Security: Back to Basics

SECURITY Back to Basics

EILEEN M. UCHITELLE ! eileencodes.com " @eileencodes # @eileencodes !
speakerdeck.com/eileencodes

Kingston, NY Pittsburgh, PA

Kingston, NY Pittsburgh, PA Canada Buffalo, NY

Security, Infrastructure & Performance Team at Basecamp

OPEN SOURCE Rails Committers Rails Security

How is security broken?

• Impossible to test for all possible vulnerabilities How is
security broken?

• Impossible to test for all possible vulnerabilities • Hackers
are always one step ahead How is security broken?

• Impossible to test for all possible vulnerabilities • Hackers
are always one step ahead • Patching one vulnerability can lead to exposing new ones How is security broken?

How did we get here?

• Failed to enforce web standards How did we get
here?

• Failed to enforce web standards • Failed to implement
a deﬁnition of security How did we get here?

“...completely failed to come up with even the most rudimentary
usable frameworks for understanding the security of modern software.” – Michal Zalewski, The Tangled Web

• Failed to enforce web standards • Failed to implement
a deﬁnition of security • Too few people understand the vulnerabilities How did we get here?

CSRF Cross-Site Request Forgery

EXPLOITING CSRF

ARYA The User

JESSIE The Hacker ARYA The User

<form class="edit_user" action="/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya" name="user[name]"
/> <label for="user_email">Email</label> <input type="text" value=“[email protected]” name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com“ name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form>

Looks the same, different URL

<body onload=“document.forms[0].submit()"> <form action="http://dogbook/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya"
name=“user[name]" /> <label for="user_email">Email</label> <input type="text" value=“[email protected]" name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> </body>

<form action="/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya" name=“user[name]" />
<label for="user_email">Email</label> <input type="text" value=“[email protected]” name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> Jessie’s email

<body onload=“document.forms[0].submit()"> <form action="http://dogbook.com/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya"
name="user[name]" /> <label for="user_email">Email</label> <input type="text" value=“[email protected]” name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> </body> Auto-submit form

<body onload=“document.forms[0].submit()"> <form action=“http://dogbook.com/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya"
name="user[name]" /> <label for="user_email">Email</label> <input type="text" value=“[email protected]” name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> </body> Auto-submit form to victim site

Jessie’s email

How dangerous are CSRF attacks?

How can we protect  our users from  CSRF attacks?

• Use built-in framework CSRF protection How to mitigate CSRF?

class ApplicationController < ActionController::Base protect_from_forgery with: :exception end

<form action="/users/2" method="post"> <input type="hidden" value="31RRdFdpulXYDxsOjyTRqKPiJxcP3+ayC==" name=authenticity_token" /> <label for="user_name">Name</label>
<input type="text" value="Eileen" name="user[name]" /> <label for="user_email">Email</label> <input type="text" value="[email protected]" name="user[email]" /> <label for="user_website">Website</label> <input type="text" value="eileencodes.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> CSRF protection

Caveat: CSRF protection in Rails is order-dependent

class ApplicationController < ActionController::Base before_action :authenticate protect_from_forgery with: :exception, if:
-> { authenticate_method.web? } end

-> { authenticate_method.web? } end Conditional authentication

-> { authenticate_method.web? } end class ChatsController < ApplicationController skip_before_action :authenticate before_action :authenticate_for_chat, only: :create end

-> { authenticate_method.web? } end class ChatsController < ApplicationController skip_before_action :authenticate before_action :authenticate_for_chat, only: :create end Skip auth callback

>> ChatsController._process_action_callbacks.map(&:filter) =>[ :authenticate, :verify_authenticity_token, :authenticate_for_chat ] Authentication callback is
too late in the chain

-> { authenticate_method.web? } end class ChatsController < ActionController::Base skip_before_action :authenticate before_action :authenticate_for_chat, only: :create protect_from_forgery with: :exception, if: -> { authenticate_method.web? } end

>> ChatsController._process_action_callbacks.map(&:filter) =>[ :authenticate, :authenticate_for_chat, :verify_authenticity_token ] Corrected callback order

• Use built-in framework CSRF protection • Refresh tokens with
the session / don’t reuse tokens How to mitigate CSRF?

class SessionsController < ApplicationController def destroy sign_out reset_session redirect_to sign_in_url
end end Refreshes Authenticity Token

• Use built-in framework CSRF protection • Refresh tokens with
the session / don’t reuse tokens • Mitigate XSS attacks How to mitigate CSRF?

XSS Cross-Site Scripting

EXPLOITING STORED XSS

Escaped HTML

<h1>Profile</h1> <p id="notice"><%= notice %></p> <p> <strong>Name:</strong> <%= @user.name %>
</p> <p> <strong>Email:</strong> <%= @user.email %> </p> <p> <strong>Website:</strong> <%= link_to('website', @user.website) %> </p> <%= link_to 'Edit', edit_user_path(@user) %> | <%= link_to 'Back', users_path %>

<h1>Profile</h1> <p id="notice"><%= notice %></p> <p> <strong>Name:</strong> <%= (@user.name).html_safe %>
</p> <p> <strong>Email:</strong> <%= @user.email %> </p> <p> <strong>Website:</strong> <%= link_to('website', @user.website) %> </p> <%= link_to 'Edit', edit_user_path(@user) %> | <%= link_to 'Back', users_path %> automatic protection. Let’s say for some reason you wanted to allow the user to dress up their name by adding html tags. To

JavaScript Scheme

javascript://example.com/%0Aalert(1)

example.com/%0Aalert(1) JavaScript Scheme javascript://

javascript://example.com/%0Aalert(1) URL example.com

Percent encoded “line feed” javascript://example.com/%0Aalert(1) %0A

JavaScript Alert javascript://example.com/%0Aalert(1) alert(1)

How dangerous are XSS attacks?

