5 ms·

Does it block `/etc//hosts` or `/etc/./hosts`? This is a ridiculous kind of whack-a-mole that's doomed to failure. The people who wrote these should realize tha

by Y_Y 2y ago

Does it block `/etc//hosts` or `/etc/./hosts`? This is a ridiculous kind of whack-a-mole that's doomed to failure. The people who wrote these should realize that hackers are smarter and more determined than they are and you should only rely on proven security, like not executing untrusted input.

mystifyingpoi 2y ago
No one expects any WAF to be a 100% solution that catches all exfiltration attempts ever, and it should not be treated this way. But having it is generally better than not having it.
- paxys 2y ago
  > But having it is generally better than not having it. So is HN and every other site in the world insecure because it allows users to post "/etc/hosts" ?
  - mystifyingpoi 2y ago
    Maybe? I don't know nor care. Assuming that HN has a vuln with path traversal, a sanely configured WAF would block the traversal attempt.
    - smallnix 2y ago
      *some traversal attempts
    - latexr 2y ago
      I propose someone who doesn’t know or care how a system works shouldn’t be prescribing what to do to make it secure. Otherwise this is like suggesting every gate must have a lock to be secure, even those which aren’t connected to any walls. https://i.imgur.com/ntYUQB1.jpeg https://i.imgur.com/ntYUQB1.jpeg
      - MatthiasPortzel 2y ago
        > someone who doesn’t know or care how a system works shouldn’t be prescribing what to do to make it secure The part that’s not said outloud is that a lot of “computer security” people aren’t concerned with understanding the system. If they were, they’d be engineers. They’re trying to secure it without understanding it.
        saagarjha 2y ago
        Good computer security people are engineers.
  - deleted 2y ago
    [deleted]
  - deleted 2y ago
    [deleted]
- smallnix 2y ago
  Dropping 0.5% of requests will prevent even the most sophisticated attacks (think APT!). Sometimes.
  - pyrale 2y ago
    Dropping 95% is even more secure, plus it lives the lucky few that get past it a sense of pride and exclusivity.
    - Y_Y 2y ago
      Is that like a "sense of pride and accomplishment"? https://knowyourmeme.com/memes/events/star-wars-battlefront-ii-unlockable-heroes-controversy https://knowyourmeme.com/memes/events/star-wars-battlefront-...
- simonw 2y ago
  "But having it is generally better than not having it." I believe the exact opposite. One (of many) reasons is that it can make your code less secure, by hiding your security mistakes from you. If your WAF obscures escaping issues during your own testing and usage you could very easily let those escaping issues go unresolved - leaving you vulnerable to any creative attacker who can outsmart your WAF.
  - RamRodification 2y ago
    If you are in charge of testing code for escaping issues, and you do that through a WAF, you might not be very good at your job.
- wyager 2y ago
  > But having it is generally better than not having it. Why? It obviously has an annoying cost and equally obviously won't stop any hacker with a lukewarm IQ
- rcxdude 2y ago
  Is it? The WAF is also now an attack surface itself, and I don't think WAFs have exactly proven themselves as something that meaningfully increases security. They certainly break things unpredictably, though.
- Macha 2y ago
  > But having it is generally better than not having it. The problem is that generally you're breaking actual valid use cases as the tradeoff to being another layer of defense against hypothetical vulnerabilities. Yes, discussing the hosts file is a valid use case. Yes putting angle brackets in the title of your message is valid use case your users are going to want. Yes putting "mismatched" single quotes inside double quotes is a thing users will do. Yes your users are going to use backslashes and omit spaces in a way that looks like attempts at escaping characters. (All real problems I've seen caused by overzealous security products)
- wavemode 2y ago
  No, that logic doesn't follow. If your application is so hopelessly vulnerable as to benefit from such naive filtering of the text "/etc/hosts, then your application is still going to be vulnerable in precisely the same ways, with just slightly modified inputs. It is net zero for security and net negative for user experience, so having it is worse than not having it.
  - serial_dev 2y ago
    Net zero for security might be generous. The way I assume it works in practice on a real team is that after some time, most of your team will have no idea how the WAF works and what it protects against, where and how it is configured… but they know it exists, so they will no longer pay attention to security because “we have a tool for that”, especially when they should have finished that feature a week ago…
jrockway 2y ago
Yeah, and this seems like a common Fortune 500 mandatory checkbox. Gotta have a Web Application Firewall! Doesn't matter what the rules are, as long as there are a few. Once I was told I needed one to prevent SQL injection attacks... against an application that didn't use an SQL database. If you push back you'll always get a lecture on "defense in depth", and then they really look at you like you're crazy when you suggest that it's more effective to get up, tap your desk once, and spin around in a circle three times every Thursday morning. I don't know... I do this every Thursday and I've never been hacked. Defense in depth, right? It can't hurt...
- bombcar 2y ago
  I love that having a web application firewall set to allow EVERYTHING passes the checkbox requirement ...
  - CoffeeOnWrite 2y ago
    (I’m in the anti-WAF camp) That does stand to improve your posture by giving you the ability to quickly apply duct tape to mitigate an active mild denial of service attack. It’s not utterly useless.
    - elevation 2y ago
      Doesn't it also add latency to every request?
      - tough 2y ago
        I think the main point is the WAF companies must have lobbied to get that into the checklist the main point is you need to pay a third party
        CoffeeOnWrite 2y ago
        You can call your existing reverse proxy a WAF to check this checklist item. (Your point still stands, on the median companies may opt to purchase a WAF for various reasons.)
eli 2y ago
Is a security solution worthless if it can't stop a dedicated attacker? A lot of WAF rules are blocking probes from off-the-shelf vulnerability scanners.
- da_chicken 2y ago
  "It's technically better than nothing," is kind of a bizarre metric. It's like not allowing the filesystem to use the word "virus" in a file name. Yes, it technically protects against some viruses, but it's really not very difficult to avoid while being a significant problem to a fair number of users with a legitimate use case. It's not that it's useless. It's that it's stupid.
  - eli 2y ago
    Do you lock your front door?
    - da_chicken 2y ago
      Do you brace yours with a bar?
      - eli 1y ago
        No, but even a steel bar would only slow down a determined thief...so I guess it's worthless?
- ndsipa_pomu 2y ago
  It's merely security theater. It reminds me of when airports started scanning people's shoes because an attacker had used a shoe bomb. Yes, that'll stop an attacker trying a shoe bomb again, but it disadvantages every traveller and attackers know to put explosives elsewhere.
  - geoffpado 2y ago
    “attacker had used a shoe bomb” It’s even dumber than that. An attacker tried and failed to use a shoe bomb, and yet his failure has caused untold hours of useless delay for over 13 years now.
nickdothutton 2y ago
See "enumerating badness" as a losing strategy. I knew this was a bad idea about 5 minutes after starting my first job in 1995.
augusto-moura 2y ago
How would that be hard? Getting the absolute path of a string is in almost all languages stdlibs[1]. You can just grep for any string containing slashes and try resolve them and voilá Resolving wildcards is trickier but definitely possible if you have a list of forbidden files [1]: https://nodejs.org/api/path.html#pathresolvepaths https://nodejs.org/api/path.html#pathresolvepaths Edit: changed link because C's realpath has a slightly different behavior
- _1tem 2y ago
  It’s not hard, but I think that’s more computation than a CDN should be doing on the edge. If your CDN layer is doing path resolution on all strings with slashes, that’s already some heavy lifting for a proxy layer.
- watusername 2y ago
  > How would that be hard? Getting the absolute path of a string is in almost all languages stdlibs[1]. You can just grep for any string containing slashes and try resolve them and voilá Be very, very careful about this, because if you aren't, this can actually result in platform-dependent behavior or actual filesystem access. They are bytes containing funny slashes and dots, so process them as such. Edit: s/text/bytes/
- TheDong 2y ago
  The reason it's doomed to failure is because WAFs operate before your application, and don't have any clue what the data is. Here is a WAF matching line: https://github.com/coreruleset/coreruleset/blob/943a6216edea83e4656f6f8b19311ec504f58a3e/rules/lfi-os-files.data#L331 https://github.com/coreruleset/coreruleset/blob/943a6216edea... Here's where that file is loaded: https://github.com/coreruleset/coreruleset/blob/943a6216edea83e4656f6f8b19311ec504f58a3e/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf#L99 https://github.com/coreruleset/coreruleset/blob/943a6216edea... It's loaded with '"@pmFromFile lfi-os-files.data"' which means "case-insensitive match of values from a file". So yeah, the reason it can't resolve paths properly is because WAFs are just regex and substring matching trying to paper over security issues in an application which can only be solved correctly at the application level.
tom1337 2y ago
Well I've just created an account on substack to test this but turns out they've already fixed the issue (or turned off their WAF completely)

by Y_Y 2y ago

mystifyingpoi 2y ago

No one expects any WAF to be a 100% solution that catches all exfiltration attempts ever, and it should not be treated this way. But having it is generally better than not having it.

