Re:Wiz walks away from $23B deal with Google
by chatmasta on Tuesday July 23, 2024 @12:45AM
(#41042566)
> clones EBS volumes and scans them on their infrastructure
Crowdstrike: “you just install a kernel module with ring zero access and we’ll make sure you’re protected”
Wiz: “hold my Red Bull…”
Re:Wiz walks away from $23B deal with Google
by golemiprague on Tuesday July 23, 2024 @04:29AM
(#41043896)
From the explanation here it sounds completely opposite concept, they download the server and check it rather than doing the checks on production environment
Re:Wiz walks away from $23B deal with Google
by chatmasta on Tuesday July 23, 2024 @10:01AM
(#41046127)
Yeah, I was thinking more about the risk of data leaks.
Re:Wiz walks away from $23B deal with Google
by pwdisswordfishd on Tuesday July 23, 2024 @02:24AM
(#41043078)
This sounds uselessly crippled, as it's not going to catch malware that doesn't drop anything to disk, or that adequately cleans up after itself if it does.
Re:Wiz walks away from $23B deal with Google
by nshelly on Tuesday July 23, 2024 @02:58AM
(#41043319)
I would assume they could also dump memory, i.e. `/dev/mem`. Agreed they would need to also do frequent memory snapshots, but lots of malware will also run in the background waiting indefinitely, and often as the same name as common Linux processes but different hashes.
Re:Wiz walks away from $23B deal with Google
by qeternity on Tuesday July 23, 2024 @03:59AM
(#41043711)
You would need an agent to do this. Cloning EBS won’t dump memory.
Re:Wiz walks away from $23B deal with Google
by stefan_ on Tuesday July 23, 2024 @04:35AM
(#41043937)
The people who have /dev/mem and run this garbage must form a complete overlapping circle.
Re:Wiz walks away from $23B deal with Google
by fullspectrumdev on Tuesday July 23, 2024 @05:58PM
(#41051395)
Even if it’s sitting in the background under a spoofed process name, it can be caught with memory dumps.
Memory dumps are obnoxiously useful for detecting stealthy malware, especially if you do the memory dumps from the hypervisor instead of from the VM itself.
The hard part is parsing :)
> Wiz combines a graph search for asset management with agentless vuln and malware scanning that clones EBS volumes and scans them on their infrastructure. That's a great combo for vuln management, but has some downsides like delays between scans and cloud costs. They have a sensor with solid detection rules, and are okay at a bunch of other stuff like cloud log threat detection and sensitive data detection. They've basically pushed what you can do without an agent to the limit.