Rails Security in the Wild - Chicago Ruby

Slide 1

Slide 1 text

Rail in the Wild Chicago Ruby Edition Security Tuesday, December 4, 12

Slide 2

Slide 2 text

Chicago Ruby Edition Builde vs. Breake Security Tuesday, December 4, 12

Slide 3

Slide 3 text

Builde Breake Chicago Ruby Edition vs. Tuesday, December 4, 12

Slide 4

Slide 4 text

Matt Konda Builde Tuesday, December 4, 12

Slide 5

Slide 5 text

Jon Claudius Breaker Tuesday, December 4, 12

Slide 6

Slide 6 text

QUICK POLL Builder Breaker ~ OR ~ Tuesday, December 4, 12

Slide 7

Slide 7 text

Audience Member 1 Vote & Drink! Question & Debate Tuesday, December 4, 12

Slide 8

Slide 8 text

BUILDER’S CONCERNS Dates Features Functional Quality Tuesday, December 4, 12

Slide 9

Slide 9 text

BREAKER’S CONCERNS LOL’s! VULNS! Compromise! Tuesday, December 4, 12

Slide 10

Slide 10 text

Let’ get in the m d Tuesday, December 4, 12

Slide 11

Slide 11 text

“….developers will never learn, never improve because they are repeating the same mistakes over and over again” Breaker Tuesday, December 4, 12

Slide 12

Slide 12 text

“…only good at ranting. Zero contribs, and almost zero constructive feedbacks but bashing” Builde Response Tuesday, December 4, 12

Slide 13

Slide 13 text

QUICK POLL Who is familiar with OWASP? Tuesday, December 4, 12

Slide 14

Slide 14 text

“If you are a developer and don’t know who OWASP is at this point, it’s because you’ve chosen not to.” reaker Tuesday, December 4, 12

Slide 15

Slide 15 text

“Problem. Infosec pros, pentesters, etc. are more interested in #appsec than programmers. How to change that? < will not change” uilde Tuesday, December 4, 12

Slide 16

Slide 16 text

Tuesday, December 4, 12

Slide 17

Slide 17 text

SECURE MAKES ME THE CLOUD Tuesday, December 4, 12

Slide 18

Slide 18 text

Customers Don’t Ask For Security Tuesday, December 4, 12

Slide 19

Slide 19 text

SLOW POLL Who typically has: 1. Pen test 2. Static analysis 3. App Scan 4. Secure Code Review 5. Secure Development Training Tuesday, December 4, 12

Slide 20

Slide 20 text

BREACHES are CHEAPER than SECURE CODING Tuesday, December 4, 12

Slide 21

Slide 21 text

Agile Hurts Security Tuesday, December 4, 12

Slide 22

Slide 22 text

A PENTEST VALIDATES SECURITY Tuesday, December 4, 12

Slide 23

Slide 23 text

A PENTEST VALIDATES SECURITY Tuesday, December 4, 12

Slide 24

Slide 24 text

3rd Party Libraries are Secure Tuesday, December 4, 12

Slide 25

Slide 25 text

QUICK POLL How many people NEVER work with sensitive data? Tuesday, December 4, 12

Slide 26

Slide 26 text

Security Tuesday, December 4, 12

Slide 27

Slide 27 text

Jon Claudius Breaker @claudijd Tuesday, December 4, 12

Slide 28

Slide 28 text

Matt Konda Builde @mkonda Tuesday, December 4, 12

Slide 29

Slide 29 text

Hat tip: @todb (Todd Beardsley) Tuesday, December 4, 12

Slide 30

Slide 30 text

#25 SQL Injection Apr 30, 2007 Episode #204 – Mar 08, 2010 – 31 comments XSS Protection in Rails 3 #178 7 Security Tips Sep 07, 2009 Episode #26 – Mar 08, 2012 – 23 comments Hackers Love Mass Assignment (revised) Episode #27 – May 04, 2007 – 15 comments Cross Site Scripting Episode #26 – May 02, 2007 – 32 comments Hackers Love Mass Assignment Episode #20 – Apr 18, 2007 – 22 comments Restricting Access Episode #352 – May 23, 2012 – 15 comments Securing an API Episode #356 – Jun 08, 2012 – 23 comments Dangers of Session Hijacking Tuesday, December 4, 12

Slide 31

Slide 31 text

Session Tuesday, December 4, 12

Slide 32

Slide 32 text

Burp Demo http://localhost:3001/ Tuesday, December 4, 12

Slide 33

Slide 33 text

Other Problems •Cookie Store •Sensitive data in session •API Tuesday, December 4, 12

Slide 34

Slide 34 text

In ApplicationController: def restrict_access_by_token_to_worker() token = request.env["HTTP_AUTHORIZATION"] if token == nil authenticate_user! else key = ApiKey.find_by_token(token) if key != nil and key.worker == true return true else puts "Invalid token" return false end end end In command controller: before_filter :authenticate_user!, :except => [:show] In show method: worker = restrict_access_by_token_to_worker Tuesday, December 4, 12

Slide 35

Slide 35 text

Injection http://localhost:3012/ Tuesday, December 4, 12

Slide 36

Slide 36 text

Command Injection • Vulnerability Focused on Server • Attacker piggybacks on variable input that is passed down to a command line call. • Most easily demonstrated like so… http://example.com/page.php?id=123;ifconfig Tuesday, December 4, 12

Slide 37

Slide 37 text

Command Injection • Lis$ng a ﬁle or showing the IP conﬁgura$on can be used to demonstrate app vulnerability. Tuesday, December 4, 12