How can we protect  our users from  XSS attacks?

• Always escape user-provided data How to mitigate XSS?

<h1>Profile</h1> <p id="notice"><%= notice %></p> <p> <strong>Name:</strong> <%= (@user.name).html_safe %>
</p> <p> <strong>Email:</strong> <%= @user.email %> </p> <p> <strong>Website:</strong> <%= link_to('website', @user.website) %> </p> <%= link_to 'Edit', edit_user_path(@user) %> | <%= link_to 'Back', users_path %> Don’t do this

• Don’t HTML escape user-provided data • Sanitize user-provided data
How to mitigate XSS?

<h1>Profile</h1> <p id="notice"><%= notice %></p> <p> <strong>Name:</strong> <%= sanitize(@user.name) %>
</p> <p> <strong>Email:</strong> <%= @user.email %> </p> <p> <strong>Website:</strong> <%= link_to('website', @user.website) %> </p> <%= link_to 'Edit', edit_user_path(@user) %> | <%= link_to 'Back', users_path %> Will strip out unwanted tags and attributes

• Don’t HTML escape user-provided data • Sanitize user-provided data
• Validate user-provided data How to mitigate XSS?

class User < ActiveRecord::Base WHITELISTED_URI_SCHEMES = %w( http https )
validate :check_uri_scheme private def check_uri_scheme begin uri = URI.parse(website) unless WHITELISTED_URI_SCHEMES.include?(uri.scheme.downcase) errors.add :website, 'is not an allowed URI scheme' end rescue URI::InvalidURIError errors .add :website, 'is not a valid URI' end end end

XXE XML eXternal Entity Attack

<!DOCTYPE todolist [ <!ENTITY ext1 SYSTEM “list_items_6-7.xml”>
]> <list> <todo>Take a nap</todo> <todo>Go on a long walk with my hooman</todo> &ext1; <todo>Take another nap</todo> <todo>Go to bed</todo> </list>

<!DOCTYPE todolist [ <!ENTITY ext1 SYSTEM “list_items_3-4.xml”>
]> <list> <todo>Take a nap</todo> <todo>Go on a long walk with my hooman</todo> &ext1; <todo>Take another nap</todo> <todo>Go to bed</todo> </list> Entity reference

<todo>Eat breakfast</todo> <todo>Bark at the mail carrier</todo>

<list> <todo>Take a nap</todo> <todo>Go on
a long walk with my hooman</todo> <todo>Eat breakfast</todo> <todo>Bark at the mail carrier</todo> <todo>Take another nap</todo> <todo>Go to bed</todo> </list>

EXPLOITING XXE

class UsersController < ApplicationController def create @user = User.new(user_params) respond_to
do |format| if @user.save format.html { redirect_to @user } format.xml { render :xml => @user.to_xml } else format.html { render :new } format.xml { render xml: @user.errors.to_xml } end end end end

class UsersController < ApplicationController def create @user = User.new(user_params) respond_to
do |format| if @user.save format.html { redirect_to @user } format.xml { render :xml => @user.to_xml } else format.html { render :new } format.xml { render xml: @user.errors.to_xml } end end end end XML

<!DOCTYPE doc [ <!ENTITY name SYSTEM "file:///path/security_examples/ config/secrets.yml"> ]> <user>
<name>&name;</name> </user>

<name>&name;</name> </user> Requested ﬁle

<name>&name;</name> </user> Entity reference

curl -X 'POST' -H 'Content-Type: application/xml' -d @xxe.xml http://dogbook.com/users.xml POST
request to users create

curl -X 'POST' -H 'Content-Type: application/xml' -d @xxe.xml http://dogbook.com/users.xml Payload

curl -X 'POST' -H 'Content-Type: application/xml' -d @xxe.xml http://dogbook.com/users.xml <user>
<name> ... production: secret_key_base: 271a389cf7bf7b4ff18af3e809241603802b5ff1617b5432a41ff0f99d5 f29c897db7f07a9cebd9e3a3535301720c0b19ac4eb82afa505ed229c40 00e166a9a5 ... </name> </user> secrets.yml as user’s name

How dangerous are XXE attacks?

How can we protect  our servers from  XXE attacks?

• Don’t parse XML How to mitigate XXE?

Don’t parse XML

• Don’t parse XML • Don’t use parsers that allow
entity replacement (LibXML) How to mitigate XXE?

>> LibXML::XML.default_substitute_entities >> true

• Don’t parse XML • Don’t use parsers that allow
entity replacement (LibXML) • Whitelist known entities How to mitigate XXE?

Investigate vulnerabilities & patches SECURITY

GitHub  eileencodes/security_examples

owasp.org

Brakeman

Resilience & empowerment SECURITY

Awareness of vulnerabilities SECURITY

JESSIE The Hacker ARYA The User

To the future

Thank You! Come ﬁnd me for questions and Basecamp stickers

EILEEN M. UCHITELLE Security, Infrastructure & Performance Team at Basecamp
! eileencodes.com " @eileencodes # @eileencodes ! speakerdeck.com/eileencodes

Security: Back to Basics

Security: Back to Basics

More Decks by Eileen M. Uchitelle

Other Decks in Programming

Featured

Transcript