Slashdot Mirror
Firewall Company Palo Alto Buys Stealthy Startup Formed By Ex-NSAers
alphadogg writes "Next-generation firewall maker Palo Alto Networks today announced its first acquisition, an intriguing buyout of a stealthy Mountain View start-up called Morta Security whose founders hail from the NSA. The price of the purchase was not disclosed. Morta that has been in stealth mode since 2012 and describes its founders as 'executives and engineers from the National Security Agency.' CEO Raj Shahsays he worked in the Air Force Reserve supporting the NSA. 'We have deep experience in protecting our national infrastructure,' he says. (Curious to see if more startups will start marketing their NSA heritage...)"
Hmmm, maybe I'll *not* buy their firewall...
If you want news from today, you have to come back tomorrow.
remote access for the NSA
> whose founders hail from the NSA
> CEO Raj Shahsays he worked in the Air Force Reserve supporting the NSA
They aren't really the same thing now are they?
When there is corruption you need to employ a former "insider" before your bids on contracts are even looked at.
Why do you think people like the person that lost the White House emails is employable by a data recovery company?
I beg your pardon? This coming from the fuckwits who insist on just about everything having unfixed holes and/or backdoors? Unless by "deep experience" they are referring to having their heads up their asses, I call BS.
What do you think would increase security more, in the long run - firewalls by the NSA, or firing squads for the NSA? Sad thing is, what starts out as a polemic rhetorical question is actually not that easy to answer, now is it.
That has any past connection, through staff or projects, with the NSA is now about as popular as cancer.
Well, that's better. Why bother pretending to be something other than a paid-off PR/click-bait site?
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
"Morta" in Italian means, "dead man".
Draw your own conclusions.
Forget Left and Right, Liberal or Conservative, Republican or Democrat. We are all enemies of the State now. It's starting to look like those divisions have just been artificially put in place in order to make us easier to control. When we're fighting each other, we're not paying attention to the real bad guys. And the bad guys goal is to take everything. If you're not part of the financial/political elite, you're not in the car, you're standing on the side of the road.
Nothing can really get better - not one thing - unless we deal with this security apparatus in a lasting way. It makes us less secure, poorer and sliding down the economic scale. And today, Janet Yellin was installed as the new bursar for this apparatus, in charge of siphoning wealth to the very few.
You are welcome on my lawn.
What a great way to save on $10 million dollar backdoor fees - have your ex-employees build the devices themselves!
Hagrin.com
Not fooled.
People who don't actually work in cybersecurity.
Surely the NSA have a number of means of bypassing the firewall by now ...
"Good evening Mr. Sir, I am being your Microsofts supporting person. My name is being Raj Shah and I am being afraid I must inform you that your Windows is being having a virus..."
What's the big deal? I mean, do you think Wernher von Braun's later work was bad just because his former boss wasn't the nicest guy in the world?
Circumcision is child abuse.
NSA live this one down? The people will not have it.
I'm not indignant, just amused.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
It's not our fault that just about anything coming from that general direction makes everybody else seem like a super intelligent saint. Your jealousy is duly noted.
I know I risk troll feeding, but another cretin who can't tell Indian from Arab names. There should be a space between Shah and says. The CEO's name would be Raj Shah
So now, instead of paying 10 mil to "security companies" and having all those nasty paper trails, the NSA just implants its ex-employees in those same "security companies" so that they can add backdoors by hand? That... is actually a pretty good idea, because it gives them a broader reach and is more cost effective.
you can build rockets for hitler, or you can build rockets for truman. they're both still rockets. you can test the rocket, make sure it works, you can separate the creator of the tech from the tech
but security is not like that. it's an ongoing trust relationship. you have to trust the people involved
and if your previous job was secretly sabotaging all security to a govt, this is probably not someone you want to trust your company's security to. when the NSA breaches your system, they have an ally already inside your system. if you didn't have a problem working for the NSA before, you probably still don't have any problems with their behavior, the defilement of our foundational rights
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I thought the primary reasoning behind firewall "appliances" was the reduced amount of non essential software they run, compared to your average server.
He tried to kill me with a forklift!
There's something that calls itself 'Princeton Alumni Weekly' that lists Raj Shah as a F-16 fighter pilot.
This seems to match his mini resume in AngelList:
CEO of Morta Security. Strong business (McKinsey, private equity) and government (@USAF F-16 pilot, DoD, NSA) background. @Wharton MBA, @Princeton undergrad.
English is not my first language. Corrections and suggestions are welcome.
So now you have the small amount of software running on the firewall, PLUS all the software running on the server (unless you advocate removing the server and having only the firewall?)... You've not decreased the amount of software you're running, you have increased it.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I think a review of the meaning of "attack surface" is due here. The idea here is to keep the bad guys out. If you can't physically secure your infrastructure (including some level of trust in your employees) you are guaranteed trouble. For that reason most networks are guaranteed trouble, but that aside a proper firewall does reduce the attack surface on the WAN by limiting traffic to what you want exiting and entering your network. Does a security guard also make a bank less secure because it increases the "robbery" surface?
Get a web developer
Not stealthy enough apparently. Rumor also has it that they are going to sell human sized fly-paper traps that way the ex-NSA-ers could stick it to the man.
