1 of 54

Slide Notes

DownloadGo Live

WHAT WE TALK ABOUT WHEN WE TALK ABOUT WEB SECURITY @RRC

Published on Feb 07, 2016

WHAT WE TALK ABOUT WHEN WE TALK ABOUT WEB SECURITY & RAILS

Simplify some of the major security issues affecting web applications today, with a strong focus on Rails vulnerabilities and the OWASP top ten.

@RUBY REMOTE CONF [2016/03]

by Dan Schanler hello@danschanler.com

View Outline

MORE DECKS TO EXPLORE

PRESENTATION OUTLINE

1.

WHAT WE TALK ABOUT WHEN WE TALK ABOUT
WEB SECURITY & RAILS

DAN SCHANLER
RUBY REMOTE CONF 2016-03-23

Photo by Stuck in Customs
2.

MEET DAN

@ jibe
Photo by _maara
3.

Untitled Slide

Photo by chrisinplymouth
4.

GOALS

Photo by zen!
5.

DEFEND OUR RAILS APPS

Photo by e³°°°
6.

TAKE-AWAYS

FOR THE LAZY LIKE ME
Photo by Aris.Sanchez
7.

OPEN WEB APPLICATION SECURITY PROJECT

OWASP TOP TEN
Photo by Zuzkins
8.

IS THAT MY JOB?
YES.

"DEVS ARE RESPONSIBLE FOR INSECURITY"

Photo by JonoMueller
9.

WHAT WE WON'T DISCUSS

  • AUTHENTICATION GEMS - DEVISE, OMNIAUTH, ETC
  • BASIC DATA SECURITY - HTTPS, PASSWORDS, ENCRYPTION
  • INFRASTRUCTURE SECURITY - FIREWALLS, LDAP, SSH KEYS
Photo by sboneham
10.

WHAT WE WILL DISCUSS

  • OWASP VULNERABILITIES
  • RAILS SPECIFIC EXAMPLES
  • GENERAL CONCEPTS TO SIMPLIFY DEV SECURITY KNOWLEDGE
Photo by Jeremy Brooks
11.

INJECTION FLAWS = BIG PROBLEMS

SHAKE WELL BEFORE USER DATA
Photo by Dirty Bunny
12.

shake well BEFORE USER DATA

  • SQL INJECTION
  • CROSS-SITE SCRIPTING XSS
Photo by 96dpi
13.

SQL INJECTION

OWASP #1 VULNERABILITY
Photo by mwin
14.

SQL INJECTION

CLICHE BUT I JUST LOVE IT: https://xkcd.com/327  
image source: https://xkcd.com/327
15.

Untitled Slide

16.

RAILS PARAMETERS HASH

AVAILABLE now IN YOUR CONTROLLERs
17.

SQL INJECTION ATTACK

18.

http://rails-sqli.org/

checkout more examples:
http://rails-sqli.org/
Photo by felixtsao
19.

CROSS-SITE SCRIPTING
XSS INJECTION
OWASP #3

Photo by kjetikor
20.

XSS - 3RD PARTY JAVASCRIPT RUNNING ON YOUR DOMAIN

Photo by Keith Allison
21.

Untitled Slide

22.

XSS ATTACKS:

  • STEAL USER COOKIES
  • SESSION HIJACKING
  • REDIRECT TO FAKE WEBSITE
  • CHANGE FORMS TO SNAG CONFIDENTIAL INFO
  • LOTS OF OTHER BAD THINGS
Photo by Connor Tarter
23.

XSS ATTACK EXAMPLES

If thIS runS in your form, attack IS possible
24.

Untitled Slide

25.

XSS PREVENTION

SANITIZE INPUT AND OUTPUT
26.

WHITELISTS > BLACKLISTS

ENUMERATING BADNESS IS TOUGH
Photo by ChrisL_AK
27.

whitelists > Blacklists

  • SECURITY headers
  • MASS ASSIGNMENT
Photo by Ionics
28.

