3 ms·

They’ve had some really nice writeups but I always thought they were your generic security firm doing some bug hunting. Recently I happened upon their domain su

They’ve had some really nice writeups but I always thought they were your generic security firm doing some bug hunting. Recently I happened upon their domain submissions to HN and saw they raised $1b+ and was like wtf? What do they actually do? I mean what are their products that people pay for? Maybe there are obvious answers to these questions, but if a company is worth $23bn I’d expect that as somebody in the industry, I could answer them without doing in depth research. This is exactly the kind of gut feeling of “something’s off” that I’ve learned to pay attention to.

walterbell 2y ago
https://old.reddit.com/r/cybersecurity/comments/1c1s9r2/wiz_is_insert_your_experience/ https://old.reddit.com/r/cybersecurity/comments/1c1s9r2/wiz_... > Wiz combines a graph search for asset management with agentless vuln and malware scanning that clones EBS volumes and scans them on their infrastructure. That's a great combo for vuln management, but has some downsides like delays between scans and cloud costs. They have a sensor with solid detection rules, and are okay at a bunch of other stuff like cloud log threat detection and sensitive data detection. They've basically pushed what you can do without an agent to the limit.
- chatmasta 2y ago
  > clones EBS volumes and scans them on their infrastructure Crowdstrike: “you just install a kernel module with ring zero access and we’ll make sure you’re protected” Wiz: “hold my Red Bull…”
  - golemiprague 2y ago
    From the explanation here it sounds completely opposite concept, they download the server and check it rather than doing the checks on production environment
    - chatmasta 2y ago
      Yeah, I was thinking more about the risk of data leaks.
- pwdisswordfishd 2y ago
  This sounds uselessly crippled, as it's not going to catch malware that doesn't drop anything to disk, or that adequately cleans up after itself if it does.
  - nshelly 2y ago
    I would assume they could also dump memory, i.e. `/dev/mem`. Agreed they would need to also do frequent memory snapshots, but lots of malware will also run in the background waiting indefinitely, and often as the same name as common Linux processes but different hashes.
    - qeternity 2y ago
      You would need an agent to do this. Cloning EBS won’t dump memory.
    - stefan_ 2y ago
      The people who have /dev/mem and run this garbage must form a complete overlapping circle.
    - fullspectrumdev 2y ago
      Even if it’s sitting in the background under a spoofed process name, it can be caught with memory dumps. Memory dumps are obnoxiously useful for detecting stealthy malware, especially if you do the memory dumps from the hypervisor instead of from the VM itself. The hard part is parsing :)

walterbell 2y ago

https://old.reddit.com/r/cybersecurity/comments/1c1s9r2/wiz_is_insert_your_experience/ https://old.reddit.com/r/cybersecurity/comments/1c1s9r2/wiz_... > Wiz combines a graph search for asset management with agentless vuln and malware scanning that clones EBS volumes and scans them on their infrastructure. That's a great combo for vuln management, but has some downsides like delays between scans and cloud costs. They have a sensor with solid detection rules, and are okay at a bunch of other stuff like cloud log threat detection and sensitive data detection. They've basically pushed what you can do without an agent to the limit.

chatmasta 2y ago
> clones EBS volumes and scans them on their infrastructure Crowdstrike: “you just install a kernel module with ring zero access and we’ll make sure you’re protected” Wiz: “hold my Red Bull…”
- golemiprague 2y ago
  From the explanation here it sounds completely opposite concept, they download the server and check it rather than doing the checks on production environment
  - chatmasta 2y ago
    Yeah, I was thinking more about the risk of data leaks.
pwdisswordfishd 2y ago
This sounds uselessly crippled, as it's not going to catch malware that doesn't drop anything to disk, or that adequately cleans up after itself if it does.
- nshelly 2y ago
  I would assume they could also dump memory, i.e. `/dev/mem`. Agreed they would need to also do frequent memory snapshots, but lots of malware will also run in the background waiting indefinitely, and often as the same name as common Linux processes but different hashes.
  - qeternity 2y ago
    You would need an agent to do this. Cloning EBS won’t dump memory.
  - stefan_ 2y ago
    The people who have /dev/mem and run this garbage must form a complete overlapping circle.
  - fullspectrumdev 2y ago
    Even if it’s sitting in the background under a spoofed process name, it can be caught with memory dumps. Memory dumps are obnoxiously useful for detecting stealthy malware, especially if you do the memory dumps from the hypervisor instead of from the VM itself. The hard part is parsing :)