1 of 50

Slide Notes

DownloadGo Live

WHAT WE TALK ABOUT WHEN WE TALK ABOUT WEB SECURITY

Published on Feb 07, 2016

WHAT WE TALK ABOUT WHEN WE TALK ABOUT WEB SECURITY & RAILS

Simplify some of the major security issues affecting web applications today, with a strong focus on Rails specific issues.

@NYC.RB [2016/02]

by Dan Schanler hello@danschanler.com

View Outline

MORE DECKS TO EXPLORE

PRESENTATION OUTLINE

1.

WHAT WE TALK ABOUT WHEN WE TALK ABOUT
WEB SECURITY & RAILS

DAN SCHANLER
NYC.RB 2016-02-09

Photo by ericmcgregor
2.

GOALS

Photo by ericmcgregor
3.

DEFEND OUR APPS FROM HACKERS

4.

IS THAT MY JOB?
YES.

"DEVS ARE RESPONSIBLE FOR INSECURITY"

Photo by JonoMueller
5.

WHAT WE WON'T DISCUSS

  • AUTHENTICATION GEMS - DEVISE, OMNIAUTH, ETC
  • BASIC DATA SECURITY - HTTPS, PASSWORDS, ENCRYPTION
  • INFRASTRUCTURE SECURITY - FIREWALLS, LDAP, SSH KEYS
Photo by sboneham
6.

WHAT WE WILL DISCUSS

  • OWASP VULNERABILITIES
  • RAILS SPECIFIC EXAMPLES
  • GENERAL CONCEPTS TO SIMPLIFY DEV SECURITY KNOWLEDGE
Photo by Jeremy Brooks
7.

OPEN WEB APPLICATION SECURITY PROJECT

OWASP TOP TEN
Photo by Lurwah
8.

TAKE-AWAYS

FOR THE LAZY LIKE ME
Photo by Aris.Sanchez
9.

#1 SHAKE WELL BEFORE USER DATA

INJECTION FLAWS = BIG PROBLEMS
Photo by Dirty Bunny
10.

#1 shake well BEFORE USER DATA

  • SQL INJECTION
  • CROSS-SITE SCRIPTING XSS
Photo by 96dpi
11.

SQL INJECTION

OWASP #1 VULNERABILITY
Photo by mwin
12.

SQL INJECTION

CLICHE BUT I JUST LOVE IT: https://xkcd.com/327  
image source: https://xkcd.com/327
13.

Untitled Slide

14.

RAILS PARAMETERS HASH

AVAILABLE now IN YOUR CONTROLLERs
15.

SQL INJECTION ATTACK

16.

http://rails-sqli.org/

checkout more examples:
http://rails-sqli.org/
Photo by felixtsao
17.

CROSS-SITE SCRIPTING
XSS INJECTION
OWASP #3

Photo by kjetikor
18.

XSS - 3RD PARTY JAVASCRIPT RUNNING ON YOUR DOMAIN

Photo by Keith Allison
19.

Untitled Slide

20.

XSS ATTACKS:

  • STEAL USER COOKIES
  • SESSION HIJACKING
  • REDIRECT TO FAKE WEBSITE
  • CHANGE FORMS TO SNAG CONFIDENTIAL INFO
  • LOTS OF OTHER BAD THINGS
Photo by Connor Tarter
21.

XSS ATTACK EXAMPLES

If thIS runS in your form, attack IS possible
22.

Untitled Slide

23.

XSS PREVENTION

SANITIZE INPUT AND OUTPUT
24.

#2 WHITELISTS > BLACKLISTS

ENUMERATING BADNESS IS TOUGH
Photo by ChrisL_AK
25.

#2 whitelists > Blacklists

  • SECURITY headers
  • MASS ASSIGNMENT
Photo by Ionics
26.

SECURITY HTTP HEADERS

TO MAKE OUR WEB A LITTLE SAFER
Photo by Jaymis
27.

RESPONSE

28.

Untitled Slide

29.

DEFAULT HEADERS

& SEE TWITTER'S SECURE HEADERS
30.

MASS ASSIGNMENT

RAILS HELPER THAT LEADS TO PROBLEMS
Photo by GotCredit
31.

MASS ASSIGNMENT ATTACK

32.

MASS ASSIGNMENT

OWASP #2 Broken Auth & Sess. MGMT
Photo by roger_ipa
33.

MASS ASSIGNMENT MITIGATION

STRONG PARAMS
34.

#3 FOLLOW WEB/RAILS STANDARDS

"SECURE BY DEFauLT"
Photo by Photosightfaces
35.

#3 FOLLOW STANDARDS

  • CROSS-SITE REQUEST FORGERY: CSRF
Photo by backseatpilot
36.

CROSS-SITE REQUEST FORGERY

OWASP #8 CSRF
Photo by 1lenore
37.

CSRF: ATTACKER FORCES USER TO EXECUTE UNWANTED ACTIONS ON WEB APP THEY'RE AUTHENTICATED TO

Photo by aldoaldoz
38.

CSRF

39.

VICTIM HAS JUST:

  • TWEETED, FOLLOWED, LIKED
  • RESET THEIR EMAIL
  • RESET THEIR PASSWORD
  • ANY NUMBER OF OTHER BAD THINGS
Photo by kevin dooley
40.

CSRF MITIGATION

41.

#4 WATCH THE NEWS

RECENT VULNERABILITIES
Photo by Robert Bejil Productions
42.

DON'T LET THEM CREEP UP ON YOU

43.

Untitled Slide

44.

RECENT VULNERABILITIES:
GOOGLE GROUPS
rubyonrails-security

Photo by qousqous
45.

TAKE-AWAYS

  • SHAKE WELL BEFORE USER DATA
  • WHITELISTS > BLACKLISTS
  • FOLLOW WEB & RAILS STANDARDS
  • WATCH THE NEWS
Photo by JohannesLundberg
46.

GEM AUDITING

  • BUNDLER AUDIT
  • HAKIRI
  • GEMNASIUM
--GEM AUDITING--
bundler-audit: https://github.com/rubysec/bundler-audit
Hakiri: https://hakiri.io/facets Gemnasium: https://gemnasium.com/
47.

SCANNERS:

  • BRAKEMAN
  • DAWNSCANNER
  • W3AF
  • TARANTULA
--SCANNERS--
Brakeman Scanner: http://brakemanscanner.org/
Dawnscanner:
https://github.com/thesp0nge/dawnscanner
w3af: http://w3af.org/
Tarantula: https://github.com/relevance/tarantula
48.

ARTICLES:

  • ROR SECURITY GUIDE
  • OWASP ROR CHEATSHEET
  • RAILS-SQLI.ORG
  • PHRACK - ATTACKING ROR APPLICATIONS
--ARTICLES--
Ruby on Rails Security Guide: http://guides.rubyonrails.org/security.html
OWASP RoR Cheatsheet: https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet
Rails SQL Injection Examples: http://rails-sqli.org/
Phrack - Attacking Ruby on Rails Applications: http://www.phrack.org/papers/attacking_ruby_on_rails.html
49.

Untitled Slide

50.

THANKS ALL.


DAN SCHANLER
HIT ME WITH QUESTIONS:
HELLO@DANSCHANLER.COM

DAN SCHANLER
hello@danschanler.com

Dan Schanler