Security, Secrets, and Shenanigans

Transcript

1. Security, Secrets, & Shenanigans Richard Schneeman @schneems
2. @schneems
3. Schnauser
5. I <3 Ruby
6. Hans Peter Von Wolfe (the 5th)
7. Sextant Gem
8. Wicked ‘ ‘ Gem
9. Triage Code codetriage.com
11. Adjunct Professor
12. Good News Everyone! schneems.com/ut-rails
13. I work for this one
14. AUS Ruby Conf
16. Hello wroclove
17. Close your Laptops
18. Unless you’re commenting on rails/rails issues
19. Web Security
20. What does it mean to be secure
21. I am not a security researcher
22. You don’t have to be either
23. Arm yourself with knowledge
24. Every system has a weakness
25. Security Bugs are Bugs
26. 420,000 lines 11 versions 17 errors
27. Bug free software is impossible
28. Cover Common Exploits
29. Talk about Mitigation Strategies
30. Improve our security processes
31. Availability
32. Security isn’t just keeping others out
33. Staying Available to Serve your customers
34. DDoS
35. Distributed Denial of Service
39. Block IP Addresses
40. Memory Exploits
41. :symbols aren’t fancy strings
42. :symbols are never garbage collected
43. params[:id].to_sym
44. params[:id].to_sym Don’t Do This
45. Parser Exploits
46. A billion Laughs
47. <?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <lolz>&lol9;</lolz>
48. 10 Entities
49. Each Reference Previous Entries
50. Consumes ~3GB of ram to process
51. Like a Zip Bomb for XML parsers
52. Ouch
53. modern XML parsers are not vulnerable to this attack Libxml2
54. Authentication the act of confirming the truth of an attribute of a datum or entity
55. e Armadillos
56. YAML Parser
57. YAML Ain’t Markup Language
58. development: adapter: postgresql encoding: utf8 database: my_development pool: 5 host: localhost config/database.yml
59. require 'yaml' db_config = YAML::load_file('config/database.yml') puts db_config["development"] # => { "adapter" => "postgresql", "encoding" => "utf8", "database" => "example_development", "pool" => 5, "host" => "localhost" }
60. YAML Ain’t just for basic objects
61. “--- !ruby/array:Array - jacket - sweater” YAML::load => ???
62. “--- !ruby/array:Array - jacket - sweater” YAML::load => [“jacket”, “sweater”]
63. “--- !ruby/hash:User email: richard@example.com” YAML::load => ???
64. “--- !ruby/hash:User email: richard@example.com” YAML::load => #<User id: 1, email: "richard@example.com">
65. “--- !ruby/hash:User email: richard@example.com” YAML::load user = User.new
66. “--- !ruby/hash:User email: richard@example.com” YAML::load user = User.new user[:email] = “richard@example.com
67. “--- !ruby/hash:User email: richard@example.com” YAML::load user = User.new user[:email] = “richard@example.com
68. “--- !ruby/hash:User email: richard@example.com” YAML::load user = User.new user[:email] = “richard@example.com puts user => #<User id: 1, email: "richard@example.com">
69. Interesting, but is it insecure?
70. class Foo def []=(name, value) puts value * 3 end end “--- !ruby/hash:Foo bar: hi” YAML::load foo = Foo.new
71. class Foo def []=(name, value) puts value * 3 end end “--- !ruby/hash:Foo bar: hi” YAML::load foo = Foo.new foo[:bar] = “hi” => “hihihi”
72. class Foo def []=(name, value) puts value * 3 end end “--- !ruby/hash:Foo bar: hi” YAML::load foo = Foo.new foo[:bar] = “hi” => “hihihi”
73. Let’s Get Dirty
74. class Foo def []=(name, value) eval(name) + value end end
75. class Foo def []=(name, value) eval(name) + value end end --- !ruby/hash:Foo “puts '=== hello there'.inspect;”: hi YAML::load
76. class Foo def []=(name, value) eval(name) + value end end --- !ruby/hash:Foo “puts '=== hello there'.inspect;”: hi YAML::load foo = Foo.new foo["puts '=== hello there'.inspect"] = 'hi' === hello there NoMethodError: undefined method `+' for nil:NilClass
77. class Foo def []=(name, value) eval(name) + value end end --- !ruby/hash:Foo “puts '=== hello there'.inspect;”: hi YAML::load foo = Foo.new foo["puts '=== hello there'.inspect"] = 'hi' === hello there NoMethodError: undefined method `+' for nil:NilClass
78. zOMG arbitrary code execution
79. But how does an attacker get us to execute arbitrary YAML?
80. XML Parser
81. <?xml version="1.0" encoding="UTF-8"?> <boom type="yaml"><![CDATA[--- !ruby/ object:UnsafeObject attribute1: value1 ]]></boom>
82. By default will parse arbitrary YAML
83. I’m in UR Servers Executing My Code
84. Java/ PHP/ C++/ etc. Secure?
85. Sanatize Your Inputs
86. And your Floors
87. Never Trust your users
88. Or your dogs
89. Ro Om Ba Attacks
90. RoOmBa Attacks
91. Responsible Disclosure
92. Create a /security report page
94. Intrusion Detection/ Logging
95. Papertrail
96. Stay Informed
97. Subscribe to Security Lists
98. Patch Early, Patch often
99. Secrets Secrets Secrets
100. CSRF
101. Cross Site Request Forgery
103. config.security_token
104. the key to your digital kingdom
105. Would you give your Car key copies to:
106. Interns? Your
107. Contractors? Your
108. Your Open Source Contributors?
109. If secrets are in your source, you’ve already given them your digital kingdom
110. Protect Your Code
111. Secure keys in source control aren’t secure
112. What’s an alternative?
113. Environment Variables
114. $ rake db:migrate RAILS_ENV=test
115. $ rake db:migrate RAILS_ENV=test
116. In Development
117. Use a .env file
118. $ cat .env SECRET_TOKEN=d59c2a439f
119. Use dotenv gem
120. $ irb > Dotenv.load > puts ENV[‘SECRET_TOKEN’] > “d59c2a439f”
121. Use foreman gem
122. $ foreman run irb > puts ENV[‘SECRET_TOKEN’] > “d59c2a439f”
123. In Production
124. $ heroku config:add SECRET_TOKEN=d59c2a439f
125. VPS • Use Foreman/Dotenv • Add to bashrc • Add values directly to command $ SECRET_TOKEN=asd123 rails console ruby-1.9.3> puts ENV[‘SECRET_TOKEN’] ruby-1.9.3> “asd123”
126. What if...
127. Someone Can read my ENV Variables?
128. Then they can read your files too
129. Is your app secure?
130. Is your app open source- able?
131. SECRET_TOKEN is just one example of Config
132. Define: Config
133. Config • What varies between deploys • resource strings to databases • credentials to S3, twitter, facebook, etc. • canonical values, hostname • security tokens
134. Can you deploy your app to change your S3 Bucket?
135. Do you NEED to deploy your app to change your S3 bucket?
136. Environment Variables! Use
137. Config
138. But I like storing my credentials in git!
139. What is Config? Just because it works...
140. Wishlist: rotate-able security tokens
141. Security
142. Nothing is ever 100% secure
143. Educate yourself
144. Secrets
145. Don’t store secrets in Git
146. Use ENV Variables
147. Shenanigans
149. Vote @hone02 (Terence Lee) Ruby Hero 2013
150. Questions? @schneems