Stonesoft

» see stonesoft.com as it lived, on the wayback machine

~ the obituary ~

Helsinki, October 2010. A mid-sized Finnish security company announced that while testing its own equipment it had found a class of techniques that let an attacker carry a known exploit straight through an intrusion prevention system without the system noticing. Not one product. The category. Stonesoft called them advanced evasion techniques, sent samples to CERT-FI and to ICSA Labs, and then spent the next two years talking about them.

The company behind the announcement was twenty years old by then and had already been three different businesses. Ilkka Hiidenheimo founded it in 1990, while still an engineering student, after stints at Tekla and Oracle. From 1994 it made its money reselling and integrating other people's security products across Scandinavia, with Check Point and RSA on the partner list. Its own software came later and started as an accessory: StoneBeat, from 1995, did not firewall anything, it kept somebody else's firewall running by clustering it across machines so one could fail.

Stonesoft went public on the Helsinki exchange about a year before the top, taking subscriptions at EUR 6.50 in late March 1999 and starting trading that April. Four thousand investors applied, eighty percent of them over the internet, and the offer was oversubscribed about tenfold. The share reached EUR 29.45 in 2000 and the company closed that December worth EUR 880 million. In 2004 it traded at 51 cents.

~ the case file ~

~ multi-link ~

The firewall of its own arrived on 19 March 2001 and it was called StoneGate, a name the company had registered as a Finnish legal entity fifteen months before the product existed. The good idea in it was Multi-Link, patented in the United States in December 2003, which let a site hold two or three internet connections from different providers at once and shift traffic and VPN tunnels between them automatically. In 2001 that was a thing you built by hand with routing protocols and prayer. An intrusion prevention system followed in May 2004, after a development project the chief executive described in the annual report as challenging, which in a Finnish annual report is a scream.

None of this was consumer software, and it never came near me. I have never configured a StoneGate cluster and I have never worked anywhere that had one. The customers were telecoms operators and banks buying a box that sat at the edge of a building, bought by the kind of committee that writes a requirements document first.

~ the evasion paper ~

The technical core of the 2010 claim was combination rather than invention. IP fragmentation and TCP segmentation had been documented attacks on intrusion detection since the 1990s. What Stonesoft said was that stacking them in layers produced a signature no product matched, and that for a set of 31 such combinations the protection offered by the systems they tested was, in the words quoted at the time, close to zero. CERT-FI treated them as vulnerabilities and ICSA Labs said it had validated the research. In February 2011 the company reported 124 more.

Other vendors were unimpressed in a very specific way. Bob Walder, who founded NSS Labs, read the work, concluded it extended known techniques rather than discovering new ones, and called the announcement more about marketing than security while agreeing that the underlying problem was real. Stonesoft's own people eventually conceded the team had re-examined earlier evasion research and extended it. The commercial tell arrived in the summer of 2012, when the company launched something called an Evasion Prevention System. You can decide for yourself whether a firewall vendor announcing an industry-wide hole and then selling the patch for it is research or positioning.

~ the premium ~

McAfee launched a tender offer on 6 May 2013 at EUR 4.50 per share in cash, which was about 128 percent above the previous Friday's closing price and roughly 142 percent above the twelve-month average. The founder, the chairman and one director held about 34.7 percent between them and committed irrevocably on day one. Intel's quarterly filing later recorded net cash consideration of $381 million, substantially all of it allocated to goodwill and acquired technology, meaning there was not much here you could count.

The numbers underneath the premium are worth looking at. Revenue in 2012 was EUR 40.1 million and the operating result was a profit of EUR 451,000, a margin of about one percent, and that was the clearest profitable year in the whole StoneGate era. The tender closed at 95.26 percent on 25 June, title passed on 2 July, and the squeeze-out arbitration ran until 20 November 2013, when McAfee took title to every remaining share and the quotation ended on the same day. McAfee retired the product name with release 5.7 in April 2014: the release notes say the Security Engine "is now known as the 'McAfee Next Generation Firewall'," and apologize in advance that the old naming still appears inside the interface.

~ the update server ~

The business moved on again when Forcepoint took it over in January 2016, and Forcepoint dropped the word from the product page some time between 20 January and 13 February 2017. There is still a page at forcepoint.com/stonesoft and it was rebuilt last month; it says "Stonesoft Has Joined Forcepoint" and sells nothing. Stonesoft Oy itself was finally struck from the Finnish trade register on 12 November 2024, thirty-four years after it was founded and eleven after the shares stopped trading.

One machine never got the message. update.stonesoft.com still answers on port 443. The page it serves was last edited on 18 June 2013, while the McAfee tender was open, and it says there is no human readable content here but you can point an RSS reader at index.rss. That feed is 2.9 megabytes and 1,261 items long, titled Stonesoft IPS Software Updates, generated by Stonesoft, and the newest firewall signature package in it was published on 31 May 2021. The certificate on the host was issued on 5 March 2024, in the name of Stonesoft Corporation, by a certificate authority called Stonesoft Root CA, and it is valid until 30 June 2027. Somebody renewed it eight months before the company was legally erased.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »