The Jeremiah Grossman stuff with WAF and F5 surprised me. His latest post sounded like a big marketing and sales ad. See my post above.

Business is business but our industry never forgets……..so I will cop it also!

The good old bandwagon! Good post and pretty much in alignment with what I am seeing. The likes of an F5 are smart to get some known industry people backing them. Gives them some cred but are some selling out to get into bed with them?

Hello everyone, I thought I’d chime in since my name was dropped.

First of all WhiteHat Security knew there was going to be a certain level of healthy skepticism towards the VA+WAF concept and we had our work cut for us to prove the benefits. We also appreciated that WAF industry had a lot of baggage from years past, and rightly so, though none of which we were responsible for. What we don’t appreciate, given our reputation, that our solutions be labeled as BS or snake oil. This is NOT what we are, have been, or will be while I’m around.

Our views on VA+WAF had little to do with PCI and everything to do with customer demand. As I write this we are conducting well over 600 web application vulnerability assessments per week on many of the largest, most recognizable, and important online properties. I don’t say this to brag, but to provide context. At that scale hundreds, if not thousands, of vulnerabilities are identified during the same period – statistically they’ll go unfixed for months or more with IT Security unable to do much of anything except plead with developers.

With the PCI 6.6 deadline looming our customers clamored for answers. Some even went to great lengths to try and disrupt or “trick” our scanner in effort to generate a “clean” report – a far worse outcome. Plus with vulnerability counts I was looking at there didn’t seem to be a way for web security at large to improve (mitigate vulns) near-term without a device such as a WAF. Far too many sites, far too many vulnerabilities, and the bad guys already taking advantage. The latest round of mass SQL injection attacks adds further proof. Anyone really think we’re going to fix 1MM+ vulns line by line?

Not being fond at all of WAFs ourselves, we’d been around the block with them too as you can tell by Arian Evan’s recent mailing list posts, still we felt we needed to keep an open mind and give them a second or even third look. So 18 months ago we began meeting with every major WAF vendor asking them a simple question, “if you knew the vulnerabilities in a website ahead of time would it help your product?” Half said yes, the other half said no. We worked with the half that said yes, but since then the others have come back around.

For our initial VA+WAF prototypes we wanted something simple to get started and a place to improve upon. It would be far from perfect, nothing lofty, and certainly not comprehensive. We decided to tackle the two most pervasive and most exploited vulnerabilities, XSS and SQL Injection, which also happen to be the easiest issues to scan for and block with a WAF. We also decided against attempting a positive security model as being too error prone being built up by a scanner.

We opted for a strict meta-character blacklist focusing only on the web applications and parameters known to be vulnerable. Without semi-colons, parens, quotes, etc. SQL Injection could not be (easily) exploited and also would not block legit traffic because those characters would not be valid anyway on a location known to have issues. The same logic applied to XSS and more classes of attack to follow. Finally we vetted the concept with a number of our customers and analysts. We’d done our homework, the feedback overwhelmingly positive, so we built it.

Please don’t take this the wrong way, but we don’t build our solutions to please competing industry experts/vendors. We build solutions to help our customers overcome the problems they ask about. Sorry this comment turned out so long. With that background I’d be happy to personally walk anyone here through a live demo showing how it all works and would be happy to answer any questions about the technology. Blog anything you’d like about what you see, no NDA required. The exact same thing Mike Andrews and I did recently. Thanks for your time.

Hey DD, good to be here and now we’re getting somewhere. You bring up some excellent points.

You’re right, VA+WAF is mostly designed for those “coming from a relatively weak base.” However, I do not believe the “focus being further taken away from the core issues”, if by core issues you mean “software security.” There are two parties involved, development and IT Security, who also have different budgets. Developers should not have to concern themselves with WAFs, or paying for them, that’s IT Security’s responsibility. And IT Security typically only has indirect involvement with code, that’s of course for the development group to manage. One should not distract or take away from the other.

The point that perhaps the system is already compromised, which by itself is interesting because I think it’s the first time I’ve seen the possibility mentioned in this context. Right again that organizations are unlikely to perform forensics unless an “event” compels them to do so, regardless of the number of type of vulnerabilities present. WH, as a VA provider, has limited insider information and can’t reliably make such a recommendation. What we have done from time to time is upon identifying particular high severity easy to find vulnerability suggest the customer might want to perform forensics because we’re probably not the first to find it. Again, we have no idea when and if they do so.