SECURITY HTTP HEADERS

TO MAKE OUR WEB A LITTLE SAFER
Photo by Jaymis
29.

RESPONSE

30.

Untitled Slide

31.

DEFAULT HEADERS

& SEE TWITTER'S SECURE HEADERS
32.

MASS ASSIGNMENT

RAILS HELPER THAT LEADS TO PROBLEMS
Photo by GotCredit
33.

MASS ASSIGNMENT ATTACK

34.

MASS ASSIGNMENT

OWASP #2 Broken Auth & Sess. MGMT
Photo by roger_ipa
35.

MASS ASSIGNMENT MITIGATION

STRONG PARAMS
36.

FOLLOW WEB/RAILS STANDARDS

"SECURE BY DEFauLT"
Photo by Photosightfaces
37.

FOLLOW STANDARDS

  • CROSS-SITE REQUEST FORGERY: CSRF
Photo by backseatpilot
38.

CROSS-SITE REQUEST FORGERY

OWASP #8 CSRF
Photo by 1lenore
39.

CSRF: ATTACKER FORCES USER TO EXECUTE UNWANTED ACTIONS ON WEB APP THEY'RE AUTHENTICATED TO

Photo by aldoaldoz
40.

CSRF

41.

VICTIM HAS JUST:

  • TWEETED, FOLLOWED, LIKED
  • RESET THEIR EMAIL
  • RESET THEIR PASSWORD
  • ANY NUMBER OF OTHER BAD THINGS
Photo by kevin dooley
42.

CSRF MITIGATION

43.

WATCH THE NEWS

RECENT VULNERABILITIES
Photo by Robert Bejil Productions
44.

DON'T LET THEM CREEP UP ON YOU

45.

Untitled Slide

46.

RECENT VULNERABILITIES:
GOOGLE GROUPS
rubyonrails-security

Photo by qousqous
47.

TAKE-AWAYS

  • SHAKE WELL BEFORE USER DATA
  • WHITELISTS > BLACKLISTS
  • FOLLOW WEB & RAILS STANDARDS
  • WATCH THE NEWS
Photo by JohannesLundberg
48.

congrats

RAILS WEB SEC 101
Photo by .reid.
49.

LOW HANGING FRUIT

  • DO SOME AUDITING
  • SCAN CODE
  • SCAN APP
  • READ MORE ABOUT SPECIFICS
50.

GEM AUDITING

  • BUNDLER AUDIT
  • HAKIRI
  • GEMNASIUM
--GEM AUDITING--
bundler-audit: https://github.com/rubysec/bundler-audit
Hakiri: https://hakiri.io/facets Gemnasium: https://gemnasium.com/
51.

SCANNERS:

  • BRAKEMAN
  • DAWNSCANNER
  • W3AF
  • TARANTULA
--SCANNERS--
Brakeman Scanner: http://brakemanscanner.org/
Dawnscanner:
https://github.com/thesp0nge/dawnscanner
w3af: http://w3af.org/
Tarantula: https://github.com/relevance/tarantula
52.

ARTICLES:

  • ROR SECURITY GUIDE
  • OWASP ROR CHEATSHEET
  • RAILS-SQLI.ORG
  • PHRACK - ATTACKING ROR APPLICATIONS
--ARTICLES--
Ruby on Rails Security Guide: http://guides.rubyonrails.org/security.html
OWASP RoR Cheatsheet: https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet
Rails SQL Injection Examples: http://rails-sqli.org/
Phrack - Attacking Ruby on Rails Applications: http://www.phrack.org/papers/attacking_ruby_on_rails.html
53.

Untitled Slide

54.

THANKS ALL.


DAN SCHANLER
HIT ME WITH QUESTIONS:
HELLO@DANSCHANLER.COM

DAN SCHANLER
hello@danschanler.com

Dan Schanler