paxys 2y ago
> But having it is generally better than not having it. So is HN and every other site in the world insecure because it allows users to post "/etc/hosts" ?
- mystifyingpoi 2y ago
  Maybe? I don't know nor care. Assuming that HN has a vuln with path traversal, a sanely configured WAF would block the traversal attempt.
  - smallnix 2y ago
    *some traversal attempts
  - latexr 2y ago
    I propose someone who doesn’t know or care how a system works shouldn’t be prescribing what to do to make it secure. Otherwise this is like suggesting every gate must have a lock to be secure, even those which aren’t connected to any walls. https://i.imgur.com/ntYUQB1.jpeg https://i.imgur.com/ntYUQB1.jpeg
    - MatthiasPortzel 2y ago
      > someone who doesn’t know or care how a system works shouldn’t be prescribing what to do to make it secure The part that’s not said outloud is that a lot of “computer security” people aren’t concerned with understanding the system. If they were, they’d be engineers. They’re trying to secure it without understanding it.
      - saagarjha 2y ago
        Good computer security people are engineers.
- deleted 2y ago
  [deleted]
- deleted 2y ago
  [deleted]
smallnix 2y ago
Dropping 0.5% of requests will prevent even the most sophisticated attacks (think APT!). Sometimes.
- pyrale 2y ago
  Dropping 95% is even more secure, plus it lives the lucky few that get past it a sense of pride and exclusivity.
  - Y_Y 2y ago
    Is that like a "sense of pride and accomplishment"? https://knowyourmeme.com/memes/events/star-wars-battlefront-ii-unlockable-heroes-controversy https://knowyourmeme.com/memes/events/star-wars-battlefront-...
simonw 2y ago
"But having it is generally better than not having it." I believe the exact opposite. One (of many) reasons is that it can make your code less secure, by hiding your security mistakes from you. If your WAF obscures escaping issues during your own testing and usage you could very easily let those escaping issues go unresolved - leaving you vulnerable to any creative attacker who can outsmart your WAF.
- RamRodification 2y ago
  If you are in charge of testing code for escaping issues, and you do that through a WAF, you might not be very good at your job.
wyager 2y ago
> But having it is generally better than not having it. Why? It obviously has an annoying cost and equally obviously won't stop any hacker with a lukewarm IQ
rcxdude 2y ago
Is it? The WAF is also now an attack surface itself, and I don't think WAFs have exactly proven themselves as something that meaningfully increases security. They certainly break things unpredictably, though.
Macha 2y ago
> But having it is generally better than not having it. The problem is that generally you're breaking actual valid use cases as the tradeoff to being another layer of defense against hypothetical vulnerabilities. Yes, discussing the hosts file is a valid use case. Yes putting angle brackets in the title of your message is valid use case your users are going to want. Yes putting "mismatched" single quotes inside double quotes is a thing users will do. Yes your users are going to use backslashes and omit spaces in a way that looks like attempts at escaping characters. (All real problems I've seen caused by overzealous security products)
wavemode 2y ago
No, that logic doesn't follow. If your application is so hopelessly vulnerable as to benefit from such naive filtering of the text "/etc/hosts, then your application is still going to be vulnerable in precisely the same ways, with just slightly modified inputs. It is net zero for security and net negative for user experience, so having it is worse than not having it.
- serial_dev 2y ago
  Net zero for security might be generous. The way I assume it works in practice on a real team is that after some time, most of your team will have no idea how the WAF works and what it protects against, where and how it is configured… but they know it exists, so they will no longer pay attention to security because “we have a tool for that”, especially when they should have finished that feature a week ago…

jrockway 2y ago

Yeah, and this seems like a common Fortune 500 mandatory checkbox. Gotta have a Web Application Firewall! Doesn't matter what the rules are, as long as there are a few. Once I was told I needed one to prevent SQL injection attacks... against an application that didn't use an SQL database. If you push back you'll always get a lecture on "defense in depth", and then they really look at you like you're crazy when you suggest that it's more effective to get up, tap your desk once, and spin around in a circle three times every Thursday morning. I don't know... I do this every Thursday and I've never been hacked. Defense in depth, right? It can't hurt...

