Unsafe at Any Speed (PyCon UK, 26th October 2017)

The default settings of some libraries and tools are so useless, or even dangerous, that they should never be used. While they give the impression of being easy to use or performant, they actually represent traps for the unwary user. I look at some examples, consider the reasons why these bad defaults might have arisen, and offer some guidelines for setting up projects with good defaults.

Presented at PyCon UK 2017: http://2017.pyconuk.org/sessions/keynotes/unsafe-at-any-speed/

Links and resources:

CKAN: https://github.com/ckan/ckan/pull/2164

MongoDB security: https://blog.shodan.io/its-the-data-stupid/, https://www.mongodb.com/blog/post/update-how-to-avoid-a-malicious-attack-that-ransoms-your-data

Elasticsearch: http://bouk.co/blog/elasticsearch-rce/

PEP 476: http://legacy.python.org/dev/peps/pep-0476/

YAML
Tom Eastman's Serialization talk: http://s3.eastman.net.nz/serialization/, https://www.youtube.com/watch?v=kjZHjvrAS74
Update! PyYAML seems to be safe by default as of 26th August 2017: https://github.com/yaml/pyyaml/issues/5

MongoDB durability: https://docs.mongodb.com/manual/release-notes/2.6-compatibility/#write-method-acknowledgements

Li and Evans, Insecure by Default?: https://www.cs.virginia.edu/~evans/pubs/webframeworks2016/insecurebydefault.pdf

The Zen of Python: https://www.python.org/dev/peps/pep-0020/

Transcript

1. Unsafe at Any Speed Rae Knowler PyCon UK, 26th October 2017
2. Who I am @RaeKnowler Python (Django, CKAN) PHP, Go, JavaScript they/them/their https://www.flickr.com/photos/zurichtourism/5160475075
3. Intro
4. CAUGHT IN A BAD DEFAULT
5. @RaeKnowler #PyConUK https://nader.org/books/unsafe-any-speed/
6. @RaeKnowler #PyConUK https://commons.wikimedia.org/wiki/File:1962_Corvair_01.jpg
7. @RaeKnowler #PyConUK Unsafe at Any Speed, Ralph Nader
8. @RaeKnowler #PyConUK Unsafe at Any Speed, Ralph Nader
9. The right thing to do is non-obvious, and the obvious thing to do is bad
10. Defaults aren't bad, bad defaults are bad
11. @RaeKnowler #PyConUK What is a bad default? • Data loss • Security breaches • Becoming part of a botnet
12. Examples
14. @RaeKnowler #PyConUK CKAN "hack" https://github.com/ckan/ckan/pull/2164
15. @RaeKnowler #PyConUK 595.2 TB Data exposed on the Internet via publicly accessible MongoDB databases with no authentication (2015) https://blog.shodan.io/its-the-data-stupid/
16. @RaeKnowler #PyConUK https://www.mongodb.com/blog/post/update-how-to-avoid-a- malicious-attack-that-ransoms-your-data
17. @RaeKnowler #PyConUK MongoDB and insecure access • By default, DBs were open to remote connections, and authentication was not required • Lots of DBs were hacked, ransomed or just wiped • Localhost-only binding became default in packaged releases from 2.6.0 (April 2014) • Implemented in MongoDB server directly from 3.6 (upcoming) • But lots of people won't hear or bother to update their installations!
18. @RaeKnowler #PyConUK Other insecure access defaults • Hadoop • Redis • Elasticsearch (this one is weird!): http://bouk.co/blog/elasticsearch-rce/
19. "The 'S' in 'HTTPS' stands for secure." PEP 476
20. @RaeKnowler #PyConUK PEP 476 • stdlib http modules used not to verify X509 certificates for https connections • Result: API calls looked simple but were unexpectedly insecure • Many people used requests instead • This was changed in the stdlib based on PEP 476 (August 2014)
21. 'goodbye': !!python/object/apply:os.system ['rm *'] Tom Eastman, Serialization formats are not toys
22. @RaeKnowler #PyConUK Parsing YAML • PyYAML's default is to use load() • Use safe_load()
23. @RaeKnowler #PyConUK https://www.flickr.com/photos/sealegssnapshots/2672780121
24. @RaeKnowler #PyConUK MongoDB: durability • Write operations used to be 'fire and forget' by default • Needed to explicitly check for errors • Otherwise, data could be silently lost • Fixed in 2.6, at a performance cost
25. Setting up good defaults
26. @RaeKnowler #PyConUK Why bad defaults get set up • Developer knows the tool • Unconsidered use cases • Desire to make the tool seem easy • Desire to make the tool seem performant • Internal tools becoming external • Improved methods are added later
27. "We expect most of the insecure aspects of current web frameworks are not due to ignorance or carelessness on the parts of their designers, but difficult tradeoffs between security, functionality, usability, and ease of development" Li and Evans, Insecure by Default?
28. Explicit is better than implicit Errors should never pass silently The Zen of Python
29. @RaeKnowler #PyConUK Good defaults • Secure • Reliable (rather than performant) • Never swallow errors • Hard fail on serious errors • Demand explicit configuration if there's no safe default • If a bad default does happen, be brave enough to fix it
30. @RaeKnowler #PyConUK Thank you! PyCon UK David Stark Liip AG and...
31. @RaeKnowler #PyConUK Thanks to @BunkyFob, @DRMacIver, @_tomchristie, @alexwlchan, @glasnt, @infosecabaret, @janepipistrelle, @mgedmin, @moreati, @n0x13 and @ncoghlan_dev … in default sort order, of course!
32. @RaeKnowler #PyConUK
33. @RaeKnowler #PyConUK https://www.flickr.com/photos/havoc0311/5586595514
34. @RaeKnowler #PyConUK Jinja2: autoescaping • Autoescaping off by default in Jinja2 • Causes security hole for the unaware • Autoescaping is slow • Some use cases don't need it
35. "You should always configure autoescaping as defaults in the future might change." Jinja2 FAQ