Deep Dive: Thoughts on Juniper’s new product: Cloud Workload Protection

The blog article [0] announces, that Juniper’s Cloud Workload Protection can protect applications against the “OWASP Top 10” [1] web application security risks. Often a web application firewall (WAF) is used to help mitigate these risks. The datasheet [2] also mentions that it works with containerized applications and lists a set of programming languages and runtimes that are supported. To my surprise, the popular languages Python and GO are not on that list.

Another capability that this new product claims to offer really got my attention: prevention of memory-based attacks including the ones based on buffer overflows and ROP techniques. Long ago during my university time, I played a bit with simple buffer overflows and think I know how they work. A few years ago I also learned about the ROP technic. Todd Mortimer from the OpenBSD project hardened OpenBSD against this technic and explained his work in talks at BSD conferences [3]. He also wrote a paper about his work [4].

ROP stands for “return-oriented programming” [5]. Modern processors and operating systems with support for the “NX bit” [6] can prevent that an attacker executes code that she injected. The NX bit ensures that memory pages that are writeable can not be executed. To circumvent that attackers use code functions that are already present in memory. Then they chain these functions (called gadgets) together. Usually with the goal to give them a shell that allows controlling the system. To make this work an attacker needs to be able to change the call stack and manipulate the control flow of the program. Finding gadgets in memory is not hard since good tooling for that purpose is easily available. The defence method Todd Mortimer applied in OpenBSD reduces the number of gadgets substantially.

With this background, I was really curious to discover what method Juniper uses to stop ROP based attacks! But I was disappointed: I could not find technical documentation on Junipers website. It looks like the marketing team is much faster than the technical doc writers.

While searching further I found via an article on packetpushers.net [7]. The product is actually not from Juniper, but from their partner “K2 Cyber Security” [8]. Apparently, Juniper demonstrated the integration of vSRX with K2 solution in March 2021 [9]. I could not find any technical documentation on the K2 website either. However, K2 has some whitepapers, webinars and videos. For most of this material, they require you to register. But the short introduction videos are accessible without any obstacles.

I registered for the 30 day trial on the K2 website and got access after a few days and emails. I got an account on the web-based manager application from K2. There I also found install instructions. I opted for the “VM/Node” variant that requires Docker to run the agent in a container.