bombcar 2y ago
I love that having a web application firewall set to allow EVERYTHING passes the checkbox requirement ...
- CoffeeOnWrite 2y ago
  (I’m in the anti-WAF camp) That does stand to improve your posture by giving you the ability to quickly apply duct tape to mitigate an active mild denial of service attack. It’s not utterly useless.
  - elevation 2y ago
    Doesn't it also add latency to every request?
    - tough 2y ago
      I think the main point is the WAF companies must have lobbied to get that into the checklist the main point is you need to pay a third party
      - CoffeeOnWrite 2y ago
        You can call your existing reverse proxy a WAF to check this checklist item. (Your point still stands, on the median companies may opt to purchase a WAF for various reasons.)

eli 2y ago

Is a security solution worthless if it can't stop a dedicated attacker? A lot of WAF rules are blocking probes from off-the-shelf vulnerability scanners.

da_chicken 2y ago
"It's technically better than nothing," is kind of a bizarre metric. It's like not allowing the filesystem to use the word "virus" in a file name. Yes, it technically protects against some viruses, but it's really not very difficult to avoid while being a significant problem to a fair number of users with a legitimate use case. It's not that it's useless. It's that it's stupid.
- eli 2y ago
  Do you lock your front door?
  - da_chicken 2y ago
    Do you brace yours with a bar?
    - eli 1y ago
      No, but even a steel bar would only slow down a determined thief...so I guess it's worthless?
ndsipa_pomu 2y ago
It's merely security theater. It reminds me of when airports started scanning people's shoes because an attacker had used a shoe bomb. Yes, that'll stop an attacker trying a shoe bomb again, but it disadvantages every traveller and attackers know to put explosives elsewhere.
- geoffpado 2y ago
  “attacker had used a shoe bomb” It’s even dumber than that. An attacker tried and failed to use a shoe bomb, and yet his failure has caused untold hours of useless delay for over 13 years now.

nickdothutton 2y ago

See "enumerating badness" as a losing strategy. I knew this was a bad idea about 5 minutes after starting my first job in 1995.

augusto-moura 2y ago

How would that be hard? Getting the absolute path of a string is in almost all languages stdlibs[1]. You can just grep for any string containing slashes and try resolve them and voilá Resolving wildcards is trickier but definitely possible if you have a list of forbidden files [1]: https://nodejs.org/api/path.html#pathresolvepaths https://nodejs.org/api/path.html#pathresolvepaths Edit: changed link because C's realpath has a slightly different behavior

_1tem 2y ago
It’s not hard, but I think that’s more computation than a CDN should be doing on the edge. If your CDN layer is doing path resolution on all strings with slashes, that’s already some heavy lifting for a proxy layer.
watusername 2y ago
> How would that be hard? Getting the absolute path of a string is in almost all languages stdlibs[1]. You can just grep for any string containing slashes and try resolve them and voilá Be very, very careful about this, because if you aren't, this can actually result in platform-dependent behavior or actual filesystem access. They are bytes containing funny slashes and dots, so process them as such. Edit: s/text/bytes/
TheDong 2y ago
The reason it's doomed to failure is because WAFs operate before your application, and don't have any clue what the data is. Here is a WAF matching line: https://github.com/coreruleset/coreruleset/blob/943a6216edea83e4656f6f8b19311ec504f58a3e/rules/lfi-os-files.data#L331 https://github.com/coreruleset/coreruleset/blob/943a6216edea... Here's where that file is loaded: https://github.com/coreruleset/coreruleset/blob/943a6216edea83e4656f6f8b19311ec504f58a3e/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf#L99 https://github.com/coreruleset/coreruleset/blob/943a6216edea... It's loaded with '"@pmFromFile lfi-os-files.data"' which means "case-insensitive match of values from a file". So yeah, the reason it can't resolve paths properly is because WAFs are just regex and substring matching trying to paper over security issues in an application which can only be solved correctly at the application level.

tom1337 2y ago

Well I've just created an account on substack to test this but turns out they've already fixed the issue (or turned off their WAF completely)