triangle.rb - how secure is your rails site, anyway?

http://www.flickr.com/photos/mthierry/4595284293http://www.flickr.com/photos/111692634@N04

How Secure is Your Rails Site, Anyway?

Cory [email protected]@cory_foy

Tuesday, March 11, 14

http://www.flickr.com/photos/111692634@N04

http://www.flickr.com/photos/111692634@N04

mailto:[email protected]


http://www.flickr.com/photos/mthierry/4595284293

Security in a Web World

http://blogs.msdn.com/blogfiles/rds/WindowsLiveWriter/RDGatewaydeploymentinaperimeternetworkFi_CBD0/clip_image002_thumb.jpg

http://www.comtelindia.com/images/network_diagram_largepic.jpg








Heartland Payment Systems - 134 Million Credit Cards Exposed via a SQL Injection attack and spyware

TJX Companies - 94 Million Credit Cards Exposed via weak WiFi or In-Store Kiosk Security was compromised

LivingSocial - 50 Million records stolen including names, date of birth and salted password

Federal Reserve - 4,000 records of key bank executives containing personal information stolen via a vulnerability in

an internal website

Smuckers - Names, Addresses, Credit and Debit Card Numbers, Expiration Dates and Verification Codes stolen

from online store

Target - 40-70 million Credit Cards, PIN and CVVs stolenTuesday, March 11, 14


Cory [email protected]

@cory_foy

blog.coryfoy.com

prettykoolapps.com







OWASPOpen Web Application Security Project





2003

Unvalidated Parameters

Command Injection Flaws

Cross Site Scripting Flaws

Buffer Overflows

Error Handling Problems

Insecure Use of Cryptology

Broken Access Control

Web and Application Server MisconfigurationO

pen

Web

App

licat

ion

Secu

rity

Pro

ject





2013

Injection

Cross Site Scripting

Cross Site Request Forgery

Insecure Direct Object References

Unvalidated Redirects and Forwards

Sensitive Data Exposure

Missing Function Level Access Control

Broken Authentication and Session Management

Security Misconfiguration

Using Components with Known Vulnerabilities

2003

Unvalidated Parameters

Command Injection Flaws

Cross Site Scripting Flaws

Buffer Overflows

Error Handling Problems

Insecure Use of Cryptology

Broken Access Control

Web and Application Server MisconfigurationO

pen

Web

App

licat

ion

Secu

rity

Pro

ject





Rails Security



2013

Injection










Rails

Built in filter to escape SQL Characters

By default, Rails escapes HTML

REST / protect_from_forgery

Manual

Manual

Manual

Manual / Partials

secret_key_base / reset_session

Manual

Manual / Gems





Injection

http://xkcd.com/327/

http://localhost:3000/bad/injection?id=1






http://localhost:3000/bad/inject?id=1

http://localhost:3000/bad/inject?id=1



http://localhost:3000/bad/comments








http://localhost:3000/bad/upload_file








http://localhost:3000/bad/index








http://plaintextoffenders.com/

http://localhost:3000/bad/make_payment

http://ghost.teario.com/how-not-to-write-an-api/




http://plaintextoffenders.com

http://plaintextoffenders.com







https://github.com/CoryFoy/railssecurityexample







Standard Rails 684,805Lines of default

included Gem code





Real Examples

http://thunderboltlabs.com/blog/2013/12/04/giving-back-to-open-source-security-edition/









Responsible Disclosure





Sorcery Config.send

https://github.com/NoamB/sorcery/

Problem: Sorcery allows the configuration of multiple providers. It figured out the right one by calling

Config.send(provider_name.to_sym)

rails cObject.ancestorsKernel.methods(false).sort

Why’s that a problem?

Fix: Don’t trust user-modifiable input, everTuesday, March 11, 14






Doorkeeper Symbol GC

https://github.com/applicake/doorkeeper/

Problem: Doorkeeper and Sorcery converted user input to symbols. Symbols are not GC’d, so can use up

a lot of memory quickly


loop { (Time.now.to_f.to_s * 100000).to_sym }

Fix: Inspect User input as a string before converting to a symbol. Whitelist where possible







I18n Injection Issue

https://github.com/rails/railshttps://github.com/svenfuchs/i18n

Problem: Missing locales showed an error message which exposed a Cross-Site Scripting attack vector


http://mysite.com/?locale=”<script>alert(‘Hi Mom’)</script>”

Fix: Don’t trust user-modifiable input, ever




https://github.com/rails/rails

https://github.com/rails/rails

https://github.com/svenfuchs/i18n

https://github.com/svenfuchs/i18n

http://mysite.com/?locale=

http://mysite.com/?locale=


Summary

DON’TEVER

TRUSTUSER

INPUTTuesday, March 11, 14




Rails Security Resources





OWASPhttps://www.owasp.org/index.php/Main_Page




https://www.owasp.org/index.php/Main_Page

https://www.owasp.org/index.php/Main_Page


Rails Security Page and Mailing List

http://guides.rubyonrails.org/security.html

http://rubyonrails.org/security









OAuth RFC

http://tools.ietf.org/html/rfc6819







Books





Cory [email protected]

@cory_foy

blog.coryfoy.com

prettykoolapps.com






triangle.rb - how secure is your rails site, anyway?

Technology

injection http

forwards http

payment http

com327 http

cross site scripting

web world http

real examples http

sensitive data exposure