Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

wallarm.com

Post reply on HN
Print view View original

61–70 of 90 posts

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#61

Post by hkr_mag »

Bombthecat wrote: post #31

For that money you can get IBM datapower. Which is an all in one very powerful solution... With near wire speed transfer. I don't know why I should get that?

Frankly speaking, I don't know what is pricing for IBM Datapower. Is it really only $1k per month?

I am pretty sure that it's a kind of good option for some enterprises. But most of our customer has high volume applications deployed in several datacenters, with CI/CD and DevOps approaches used. For them, hardware security boxes are almost impossible to use. What they are looking for is DevOps friendly tools that scale and orchestrated well with their application. That is why we're partners with NGINX to provide all the flexibility of our filter nodes.

Moreover, IBM thing will not help you to figure out security flaws in your apps and network perimeter. It will not provide you with details which of millions of malicious request you really need to care about as they are targeting existing security flaws.

I would like to get your feedback about this IBM product. Do you use for some time? It's not that popular among security community (at least, that part we usually talk with). If you give you access to test it, we'll show you some bypasses — unfortunately, there are dozens of them for almost all old-fashioned security solutions like this.

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#62

Post by hkr_mag »

sz4kerto wrote: post #60
hkr_mag wrote: post #59

Earlier quoted context omitted.

Just a few examples of the attacks that other security products can't catch. 1. A very complicated things going through XML/JSON APIs. Wallarm really parse XML, understand the structure and catch even complicated exploitation attempt like this: -1 &a; &b; &c; &d; &e; &f; id=1 2. Every vector that exploits vulnerabilities over WebSockets. Some product doesn't support WebSocket at all. Some just proxy data without anal…

Aren't you claiming that you don't need to terminate SSL?

No magic here :) Sure, we need to terminate SSL. Either before traffic is going to Wallarm proxy node, either by Wallarm Node itself.

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#63

Post by hkr_mag »

csears wrote: post #12

Starting at $1000/mo

Actually, for startups with no or small revenue, we give a license free of charge.

If you need more than four nodes, the price is more than flexible. Also, we always try to understand better customer infrastructure and, case by case, give node free of charge at all—to cover all the customer's network perimeter. Don't want them to sacrifice part of the infrastructure because of stupid license/price limitations.

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#64

Post by liquidise »

elmigranto wrote: post #51
hkr_mag wrote: post #49

Earlier quoted context omitted.

Yeah! We would say the same if someone propose us to use this :) 1. We share the source code of Wallarm Node (nginx-based filter instance) with the companies after signing NDA. 2. Will run 3rd party audit of the code and share the report. 3. At some point, we'll open-source it. Ivan (wlrm) will come up with the examples of attacks soon.

What do you mean "come up"? You made a commercial product and don't have a single use case or user story to pitch?

Why the negativity? I can think of a number of tech questions that no one but the deepest in the technical weeds on a team could provide actual answers to. Is deferring to someone else on a team to answer questions so bad?

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#65

Post by hkr_mag »

0xmohit wrote: post #14
csears wrote: post #12

Starting at $1000/mo

Isn't it cheap for a magical black-box?

When we started working on Wallarm we really wanted to make it real magic :) So we did everything automatically (profiling of applications, tuning rulesets, etc.) It turned out that security guys (like we are) more likely to understand how it actually works. So we did a lot to give this visibility. E.g now it's possible to get a visual profile of an application, add/change the facts about, its structure etc.

In fact, Wallarm Node is much less black-box than most of the commercial security products (with their own operation system you don't have access to, updates no one knows what inside is, etc.). It is predictable in configuration (just new directives in nginx.conf). Scripts, which come with the Wallarm Node, are free to review. In-memory storage (used for fast local analytics) is accessible. You can watch what the data is exchanged between Wallarm Nodes and Wallarm Cloud. And you use operation system you know.

With our customers, it's OK for us to share source codes.

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#66

Post by hkr_mag »

Guys, here is a story of how we got the the idea of Wallarm

We started as a team of white hat hackers. Ivan (CEO) is a respected researcher known for his articles and talks at international security conferences (BlackHat, Hack In the Box, etc) on web application security.

Everything started with boutique security consulting company founded by Ivan in 2009 which with time became a synonym for the "best security audits for web applications". After each security audit had carried out we got a simple question "Good job, guys, but what's next now? We've fixed all the vulnerabilities you found. The only problem that we deploy code five times a week — and each (!) update might have new security flaws. We could be hacked again anytime!"

So "What's next?" We didn't know and were looking for the answer evaluating different products pretending to secure modern web — with orchestration by DevOps teams, continuous integration (CI) with frequent code updates right on production systems, complex Single-Page Applications and REST APIs, etc. And we failed. Every solution was broken for the same reasons.

1. They are not ready for continuous integration. Frequent code updates results in false positives when legitimate users got banned. The only way to avoid this is manual/semi-manual reconfiguration after each code release.

2. They don't scale well and are not ready for orchestration by popular DevOps tools (making themselves enemies for DevOps teams).

3. They overwhelm users with senseless notifications about thousands of attacks (that obviously has every website!) — without saying which of them are in fact dangerous and targeting security flaws of protected application.

4. Finally, none of them help to find vulnerabilities which are the real reason of data breaches.

So we ran different experiments by ourselves and step by step came to the idea of the product that we wanted to see on the market and recommend to our customers. We started working on it, released first MVP and instantly got positive feedback from all those security teams.

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#68

Post by hkr_mag »

elmigranto wrote: post #51
hkr_mag wrote: post #49

Earlier quoted context omitted.

Yeah! We would say the same if someone propose us to use this :) 1. We share the source code of Wallarm Node (nginx-based filter instance) with the companies after signing NDA. 2. Will run 3rd party audit of the code and share the report. 3. At some point, we'll open-source it. Ivan (wlrm) will come up with the examples of attacks soon.

What do you mean "come up"? You made a commercial product and don't have a single use case or user story to pitch?

Lot's of stories happening right away. Don't get the reason for the negativity. Though here is a recent story — critical XXE with remote file reading at LinkedIn (http://blog.wallarm.com/post/145883562288/critical-linkedin-...)

Re: Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

#70

Post by hkr_mag »

hkr_mag wrote: post #61
Bombthecat wrote: post #31

For that money you can get IBM datapower. Which is an all in one very powerful solution... With near wire speed transfer. I don't know why I should get that?

Frankly speaking, I don't know what is pricing for IBM Datapower. Is it really only $1k per month? I am pretty sure that it's a kind of good option for some enterprises. But most of our customer has high volume applications deployed in several datacenters, with CI/CD and DevOps approaches used. For them, hardware security boxes are almost impossible to use. What they are looking for is DevOps friendly tools that scal…

BTW, here is the link to Ivan's presentation about WAF evasion techniques — http://www.slideshare.net/d0znpp/lie-tomephd2013. Lots of them are still valid for old-fashioned security vendors
Post reply on HN