#wallarm

Entegre Uygulama ve API güvenlik platformu sunan San Francisco merkezli Wallarm’ın Türkiye temsilcisi e-data oldu. E-data tarafından yapılan açıklamada Şirketimiz merkezi San Francisco Kaliforniya’da bulunan , Entegre Uygulama ve API Güvenlik Platformu sunan, sunduğu API Saldırı Yüzeyi Yönetimi, API Sızıntı Yönetimi, Gelişmiş API Güvenlik Ürünü, API Keşfi gibi çözümlerle, çeşitli teknoloji…

New link to this post: https://lab.wallarm.com/rsa-2017-takeaways-576e4e2fc97#.3abd1lgks

Last week Wallarm attended RSA Conference in San Francisco. Wallarm booth was quite popular all three days of the show. We’ve got to network with over 300 of our current and future customers. We have presented both our next generation WAF product and our upcoming product for CI/CD application testing, Wallarm FAST.

Wallarm has detected hundreds of vulnerabilities just for the companies who signed up for a free trial of the Wallarm vulnerability scanner during the show.

The show was huge. Walking around both parts of the exhibit center (the show was in both North and South concourse of Moscone center) took several hours. We have seen a lot of friendly faces from the companies like #NGINX.

Interestingly, a whole day of the show was devoted to increasing security of DevOps with a specialized event called DevOps connect.

Even though we spent most of our time on the exhibit floor, catching up on the show presentations also provided some interesting insights:

Ransome-ware + IOT = some very scary situation. As exemplified by a recent case at San Francisco Trade Authority.

New link to this post: https://lab.wallarm.com/rick-orloff-joins-wallarm-advisory-board-d4cc8b3471a2#.n3a2u4z6i

We’re happy to announce Rick Orloff joining Wallarm advisory board. Rick will work closely with a team advising on product and roadmap.

Rick has successful 20-years long track record in security and is currently the Chief Security Officer at Code42. Prior to that he was a Vice President and Chief Information Security Officer at eBay and before that spent seven years at Apple Inc. He is a member of several Advisory Boards such as Raytheon Cyber Products, Oracle, Box Inc, FINDO, 802 Secure, and now Wallarm.

As is a tradition for the new members of the advisory board, we asked Rick a few questions about his vision of application security.

Application security has always been hard. How did it become even more complicated in the last few years?

Application security is always difficult and got further complicated as the software developers often developed their code while focusing on product features. Development teams were measured on delivering the feature sets to scope, schedule, and budget. The problem was, security was not one of the core design principles which meant security was addressed as a checkbox approach and not part of the primary workflow. Quite often, the security issues discovered were complicated to correct and placed the DevOps schedule at risk and this introduced friction between the security teams and the DevOps teams. From a customer persecutive, this often meant code was released with known issues and the developers were now racing to develop a 1.x.1 security patch.

Could you give your 3-5 take-aways for those enterprises adopting agile/CI/CD to run faster but not willing to sacrifice security?

Teams that follow agile practice with security experts embedded in their development processes developed code faster and more securely than teams that didn’t. In fact, as some of these teams embraced this model, they began including security elements as features. From a product management perspective, adopting an Agile approach means that when DevOps are walking into a Change Control Board meeting, security is already fully baked in and they don’t have to compromise customer security over their product delivery schedule.

What do you like best about Wallarm products/approaches?

New link to this post: https://lab.wallarm.com/meet-wallarm-at-rsa-2017-introducing-wallarm-fast-42df675bd91a#.in1wyiop2

Next week, come visit with Wallarm in San Francisco. We will be exhibiting at the RSA conference, at the north part of Moscone Center, booth #N4825.

Those of you who make it to the show will get a sneak peek of the new product we are working on - Wallarm FAST.

Wallarm FAST will help those working in CI/CD environment:

increase test coverage

deploy test automation as a service

focus DevSecOps on business logic

Wallarm FAST is designed to be a flexible test environment and provide Test Automation As A Service. Tests are run from the Wallarm Cloud service allowing DevOps full configuration control without having to worry about environment deployment, scale or flexibility.

Custom policies can be configured for composition, running and reporting on Test Jobs. Wallarm FAST generates tests using both known attack vectors such as OWASP top10 and fuzzing as well as payload patterns seen in production traffic.

Run policy configuration includes schedule of the test runs, scan load, source and frequency of the scans.

We support the following protocols (including nested protocol) for Deep Request Inspection:

HTTP/2.0

REST

JSON

COMET

XML

SOAP

Base64

GZIP

VIEWSTATE

PHP (unserialize)

Using Wallarm FAST, DevOps and DevSecOps teams can increase security test coverage 100X or more. Moreover, test results for every build are summarized and shown in a single-pane-of-glass dashboard. DevOps managers will now have all the test information at their fingertips.