Slide 38

Slide 38 text

Command Injection • Demo • “Pop a shell” via command injec$on vulnerability in Rails App Tuesday, December 4, 12

Slide 39

Slide 39 text

Tuesday, December 4, 12

Slide 40

Slide 40 text

SQL Injection 1 @project = Project.find(params[:id]) 2 @projects = Project.find(:all, :conditions=>"id LIKE #{params[:id]}") 3 @project = Project.find(:all, :conditions=> ["id LIKE ?", "%#{params[:query]}%&"] ) http://localhost:3002/projects/-1%20or%20name%20= %20name Tuesday, December 4, 12

Slide 41

Slide 41 text

Forceful Browsing Tuesday, December 4, 12

Slide 42

Slide 42 text

Demo Tuesday, December 4, 12

Slide 43

Slide 43 text

Before and After def destroy @service_request = ServiceRequest.find(params[:id]) @service_request.destroy respond_to do |format| format.html { redirect_to service_requests_url } format.json { head :no_content } end end def show @service_request = ServiceRequest.find(params[:id]) respond_to do |format| format.html # show.html.erb format.json { render json: @service_request } end end Tuesday, December 4, 12

Slide 44

Slide 44 text

Magic def user_can_access_service_request(service_request) sr_key = service_request.api_key keys = get_api_keys keys.each do |key| if (key == sr_key) return true end end return false end Tuesday, December 4, 12

Slide 45

Slide 45 text

After def destroy @service_request = ServiceRequest.find(params[:id]) if (user_can_access_service_request(@service_request)) @service_request.destroy end respond_to do |format| format.html { redirect_to service_requests_url } format.json { head :no_content } end end def show @service_request = ServiceRequest.find(params[:id]) respond_to do |format| if (user_can_access_service_request(@service_request)) format.html # show.html.erb format.json { render json: @service_request } else @service_request = ServiceRequest.new @service_request.errors.add(:base, "You do not have access to this object.") flash[:error] = "Unable to access specified instance." format.html { render action: "new" } format.json { render json: @service_request.errors, status: :unprocessable_entit end end end Tuesday, December 4, 12

Slide 46

Slide 46 text

XSS http://localhost:3011/ Tuesday, December 4, 12

Slide 47

Slide 47 text

Cross-site Scripting (XSS) • Alert boxes are an easy proof of concept to demonstrate applica$on vulnerability. • Real attackers use JavaScript for evil Tuesday, December 4, 12

Slide 48

Slide 48 text

Cross-site Scripting (XSS) • Demo • Steal Facebook Credentials via Persistent XSS Vulnerability in Rails App Tuesday, December 4, 12

Slide 49

Slide 49 text

Cross-site Scripting (XSS) • Vulnerability Focused on Client Browsers • AHacker convinces user to click a link, Javascript is executed in target browser. • Most easily demonstrated like so… • hHp://example.com/page?id=alert(‘xss’)</ script> Tuesday, December 4, 12

Slide 50

Slide 50 text

Common Issues Tuesday, December 4, 12

Slide 51

Slide 51 text

Business Logic Tuesday, December 4, 12

Slide 52

Slide 52 text

Manager approves timesheet. Manager cannot approve own timesheet. Tuesday, December 4, 12

Slide 53

Slide 53 text

Tuesday, December 4, 12

Slide 54

Slide 54 text

Signed integer. -6 = 64.1 Trillion Tuesday, December 4, 12

Slide 55

Slide 55 text

Mass Assignment Tuesday, December 4, 12

Slide 56

Slide 56 text

Password Complexity Tuesday, December 4, 12

Slide 57

Slide 57 text

File Path Traversal Tuesday, December 4, 12

Slide 58

Slide 58 text

File Upload Tuesday, December 4, 12

Slide 59

Slide 59 text

Third Party Libraries Tuesday, December 4, 12

Slide 60

Slide 60 text

Use SSL Tuesday, December 4, 12

Slide 61

Slide 61 text

Anyone? Tuesday, December 4, 12

Slide 62

Slide 62 text

Top 10 • A1: Injection • A2: Cross-Site Scripting (XSS) • A3: Broken Authentication and Session Management • A4: Insecure Direct Object References • A5: Cross-Site Request Forgery (CSRF) • A6: Security Misconﬁguration • A7: Insecure Cryptographic Storage • A8: Failure to Restrict URL Access • A9: Insufﬁcient Transport Layer Protection • A10: Unvalidated Redirects and Forwards Tuesday, December 4, 12

Slide 63

Slide 63 text

Top 10 A1: Injection • A2: Cross-Site Scripting (XSS) • A3: Broken Authentication and Session Management • A4: Insecure Direct Object References • A5: Cross-Site Request Forgery (CSRF) • A6: Security Misconﬁguration • A7: Insecure Cryptographic Storage • A8: Failure to Restrict URL Access • A9: Insufﬁcient Transport Layer Protection • A10: Unvalidated Redirects and Forwards Tuesday, December 4, 12

Slide 64

Slide 64 text

Resources OWASP • Code Review Guide • Legal Language • Cheat Sheets • Top 10 • Tools (ZAP) Tools Attack Proxy (Burp, ZAP) Static Analysis (Brakeman) Web App Scan (Arachni) Code Review (Barkeep) https://github.com/claudijd/xss https://github.com/claudijd/command_injection Tuesday, December 4, 12

Slide 65

Slide 65 text

Now let’s talk: . We’ll buy for the first 5 people that find problems and verify with us. Tuesday, December 4, 12