I think we also both agree that VA+WAF virtual patches will be used as long-term solutions whether we like it or not. An organization might perceive this mitigation as “good enough” over the costs of a code fix – and IMHO this should be their right to choose. Nothing says an organization MUST remedy a particular issue at all ever anyway. The business could make the conscious choice to accept the risk. What’s hard to measure presently is how difficult a blacklist virtual patch as I’ve described is to defeat. I think in most cases it’d be pretty hard if implemented properly, but confidence will need to be built over time, such as is our discussion here.

Personally I view WAFs the same way as another other security solution including multi-factor authentication, system hardening, patching, security-with-obscurity, etc. Its important to know what they’re good at, not so good at, and their hard/software costs. Each should be selected as dictated by the needs of the business to sufficiently reduce risk. Risk of getting hacked. Risk of failing compliance, and so on. And as we know, risk is an extremely tough thing to measure in infosec. All too many people give up though and go with conventional wisdom in effort to CYA.

How often does the question of ‘indepence’ of opinion get raised here ?

Facts are, you’d have to seriously question the independence of any expert opinion that is potentially clouded by sponsorships, gratuities or any other form of reward. (ie, someone paid to tell me that WAF is a good thing.)

Now I fully respect the right of those people to make such paid comments (thats their job) but I’ll treat ‘em with the same respect I would a car salesman or real estate agent: Buyer beware.

BG.

@matthew

“Well that’s good and all, but it doesn’t work well in security. If you have 10 vulnerabilities that have the same capability then blocking 8 of them you’re raising the bar slightly, but really you’re not lowering the capability of any hackers that come across your site at all.”

This is true if you view WAFs in a vacuum. Let’s say you’ve adequately mitigated 8 of 10 issues with a WAF, IT Security can then recommend to the development group they prioritize the remaining 2 over the others, which be should/could be faster to deal with. We’re trying for incremental gains not silver bullets.

“So say you have ten XSS holes in your system. Nine use quotes but one doesn’t. Are you really more secure if you block just the nine that use quotes? ”

“secure” is a relative term, but again, if you’ve mitigated 9 you code fix the last one in the code. Its an easier/faster path to something comprehensive.

“Of course the major problem is there’s no context. Poor O’Conner can’t register to your site. The email site might not be able to have email addresses in angle brackets. The code site is totally stuffed.”

We’re suggesting extremely narrow rules on url parameters known to be vulnerable, see below for an example. I have little faith in global rules of any kind. Also, if the field that O’Conner was trying to login to was vulnerable to SQL Injection, I’d submit he in the vast majority of cases he wouldn’t able to login anyway because he would have caused the system to syntax error.

SQL Injection
SecRule ARGS:’/^(var)$/’ “([\'\"\(\)\;\-=`\*])” capture

XSS
SecRule ARGS:’/^(var)$/’ “([\'\"\(\)\;])” capture

“Meanwhile the WAF is doing nothing to prevent someone from changing the query variable from 31432 to 38432 and grabbing someone else’s credit card number. Such a simple flaw, yet it does nothing.”

Most of the time they don’t, that doesn’t mean they can’t though. I’ve been doing a lot of research in this area, even though we don’t have a WAF of our own, I think it can be done.

“How about we concentrate on implementing better solutions? Parameterise your SQL. Use whitelists for every field. Patch your software.”

They are and they should, however this is a developer activity. WAFs are an IT Security activity. The use of one should not preclude the use of the other.

matthew, really nothing stops an attacker from going after a WAF, just like any other network device practically speaking. Externally WAF are probably easier to bypass than to outright hack. The web-interfaces are internally facing and OS/TCP stack is *nix. All well understood and used tech.

An acceptable level of comfort with WAFs will only come over time, just like they did with network firewalls. More people need to bang on them, deploy them, and openly talk about them their experiences. Issues will and have come up with various vendors, which helps the products improve and people to become OK with the complexity/security trade-off you mentioned.

You ask me, its not their security that should be the most worrisome, its their stability.

Waffle, waffle, waffle…the stuff is crap! Lets not compare this to FWs and what they did years ago and justify their (WAFs) existence. We’ve moved on. WAFs are nowhere near at a level that anyone should consider the serious investment! It’s not just the cost of the h/w and s/w but maintenance, management and admin of the crappy systems - let alone the extra layer of comms slow down while these systems pretend to be smart. Added management adds to complexity and further decreases ability to focus on core f**king problems. Wake up!

The infosec industry should not be bowing down and accepting patchwork defences as ‘well, it’s better than nothing’! That just gives support to shit practice to begin with and goes against what we stand for. Ok …. we can catch x number of y type vulns…great! So can and more a serious VA program. Weigh up the dollars vs. the negative positive BS this provides a cio and we’re taking many steps backwards in what we do in our industry.