Dennis Fisher talks with HD Moore, the founder of the Metasploit Project and the chief security officer at Rapid7, about the evolution of Metasploit, the difficulty of client-side exploitation in the age of DEP and ASLR and the decision on when to publish an exploit.
*Podcast audio courtesy of sykboy65
Subscribe to the Digital Underground podcast on 
Metasploit today released an exploit module for a serious vulnerability in Honeywell industrial control system software used to manage everything from HVAC and building access systems, to energy and facilities management processes.
The exploit targeting the latest zero-day vulnerability in the Java platform is dropping ransomware, and has been found in another exploit kit. Security experts, including U.S.-CERT last night, advise users and IT managers to disable Java on endpoints and browsers. Meanwhile, Polish security researcher Adam Gowdiak of Security Explorations, said the attacks target a pair of vulnerabilities, one of which was reported to Oracle in September and patched, apparently incompletely, in October.
UPDATE–Unix and Linux versions of Tectia SSH server as well as the open source versions of Free FTPD and FreeSSHD for Windows are vulnerable to a critical remote authentication bypass exploit published on the Free Disclosure List.
“Patents against innovation”. Sounds as paradoxical as “bees against honey”, “hamburger patties against buns”, “students against sex” or “rock ...
Fostering knowledge exchange among different generations of security researchers is maybe one of the best traits of a good security conference. Judging by its attendance, NoSuchCon can easily claim to...
Olga Rumyantseva began her 7 Volcanoes expedition in Antarctica as the first Russian woman to climb Mount Sidley. Mount Sidley (4,285 m) is the highest and most imposing of the five volcanic mountai...
Cybersecurity for the next generation!
Art tho it may be, the pen-test in but only one small facet of the IT management process. Scanned and Fully-patched are still highly susceptible to all matter of threats and misuse. Elevating the pen-test to art form, which by itself won’t keep a network fully secure, it akin to milking a cow with satin gloves and claiming product is silky smooth.