The Who's
- Edward B. Fjellskål, security analyst
- Kacper Wysocki, security consultant
- Kristian Lyngstøl, Varnish (was security analyst)
- Eduardo Scarpellini, OWASP, Masters student @ ITA
The Idea
Varnish has
- sweet architecture
- really REALLY high loads
- flexible control and transparency
- can make things more secure too
LOLBUNNY
There are no silver bullets
Usually we use varnish to:
- scale a website
- hack around application issues
The Story
- DDoS mitigation..
- Project started in 2008
- XSS/hole mitigation
- Can we do better?
The Approach
- security rule framework in VCL
- PoC Breach rule translator
- expert rules for GET
- POST handling
Thwarting attacks
what we do today:
- common malicious access
- SQL injection
- Cross site scripting
- Cloaking
Security handlers
- reject, alert
- redirect
- g-line / offensive script
- honeypot
VFW - Varnish FireWall
- Eduardo Scarpellini's VFW master thesis
- Varnish 2 with inline C for POST
- Testing of effectiveness
- Web GUI
Future work
- POST access
- normalization
- merge VFW and Sec.vcl
