Metasploit acquired by Rapid7

Early yesterday the news became official first by press release, then by a very well done podcast over at Risky Business. The very popular Metasploit project was acquired by Rapid7.

Metasploit is the largest and most widely used penetration testing framework and collection of publicly available exploits. The project founder, HD Moore is a well known and respected member of the security community. Rapid7 is a provider of commercial vulnerability management software, which is a fancy way to say they do network scans for vulnerabilities and generate reports.

At first glance, detection and exploitation sound like very similar efforts. The truth is that detection and exploitation are very different efforts. Let’s imagine that Microsoft releases a patch. The folks at Rapid7 will immediately begin reverse engineering the patch. They need to understand what changes between a patched and unpatched machine and more importantly how the heck you can remotely detect a behavioural difference without crashing the target machine. Using a variety of techniques, they detect if the machine is “likely” to be vulnerable and include that in a report.

Metasploit has a much different purpose. The same reverse engineering process goes in to figuring out what changed between the patched and unpatched machine – but with a much different purpose. The purpose here is to figure out what was fixed, and once you’ve isolated what got fixed, find out how the “broken” code was exploitable. Hopefully, it’s possible to write an exploit that works with some consistency. Certainly worrying about the target machine’s stability isn’t a concern.

Aside from the research overlap, bringing Metasploit into the Rapid7 fold makes plenty of sense for the folks at Rapid7. The inclusion of the Metasploit intelligence will help them provide their customers with more realistic risk analysis. Understanding what’s “theoretically a problem” versus “what’s easily and consistency exploitable” changes risk substantially. The real risk of a single machine’s security posture may depend on a variety of prerequisites and dependencies involved in getting an exploit to work.

From the Metasploit perspective, there’s no commercial interest behind the project. So the fit is harder for folks to see. Certainly the community will have fears that Rapid7 will make the source closed and proprietary, that Rapid7 may alienate the community or that any of the useful Metasploit features will only be available at a cost. A good example of this is the Nessus project, which went to a closed source model shortly after the Tenable acquisition. Certainly the joining of open source and commercial interests has been accomplished while maintaining the community aspects as illustrated by the SourceFire maintenance of the Snort project.

I think what makes this acquisition substantially different is that the Metasploit project is led by HD Moore. He has dedicated his time and personal funds to the project for the last 6 and a half years and cares about the project deeply. When asked about the acquisition, HD responds “Acquisitions are all about folks getting tired of what they are doing.  They want to change gears. They want to move on to something else. This is the opposite. I love Metasploit”. In his new role as Chief Security Officer at Rapid7, HD will get to focus his time on the development he loves and hopes to find more time with his family. He also gets a team of 5 dedicated developers.

Bottom line, I don’t really care what the PR department says, but if HD says the project will stay open source and continue with even more momentum and community involvement – I believe him. His credibility is rock solid and as anyone who knows him knows – he’s one of the most sincere people you’ll meet. Some disclosure here, HD also custom built the netbooks we gave away for the SecTor awards with no personal benefit or interest other than supporting the community. This move to Rapid7 will also be for the benefit of the community.

Related Download
CanadianCIO Census 2016 Mapping Out the Innovation Agenda Sponsor: Cogeco Peer 1
CanadianCIO Census 2016 Mapping Out the Innovation Agenda
The CanadianCIO 2016 census will help you answer those questions and more. Based on detailed survey results from more than 100 senior technology leaders, the new report offers insights on issues ranging from stature and spend to challenges and the opportunities ahead.
Register Now