information (e.g., ‘no user interaction required’ or ‘RCE’) about truly impactful vulnerabilities.”

attackerkb-page.png

Image: ZDNet

Everything can be reviewed

Cook also says that AttackerKB won’t discriminate against the types of vulnerabilities listed on the site. Everything can be reviewed and listed. The site’s true purpose is to review all bugs, and not just those who are of interest to attackers.

“There is no minimum criteria for a vulnerability being listed on the site,” Cook said. “AttackerKB users choose which vulnerabilities to assess as high-impact or benign based on their own interests, skill sets, and personal experiences (e.g., as penetration testers or exploit developers).”

Cook also tells ZDNet that AttackerKB will even include vulnerability assessments for bugs that had yet to receive a CVE identifier.

CVE codes are typically assigned to all major bugs, and, sometimes, companies don’t patch bugs that don’t have a CVE ID, thinking the vulnerability was not important enough to receive a CVE, hence, it’s not important enough to patch.

But, the reality is that many severe bugs fail to receive a CVE in time, primarily due to bureaucracy rather than importance and severity. AttackerKB aims to raise the alarm about such vulnerabilities, even before they receive a CVE.

Furthermore, Cook says that AttackerKB will also list issues that are not eligible to receive a CVE identifier and which aren’t technically “security flaws.” This will help companies be aware of issues that come to light from scientific research, such as feature implementations bugs or weaknesses in protocols, as a whole.

Leaning on the Rapid7 community

All in all, the new AttackerKB site is not meant to be a replacement for the current Common Vulnerability Scoring System (CVSS), an industry-recognized standard for rating security flaws.

“[AttackerKB] is not intended to be an authoritative ranking of which vulnerabilities are the most or least dangerous, but instead a centralized place for the security community to express opinions on which vulnerabilities they consider to be worthy of attention and why they hold those opinions,” Cook said.

As Cook hints, most of the heavy lifting that’s going to happen on the site will be done by its community. However, this isn’t expected to be an issue.

Rapid7 is the company behind Metasploit, today’s most popular penetration-testing toolkit, an open-source project also driven by its users.

The Metasploit community supplies patches, new features, but also develops new Metasploit offensive modules (exploits). Assessing vulnerabilities is a natural step before developing a Metasploit module, a process that Rapid7 now hopes to tap into and leverage to get the AttackerKB portal off the ground.

And Cook tells ZDNet that AttackerKB has struck a nerve with some security professionals during its closed beta period and seems to be filling a gap that many organizations have been longing for.

“We were surprised to hear how frustrated and tired even experienced security professionals were with what they perceived as ‘hype’ surrounding some vulnerabilities,” Cook told ZDNet.

The Rapid7 manager shared the following comment the company received from one of its closed beta users:

“I’m tired of trying to convert hypothetical apocalypses to reality on a regular basis. If a company has strong controls in other areas, many of these ‘doomsday’ zero-days are really mild or not a threat at all. But getting to that final determination is an arduous process.”

Users can sign up to AttackerKB using their GitHub account here.

Credit: Zdnet

Previous Post

49 New Google Chrome Extensions Caught Hijacking Cryptocurrency Wallets

Next Post

Awake Security raises $36 million for AI that identifies network threats

Related Posts

Microsoft account hijack vulnerability earns bug bounty hunter $50,000
Internet Security

Microsoft account hijack vulnerability earns bug bounty hunter $50,000

March 3, 2021
Malaysia Airlines suffers data security ‘incident’ spanning nine years
Internet Security

Malaysia Airlines suffers data security ‘incident’ spanning nine years

March 3, 2021
Remote work: 5 things every business needs to know
Internet Security

Remote work: 5 things every business needs to know

March 3, 2021
New app rollout helps reduce paperwork for NSW frontline child protection caseworkers
Internet Security

New app rollout helps reduce paperwork for NSW frontline child protection caseworkers

March 3, 2021
Linux Mint may start pushing high-priority patches to users
Internet Security

Linux Mint may start pushing high-priority patches to users

March 3, 2021
Next Post
Awake Security raises $36 million for AI that identifies network threats

Awake Security raises $36 million for AI that identifies network threats

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recommended

Plasticity in Deep Learning: Dynamic Adaptations for AI Self-Driving Cars

Plasticity in Deep Learning: Dynamic Adaptations for AI Self-Driving Cars

January 6, 2019
Microsoft, Google Use Artificial Intelligence to Fight Hackers

Microsoft, Google Use Artificial Intelligence to Fight Hackers

January 6, 2019

Categories

  • Artificial Intelligence
  • Big Data
  • Blockchain
  • Crypto News
  • Data Science
  • Digital Marketing
  • Internet Privacy
  • Internet Security
  • Learn to Code
  • Machine Learning
  • Marketing Technology
  • Neural Networks
  • Technology Companies

Don't miss it

Companion Raises $8M Seed Round to Use Machine Learning and Computer Vision to Talk to Dogs
Machine Learning

Companion Raises $8M Seed Round to Use Machine Learning and Computer Vision to Talk to Dogs

March 3, 2021
The TensorFlow Certification: get official recognition, but it’s hard! | by Keenan Moukarzel | Feb, 2021
Neural Networks

The TensorFlow Certification: get official recognition, but it’s hard! | by Keenan Moukarzel | Feb, 2021

March 3, 2021
Microsoft account hijack vulnerability earns bug bounty hunter $50,000
Internet Security

Microsoft account hijack vulnerability earns bug bounty hunter $50,000

March 3, 2021
New Chrome 0-day Bug Under Active Attacks – Update Your Browser ASAP!
Internet Privacy

New Chrome 0-day Bug Under Active Attacks – Update Your Browser ASAP!

March 3, 2021
6 Ways Machine Learning Can Improve Supply Chain’s Bottom Line
Machine Learning

6 Ways Machine Learning Can Improve Supply Chain’s Bottom Line

March 3, 2021
Malaysia Airlines suffers data security ‘incident’ spanning nine years
Internet Security

Malaysia Airlines suffers data security ‘incident’ spanning nine years

March 3, 2021
NikolaNews

NikolaNews.com is an online News Portal which aims to share news about blockchain, AI, Big Data, and Data Privacy and more!

What’s New Here?

  • Companion Raises $8M Seed Round to Use Machine Learning and Computer Vision to Talk to Dogs March 3, 2021
  • The TensorFlow Certification: get official recognition, but it’s hard! | by Keenan Moukarzel | Feb, 2021 March 3, 2021
  • Microsoft account hijack vulnerability earns bug bounty hunter $50,000 March 3, 2021
  • New Chrome 0-day Bug Under Active Attacks – Update Your Browser ASAP! March 3, 2021

Subscribe to get more!

© 2019 NikolaNews.com - Global Tech Updates

No Result
View All Result
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News

© 2019 NikolaNews.com - Global Tech Updates