Launch HN: Feroot (YC W21) – security scanner for front-end JavaScript code Hi HN! I'm Ivan, the co-founder of Feroot Security (YC W21) ( https://www.feroot.com/ ). Feroot Inspector is a security scanner for the client-side javascript code of web apps made for app sec teams. If you're not testing the security of the client-side code of your web app, there’s a good chance you could be exposed to Magecart skimmers, malware and spyware loaded with third-party scripts - css, pixels, tags, trackers, and more. We use synthetic users (i.e. bots—good ones!) to detect keyloggers, spyware, security misconfigurations, vulnerabilities, anomalies in the client-side code of web applications. Simulating activities that real users do, our scanner triggers all code activities first. And then it performs security testing and assessments of actual JavaScript code and everything else that is loaded into the browser when your users are using your web app. Pretty much what security scanners (like Qualys and Acunetix) are doing to test the application side code of web apps, but we do it for client-side code. So why did we build Feroot? First, nobody knows what actually happens on the client-side of web apps. Client-side code is a mystery and nobody knows when keyloggers are stealing users’ keystrokes or doing anything else sketchy. Second, existing web app security testing tools don’t perform data asset discovery. They don’t tell you what web forms exist throughout the user journeys and what information is ingested by the web app through each and every web form. All that is missing. Third, client-side code of web apps is highly variable and dynamic. As web developers are moving logic to the client-side a lot more externally controlled JavaScript code is included into users’ web browsers. Meaning, that every script, third-party and open source library can open a backdoor for hackers to exploit. We saw a need for a simple self-serve solution that brings security, developers, marketing and compliance teams together to help them secure the client-side of web apps. Feroot Inspector uses synthetic users and headless Chrome, which use algorithmic and heuristic approaches, to do activities that real users do -- type input into forms, submit forms to trigger potential keyloggers, skimmers, and all other client-side script activities. It also monitors all incoming and outgoing network traffic from the browser and uses data traps to terminate outbound network requests, to avoid any impact during the scan. Tech specs: 1) Support single-page/multiple-page web apps, and auto-discovery pm multi-page websites; 2) Resolves captchas, undetected by bot detection systems; 3) Tracks script changes, stores scripts content, detection of unauthorized scripts; 4) Audits page and frame security matrix, permission model for main frame of the page and all child-frames; 5) Detects data input and data ingestion points and report on data transfer, active data read (keystroke read), data access model; 6) Form-based authentication for scanning password-protected websites and custom scenario based authentication; 7) Detects data transfers from browser of user sessions to third-party hosts and domains; 8) Geo-decoding in real time of the destination country of data transfers; 8) Report export to: JSON (using API), CSV, Excel, and PDF; 9) Native Integrations: Slack, Jira, Datadog, PagerDuty, Splunk, JupiterOne, Sumo Logic, AWS Cloudwatch Events/logs, Opsgenie, ServiceNow, and webhooks; 10) Inspector performs non-intrusive, outside-in scanning of production live web apps. We would love to hear your feedback about Feroot scanner, as well as answer questions you might have! Thanks, Ivan & Vitaliy February 4, 2021 at 06:55PM
Women Pioneers at Muni: Adeline Svendsen and Muni’s First Newsletter By Jeremy Menzies To close out Women’s History Month, here’s a look back at one woman whose work to bring Muni staff together in the late 1940s created a legacy that lives on to this day. Adeline “Addy” Svendsen was founding editor of Muni’s first internal newsletter, “ Trolley Topics .” Adeline Svendsen sits at her desk in the Geneva Carhouse office building in this 1949 shot. Trolley Topics was a new venture when it started in February 1946. As Svendsen wrote in the first issue it was created, “to bring a little fun, a little news, and a lot of good will to all our fellow employees in the Railway.” Just two years prior in 1944, Muni merged with the Market Street Railway Company, expanding the small municipal operation into the largest transit provider in the city with hundreds of employees, vehicles of every shape and size, and dozens of facilities scattered across town. The newsletter was meant to help unite ...
Comments