Can’t get to San Francisco in time but would like to try Wallarm FAST for yourself? Get in touch with us for demo at [email protected]

New link to this post: https://lab.wallarm.com/wallarm-is-the-top-25-fastest-growing-y-combinator-summer-2016-startups-8096ab99584e#.ygxzc1s3r

Wow! Wallarm is one of the top 25 fastest growing Y Combinator (S16 batch) companies, according to the Mattermark research.

Mattermark ranked this batch of Y Combinator and found companies with the highest Mattermark Growth Score. Mattermark's Growth Score measures how quickly a company is gaining traction at a given point in time.

Mattermark was launched in 2012 as a data platform for VCs with hopes of becoming the go-to software for firms to use when quantifying signals of growing and potentially lucrative startups.

New link to this post: https://lab.wallarm.com/critical-linkedin-vulnerability-proactively-resolved-by-wallarm-xxe-in-application-server-239bba28e415#.lgprax5d5

With all the time and resources we allocate to finding application vulnerabilities it’s easy to forget that 3rd party libraries and software can introduce vulnerabilities into our applications as well. Hackers know this and they try to exploit them. In this blog post we will illustrate a vulnerability found within one of the LinkedIn services. The security issue was discovered in December 2015 and was fixed within 24 hours by the LinkedIn team.

What is XXE

OWASP says, An XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.

So XXE vulnerability is not truly a developer mistake but more of a misconfiguration of the XME parser.

If you are not familiar with XME External Entities, we suggest referring to XML RFC. It is also well worth your time to read a special OWASP page.

The impact of XXE vulnerabilities are severe. They allow the ability to read local files on remote servers, run queries into internal networks, and in some cases even execute code remotely.

XXE in an application server

An even more complicated situation is where a vulnerability is not introduced in your code, but in the web server or application server you use.

A good example here is an old vulnerability in SOAP server Apache CXF. Unsafe initialization was introduced in Apache CXF library, and the developer was unable to catch how the XML parser initialized. As a quick bug fix, Apache CXF maintainers propose developers to redefine the XML parser in a safe way by themselves. In the case it was possible — but what if you have such a vulnerability in the code of web server?

This is exactly the case with the critical LinkedIn service vulnerability discovered by Wallarm security researcher, Anton Lopanitsyn.

Vulnerability in LinkedIn

LinkedIn Marketing Solutions is a B2B product for the marketing purposes within a social network. After a simple check, it turned out that web server parses all of the XML documents passed within HTTPS requests. Parsing happens even before passing a control flow to the web application itself. So it was the functionality of the application server.

As a result, it was possible to send XML documenst to any web server URL which could result in the XXE vulnerability being exploited. This is an example of a request to the root page which allowed the reading of the local file /etc/motd

POST / HTTP/1.1 Content-type: blabla/xml Host: signin.lms.linkedin.com Content-Length: 204 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21 Wallarm-bot Accept: */* %asd; %rrr; ]> 123

The content of xxe.dtd:

'>%c;

In the XML file, a special OOB technique was used for reading the file content and transmitting it to the FTP server. You can get more details on this technique in this article.

Wallarm reported this vulnerability to the LinkedIn Security Team on December 12th and received an initial response within two minutes. The vulnerability was fixed within a 24-hour turnaround.

Protection against XXE

Obviously, organizations are not able to do a lot if a vulnerability occurs in 3rd party libraries or application server.

In this case, you need to use WAFs (Web Application Firewall) which analyze all the HTTP request and block those which malicious payloads.

However, there is one complication….a WAF needs to have full support for parsing XML documents to provide an actual protection against XXE vulnerabilities. It may seem that an organization just requires a few regular expressions to analyze requests. However, XML documents could be transmitted in a different encoding, e.g. in UTF-16, andattempts to mitigate via expressions will fail

Wallarm parses all the XML content to detect XXE attacks. Furthermore, Wallarm can discover XXE vulnerabilities with a built-in fuzzer. You can try it now for free at https://wallarm.com.

New link to this post: https://lab.wallarm.com/ah-ha-we-like-this-much-1fd1b5f11b6d#.yz6e9abqn

Ah-ha, we like this much. sqlmap, which is an incredibly popular tool that automates the process of detecting and exploiting SQL injection flaws, is now able to identify applications and API protected by Wallarm.

When WAF is detected, sqlmap even proposes to activate tamper scripts and try to bypass security checks. But as Wallarm doesn’t use regular expressions for attack detection and more relies on statistical profiles, it won’t help, sorry :)

This week (March 15-17) the first and foremost world-class technology conference in the hosting and cloud services industry, WHD.global, is taking place in Rust, Germany. The trade show, established 12 years ago, brings more than 6.000 leading experts and insiders together for high-value networking, informative discussions, and shared experiences. Exhibiting companies include Acronis (a Wallarm partner), Dell, HP, Lenovo, Odin, AMD, Samsung, and Microsoft.