Somebody guessed my
password,
so I had to rename my
dog.
- @teknoteacher
Tuesday, July 28, 15
This is an intro talk.
If you think you might get
bored please check out:
[Link]
Rails Security Training app
Tuesday, July 28, 15
Intro to Rails Security
Nicholas Klick
Engineer, [Link]
Tuesday, July 28, 15
Why does security matter?
Tuesday, July 28, 15
Tuesday, July 28, 15
Tuesday, July 28, 15
Where do you start looking
for security vulnerabilities?
Tuesday, July 28, 15
Open Web Application Security Project
Tuesday, July 28, 15
OWASP Top 10
Injection
Sensitive Data Exposure
Auth and Sessions
Function level access control
Cross Site Scripting
Cross Site Request Forgery
Insecure Object References
Using Insecure Components
Security Misconfiguration
Redirection / Forwarding
Tuesday, July 28, 15
OWASP Top 10
Injection
Sensitive Data Exposure
Auth and Sessions
Function level access control
Cross Site Scripting
Cross Site Request Forgery
Insecure Object References
Using Insecure Components
Security Misconfiguration
Redirection / Forwarding
Tuesday, July 28, 15
Injection attacks
Injection flaws allow attackers to relay
malicious code through an application to
another system
These attacks include calls to the operating
system via system calls, the use of external
programs via shell commands, as well as
calls to backend databases via SQL
Tuesday, July 28, 15
SQL Injection
Attacker must find a parameter that the web
application passes through to a database
Carefully embedding malicious SQL
commands into the content of the
parameter, the attacker can trick the web
application into forwarding a malicious query
to the database
Tuesday, July 28, 15
SQL Injection
Tuesday, July 28, 15
SQL Injection Mitigation
Tuesday, July 28, 15
Command Injection
Execution of arbitrary commands on the host operating
system
Possible when an application passes unsafe user supplied
data to a system shell
Tuesday, July 28, 15
Command Injection
Tuesday, July 28, 15
Command Injection Mitigation
Tuesday, July 28, 15
Cross Site Scripting - XSS
Occurs whenever an application takes
untrusted data and sends it to a web
browser without validation and escaping.
XSS allows attackers to execute scripts in
the victims browser which can hijack user
sessions, deface web sites, or redirect the
user to malicious sites.
Tuesday, July 28, 15
Source: [Link]
Tuesday, July 28, 15
XSS examples
Tuesday, July 28, 15
Rails & XSS
Rails handles basic XSS threats.
When string data is shown in views, it is escaped by
ActiveSupport::SafeBuffer prior to being sent back to
the browser*
[Link]
Tuesday, July 28, 15
XSS Mitigation
Avoid using: raw, .html_safe etc for where
user input is displayed
Consider a markup language for rich text in
an application which will sanitize input
Use the #sanitize method that let's you
whitelist allowed tags
Tuesday, July 28, 15
Cross Site Request Forgery CSRF
Forces an end user to execute unwanted actions on
a web application in which they're currently
authenticated
Tuesday, July 28, 15
Cross Site Request Forgery - CSRF
1. User browses a message board and views a post from a hacker with HTML image
element. The element references a command in Bob's project management application,
rather than an image file.
2. User session at [Link] is still alive, because they didn't log out a few
minutes ago.
3. By viewing the post, the browser finds an image tag. It tries to load the suspected
image from [Link]. As explained before, it will also send along the cookie
with the valid session id.
4. The web application at [Link] verifies the user information in the
corresponding session hash and destroys the project with the ID 1. It then returns a
result page which is an unexpected result for the browser, so it will not display the
image.
5. User doesn't notice the attack - but a few days later they find out that project
number one is gone.
Tuesday, July 28, 15
Cross Site Request Forgery CSRF
User must be logged in
Malicious request sent server with users
valid credentials
Tuesday, July 28, 15
Cryptographically random token bound to the user's session.
Within each form a hidden input field, authenticity_token, is
injected; this field contains the token.
The token is sent with the form submission request and is
processed by the web application.
Tuesday, July 28, 15
Rails CSRF Mitigation
Upon processing the POST request, the server compares the value
submitted for the authenticity_token parameter to the value
associated with the users session.
If it doesnt match, this indicates that the request may be a
malicious request forged by an attacker and the request fails
Tuesday, July 28, 15
Insecure Direct Object
Reference
Allowing a User to access data they should not access
Insufficient authorization checks
Tuesday, July 28, 15
Insecure Direct Object
Reference
Tuesday, July 28, 15
Insecure Direct Object
Reference
By default, Ruby on Rails apps use a RESTful
uri structure.
That means that paths are often intuitive and
guessable.
To protect against a user trying to access or
modify data that belongs to another user, it is
important to specifically control actions.
Tuesday, July 28, 15
Insecure Direct Object
Reference Mitigation
Use a resource-based access control library
Ex: CanCan or Pundit
Ensure all operations on a database object
are authorized by the business logic of the
application
Tuesday, July 28, 15
There are often
overlooked areas
where security is a
concern
Tuesday, July 28, 15
Recommedation:
Beware of sensitive files
/config/[Link]
/config/initializers/secret_token.rb
/db/[Link]
/db/development.sqlite3
Add files you wish to hide to .gitignore file?
Tuesday, July 28, 15
Recommedation:
Use ENV variables
Tuesday, July 28, 15
Recommedation:
Audit your code
Tuesday, July 28, 15
Brakeman
Tuesday, July 28, 15
Gemfile auditing with
bundler-audit
Checks for vulnerable versions of gems in
[Link].
Checks for insecure gem sources ([Link]
Allows ignoring certain advisories that have
been manually worked around.
Prints advisory information.
Tuesday, July 28, 15
Recommedation:
Run a vulnerability scanner
Tuesday, July 28, 15
Recommedation:
Subscribe to Security Alerts
Ruby Security Announcements Google Group
Ruby on Rails Security Google Group
Tuesday, July 28, 15
More Resources
Tuesday, July 28, 15
Homework:
Learn about Rails Security
interactively
[Link]
Rails Security Training app
Tuesday, July 28, 15