Black Hat, Las Vegas: Controversy greeted news that Metasploit would release a raft of modules to speed up hacks of Oracle's database management system, but some security experts believe Metasploit is offering nothing new.
Chris Anley, director of UK penetration testing firm NGS and co-author of the Database Hackers' Handbook, said Metasploit's free hacking tools had been available for years, but this was the first time so many modules had come out at once to automate the hacking process.
Anley said Oracle's database was known to be vulnerable, but Oracle had done much in recent years to close the loopholes.
Oracle users should follow the supplier's advice on how to configure the database and set up the securities, and then install the patches when Oracle released them. "The aim should be to prevent, not to cure," he said.
Anley has used Metasploit's tools to discover gaps in Oracle's defences. "It's good," he said.
He had mixed feelings about Metasploit's effectiveness. On one hand it was a good tool for system administrators and penetration testers to use to find vulnerabilities in corporate database systems. On the other, Metasploit exploited the vulnerabilities, opening the way for bad people to do massive damage.
"It is a weapon, but it is not a master key," Anley said. "If the database is properly configured and patched, firms should have nothing to worry about."
Research released at the Black Hat Conference by Microsoft showed that more than 90% of malware tries to exploit vulnerabilities for which patches have existed for two years or more. This made it imperative for firms to evaluate, test and install patches when they came out to preserve their systems' integrity.
Anley said many systems administrators were using Metasploit to bolser their requests for the money they need to keep systems up-to-date.
"Many sysadmins who ask the board for patch budget find it easier to get when they can prove their vulnerability," he said.
Anley said Metasploit also helped to level the playing field between large and small firms. Large firms had the resources and staff to throw at securing their systems, but Metasploit allowed smaller firms to find them quickly and easily with fewer skills and cost.