An Air force pilot? really ? no history ? nothing anywhere on the web including the seclists /waves hand....charlatans everywhere
AC's allegation about Raj Shah being a charlatan really intrigued me, so I just wasted two hours doing a little digging... and I now suspect Raj Shah is lying about having been a USAF F-16 pilot. Here are a few different versions of Raj Shah's CV:
Khabar: Georgian Raj Shah Wins Soros Fellowship for New Americans (April 2007)
Raj Shah is among 31 finalists in the 10th annual competition for the Paul & Diasy Soros Fellowships for New Americans (immigrants and children of immigrants). They were selected from over 800 applicants representing 141 nationalities and 360 colleges and universities. Shah is currently the Special Assistant to the Deputy Undersecretary of Defense for International Technology Security in the US Department of Defense. He plans to attend Wharton in the fall to study business. Shah holds an AB from the Woodrow Wilson School at Princeton University. Upon graduating from Princeton, he took a job at McKinsey and Company but left 4 months after 9/11 to join the United States Air Force. Shah flew eighteen combat missions in Iraq as a captain and F-16 pilot. After four years of active duty, he transitioned to the reserves and rejoined McKinsey & Co.; from there he embarked on his present work.
Times of India: Business honcho bombed Iraq for US Air Force
He flew US Air force F-16 over Iraqi air space in 2006 and as recently as in March to May in 2010 for nearly 200 hours in 38 combat missions at a speed of Mac 2 (twice the speed of sound). Thirty-three-year-old Gujarati American Raj Shah, then a combat pilot, said, "The biggest fear in a pilot's mind is the fear of making a mistake. If we err, innocent people die." This Wharton School MBA, now vice-president of a defence focused investment firm, is a battle hardened soldier turned business executive.
"From 500 feet above the sea level to 50,000 feet, I flew as per the requirement. The altitude depended on the targets and in Iraq we flew very low for precision target hitting," said Raj, who joined the US Air Force in 2000 and took his first flight school in December, 2001.
He flew every third day on missions in Iraq and volunteered himself at Airport Theatre Hospital at Bagdad to help out the medical teams.
"In January 2006, it was 3 am in Bagdad when the US Air Force base sirens went off. I was sleeping in my flight suit. I ran to the jet and and in five minutes was flying 500 feet over Bagdad where a number of people were trying to block the path of US-Iraqi troops, who were on rescue mission," he said.
Those quotes about his missions are really strange.... and the the timeline in the 1st article (joined USAF 4 months after 9/1) contradicts the timeline in the 2nd (joined USAF in 2000). Also, in the first article (from 2007), he is described as having flow 18 combat missions, but in the next piece, posted four years later, he claims he flew 38 combat missions:
NetIP: Vote for Raj Shah (August 2011)
A reserve F-16 Pilot in the US Air Force, Raj is also is the Vice President of Federal Systems, a defense-focused investment firm. Now in its 6th year, Nanubhai impacts 8,000 students in rural India and has sent over 25 American teachers to India. In the USAF, Raj served two tours of duty in Iraq flying 38 combat missions. Raj has also worked as a Special Assistant in the Office of the Secretary of Defense. Previously Raj worked at McKinsey & Co. serving both private and public s
So you think each internal device should be responsible for its own access control on the network? You want the application server to implement layer 7 filtering? What about ASIC's? Are you adding custom silicon to your application servers so they can filter at high speeds? Are you going with a hardware loadbalancer? Your arguments don't make sense in the real world.
If your hosts are sensibly configured, then a firewall only serves to prevent external users from sending traffic to closed ports on your server... There isn't a huge risk involved with users being able to send traffic to closed ports.
If a port is open then it should be open for a reason, and you will configure your firewall to allow that service through anyway.
By adding a firewall you've increased your hardware costs, increased your hosting (rackspace, power) costs, increased your maintenance costs, decreased throughput, increased latency, added additional potential failure points... And for what?
Firewalls are often used by people who are too lazy or incompetent to configure their servers properly, so you have a grossly insecure webserver running telnet, smb, ftp etc where the firewall only permits access to http. A properly configured webserver would only allow http in the first place.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I know you are posting as Anonymous, so chances are you will not read this. I am just curious where you get this idea of dodgy network compatibility? I also have a hard time believing that in 20 years of administration, you don't see the good side of firewall appliances. I too am a BSD administrator, running countless pf, ipfw, ipfilter, iptables systems. Just because you like and/or use one thing doesn't mean it is the be all end all of the networking world. If you knew anything about these Palo Alto firewalls, you would know the benefits to using them over BSD. I have nothing against BSD firewalls, but you simply cannot compare the two. The PA firewall has customer silicon that processes layer7 data in real time. I have seen L7 filtering with pf and relayd, but come on now, it is not what pf was meant to do. I am sure you can add customer chips to a BSD box and get something similar, hell I wouldn't be surprised if the PA is based off some sort of the OS. I just don't see the point in dismissing what many would argue as 'state of the art' firewalls as being obsolete because you can do the same with open source. There is a reason why people choose VMWare licensing over running purely KVM/BHyve... By the time you factor in enough staff to get the open source platform working, paying workers comp, unemployment, and benefits...you might be better off licensing a turn-key product. I'm not in favor of one or the other, but rather use the right tool for the job.
And by customer I mean customer..doh I mean custom.
Hey look, this anonymous guy on the internet says that Palo Alto doesn't know what they are doing based on something he read on the internet. Can't argue that...
>If your hosts are sensibly configured, then a firewall only serves to prevent external users from sending traffic to closed ports on your server. I had a real LOL at this. What about virus protection? What about identifying an infected client and blocking communication with command and control servers? What about web browsing policy, and blocking L7 traffic on known good ports (Think SSH Tunnel on port 443)? While I completely understand your arguments when talking about Layer 3 firewalls, this is not what we are talking about. These Palo Alto firewalls have ASIC's that scan for virus definitions on dedicated hardware in real time. This is just one of their many features. While a firewall is no replacement for a properly configured server, acting like firewalls have no use is laughable.