81–90 of 90 posts
But hey, I guess that solves all the complaints about secret black boxes.
Earlier quoted context omitted.
4. Another great example is detecting exploitation of Java Unserialize vulnerabilities ( https://foxglovesecurity.com/2015/11/06/what-do-weblogic-web... ). WebSphere takes payload in Base64 inside the XML. To parse everything (and do it fast), unfold the structure and detect the attacks is still almost impossible thing for most of the WAFs
A security company citing another security company blog to describe a vulnerability. I -- BTW, in order to use Wallarm one needs to pay upwards of $1000 pm. In order to pacify themselves that it works, one either need to write poor code that exhibits XEE or pay further to use WebSphere. Nice.
And, no one asked to pay anything until getting proper results while 30 days free pilot (it could be extended). Give it a try
Earlier quoted context omitted.
What do you mean "come up"? You made a commercial product and don't have a single use case or user story to pitch?
Lot's of stories happening right away. Don't get the reason for the negativity. Though here is a recent story — critical XXE with remote file reading at LinkedIn ( http://blog.wallarm.com/post/145883562288/critical-linkedin-... )
TLDR: proxy your traffic through a locally installed secret blackbox, after which it is "100% protected". Not found on the website: non-buzzwordy description of how this really works and what makes it better than the other gazillion security products. Show me an example of an attack you stopped. I realize the website isn't selling to engineers, but still.
Just a few examples of the attacks that other security products can't catch. 1. A very complicated things going through XML/JSON APIs. Wallarm really parse XML, understand the structure and catch even complicated exploitation attempt like this: -1 &a; &b; &c; &d; &e; &f; id=1 2. Every vector that exploits vulnerabilities over WebSockets. Some product doesn't support WebSocket at all. Some just proxy data without anal…
hXXp://defended-site/?test={%22attack%22:%22\u004a3Vu\u0061W\u0039uIHNlbGVjdCBwYXNzd2\u0039yZCBmcm\u0039tIHVzZXJzIGxpbWl0IDEtLWEt%22}
Let's explain payload processing in details: 1. URL-decode {"attack":"\u004a3Vu\u0061W\u0039uIHNlbGVjdCBwYXNzd2\u0039yZCBmcm\u0039tIHVzZXJzIGxpbWl0IDEtLWEt"}
2. JSON unicode chars decode: J3VuaW9uIHNlbGVjdCBwYXNzd29yZCBmcm9tIHVzZXJzIGxpbWl0IDEtLWEt
3. BASE64 decode: 'union select password from users limit 1--a-
Wallarm can process this w/o any manual tuning out of the box.
Earlier quoted context omitted.
Lot's of stories happening right away. Don't get the reason for the negativity. Though here is a recent story — critical XXE with remote file reading at LinkedIn ( http://blog.wallarm.com/post/145883562288/critical-linkedin-... )
This blog post has nothing to do with your product. Also, stopping a single request is very different from stopping an attack. A real attacker isn't going to stop the first time they get blocked, and if possible they'll probably end up evading your WAF.
Earlier quoted context omitted.
Yeah! We would say the same if someone propose us to use this :) 1. We share the source code of Wallarm Node (nginx-based filter instance) with the companies after signing NDA. 2. Will run 3rd party audit of the code and share the report. 3. At some point, we'll open-source it. Ivan (wlrm) will come up with the examples of attacks soon.
> We share the source code of Wallarm Node (nginx-based filter instance) with the companies after signing NDA. Is that because of the licensing terms of a certain underlying component that you use which forces you to share it?
Earlier quoted context omitted.
What do you mean "come up"? You made a commercial product and don't have a single use case or user story to pitch?
Why the negativity? I can think of a number of tech questions that no one but the deepest in the technical weeds on a team could provide actual answers to. Is deferring to someone else on a team to answer questions so bad?
Earlier quoted context omitted.
> We share the source code of Wallarm Node (nginx-based filter instance) with the companies after signing NDA. Is that because of the licensing terms of a certain underlying component that you use which forces you to share it?
It's because all the security guys (as we're) troll a lot and always skeptical (reasonably!) about blackboxes
Why not open-source it then? In that event tt wouldn't be termed a blackbox either.
For that money you can get IBM datapower. Which is an all in one very powerful solution... With near wire speed transfer. I don't know why I should get that?
Frankly speaking, I don't know what is pricing for IBM Datapower. Is it really only $1k per month? I am pretty sure that it's a kind of good option for some enterprises. But most of our customer has high volume applications deployed in several datacenters, with CI/CD and DevOps approaches used. For them, hardware security boxes are almost impossible to use. What they are looking for is DevOps friendly tools that scal…
About your points:
Devops is possible. You got like three interfaces you could utilize. Json, soap and something called afp, if you count shh, that's also possible to automate with. You can load balance it, fail over, active, active, passive active, self load balance etc. There is also a Citrix, vmware and docker version. You can load balance incoming and outgoing traffic. I don't know what else you want?
You get near wire speed format, signing, authing etc stuff on the datapower. You can also add a hardware cryptography card for even more speed.
Datapower won't protect you from passwords like admin, admin. This needs and should be done on application level. But if you feel frisky you can implement a rule check on your own. In JavaScript if you like.
Where datapower shines is with three a and validation with a check against known attack vectors.
Let's say you want to prevent overloading your api with nonsense. Including none valid string formats ie they shouldn't be longer than 69 signs. And the while json request shouldn't be bigger than 2kb. You can do side calling. Ie checking external databases for validity. Throttle and or stop requests.
The datapower is extreme powerful. In terms of flexibility, speed and security.
There is a reason why one of our customers has 60 of them.
Same features but open source [0]
[0] https://github.com/alexazhou/VeryNginx
Demo dashboard: http://alexazhou.xyz/vn/index.html#
User: verynginx
Password: verynginx