Also, I’d read this mail if I were you: http://lists.immunitysec.com/pipermail/dailydave/2009-August/005837.html

Even if writing a fuzzer->exploit is out of the range of the attackers you want to prevent, 2k USD is well within the range of someone who wants to make some $$/fuck some shit up, especially given who runs that WAF.

That device is hardened a little, but nowhere near as hardened as it should have been.

Yup RE: 0day still being present. Nope RE: better off. Most of the enterprises out there have serious lag time between time to discovery and time to fix. Even sometimes for high risk vulnerabilities I see 40+ days before a patch is delivered. And by the way, there’s no guarantee the patch actually fixes the problem and doesn’t introduce a new one.

RE: attack surface. At layer 8 I think we can firmly conclude that the WAF has the ability to remove more attack surface than it adds, assuming competent operation.

For commercial products operating at layer 6/7, they probably do add some limited attack surface, assuming they’re all built with native code. I also (possibly wrongly) assume they’re running on SELinux/grsecurity/Vista w/ ASLR&DEP/(closest equivalent for their OS). The cost of exploit development in a platform like that is higher than most classes of attackers can afford technically or financially. But anyway, there’s for other companies to deal with, it’s not a problem I have. =)

The WAF is for development teams mature in the world of application security. It’s strictly intended for virtual patches. Whether its used appropriately I can’t control.

The bottom line, to me, is that I would want this as an application owner. It gives me short term solutions that I didn’t have before.

The reason virtual patches don’t worry me so much is because the worst case is the attack gets blocked; I don’t lose my 0day in your webapp, because, well, you already know about it. Egress filtering & general rules mean I can be worse off than if you didn’t have a WAF and had just patched the vuln. Also, if there’s a WAF between me and the target, I’d bet on me getting through.

Also, your “Is criticism stupid?”-ometer should probably meet a friend of mine called reliable heap overflow. Seriously.
Obviously this isn’t so much of a problem for ESAPI as it is for other products, but it doesn’t make the criticism stupid.

Where are the slides?

Best regards,

Erwin