SlideShare ist ein Scribd-Unternehmen logo

Rails Security

•
•
David Keener
David Keener

So, you think your web application is reasonably secure? Well, based on the statistics, you're probably wrong. This talk examines real-world security problems in Rails applications, and shows how they can be mediated.

Technologie
1 von 24
Downloaden Sie, um offline zu lesen
Rails Security : It’s Not Just a Good Idea By David Keener
Introduction Why security matters Realistic goals Learning good practices …by looking at some bad practices Resources Some final thoughts
Who Am I? Long-time Ruby/Rails developer Founder/Organizer – RubyNation & DevIgnition conferences Last 3 projects… - Online Video Contest: With $10K-plus prizes… - Bank: Online charitable donations via credit card - Cyber Security: <cannot discuss details> “School of hard knocks” for security
Why Security Matters More personal data is moving online than ever before Social networks, retail sites, mobile devices, etc. The community of “bad actors” is growing and it’s international The Internet is everywhere If the data in your app has value, someone WILL try to get to it RSA is THE ultimate example There are serious legal ramifications to security breaches
Realistic Goals Security is a BIG topic Nobody can cover it all in one talk Goal 1: Illustrate how important security is Goal 2: Demonstrate some good practices (and a few bad mistakes) Goal 3: Point you to some awesome resources
“…out of 300 audited sites, 97% are vulnerable to attack” - From a Gartner Group survey
1. A Silly Vulnerability A newbie mistake… …here’s the exploit: curl –d ‘forum_id=1&message[subject]=foobar’ http://yoursite.com/forums
1. Mitigation Option 1: Include the before filter in proper controller Option 2: Create a NoAuth controller… - ApplicationController: before_filter :login_required - NoAuthController: skip_before_filter :login_required General Rule: “Default Deny” is your friend. Also: Be aware of code smells such as out-of-control before-filter stacks, filters with non-obvious side effects, etc.
2. Mass Assignment How many times have we seen this: Mass assignment is convenient…but it’s not safe.
2. Mitigation Mass assignment – only for fields with no security impact ALL models should use attr_accessible to specify fields that can be mass-assigned attr_accessible :first_name, :last_name, :email Other fields can be individually assigned if needed
3. Regexes What’s wrong with this code?
3. Mitigation The regular expression uses ^ and $ to match the start and end of the string In Ruby, this only matches a single line if multi-line input is provided Use A and z instead for input validation
4. File Uploads views/uploads/new.html.erb controllers/uploads.rb Uploads are prone to numerous potential security issues…
4. Problems The original file is left in the /tmp directory - Under a name like Rack*multipart*{random stuff} - Executable files could theoretically be executed by someone (BAD) The uploaded file is copied to $RAILS_ROOT/public/data - Under a name like Rack*multipart*{random stuff} - The file is web-accessible - Embedded JavaScript will have server access (BAD) - Could potentially see files uploaded by other users (PRIVACY) Uploaded files are never cleaned up File names can have collisions
4. Mitigations File in /tmp directory - Remove the file immediately after it has been copied File is copied to $RAILS_ROOT/public/data - Copy files to a non-web-accessible dir - Validate file types and eliminate undesirable files - Ensure that files are never left as executable Uploaded files never cleaned up - Delete files when no longer needed File names can have collisions - Add a unique ID as a filename prefix to prevent name collisions
5. Uploading XML Files What if I want to … upload and parse an XML File? It’s called an XML External Entity Expansion Attack…
5. Mitigation Options Option 1: Before parsing, regex for !DOCTYPE, !ELEMENT or !ENTITY and immediately reject the file - No need to be nice to the user Option 2: Disable entity expansions - Differs based on XML parser used
5. Mitigation - Nokogiri Parse settings - Validates the XML against the XSD - noent => No entity expansions - nonet => No network access - Does not actually do external entity expansions, but the infrastructure is there
5. Mitigation - REXML - Non-validating parser - entity_expansion_limit: raises exception if it finds any entity expansions - Not actually required to do entity expansions, but it seems to have some of the infrastructure
Some Best Practices Here are a few more best practices Always sanitize user-provided input Rolling your own authentication is an anti-pattern…think twice - Use Devise, restful_authentication, CanCan, etc. Use database-backed session storage “Default Deny” is your friend Use SSL for secure logins in production
Resources Rails Security Guide http://guides.rubyonrails.org/security.html OWASP Ruby on Rails Security Guide V2 https://www.owasp.org/index.php/Category:OWASP_Ruby_on_Ra ils_Security_Guide_V2 DHS Sensitive Systems Policy Directive 4300A http://www.uscg.mil/hq/cg9/NAIS/RFP/SectionJ/dhs-4300A- policy.pdf
Conclusion Security matters... Compromising PII or financial info will always be BAD It’s easier to build security in from the beginning than to retrofit it later Make good security practices second nature now…they will pay off later The security of your app must be TESTED RSpec, Cucumber and similar tools are essential
It’s smooth sailing If you build good security practices into your app…
Questions Feel free to contact me: dkeener@keenertech.com david.keener@gd-ais.com Twitter: dkeener2010 Blog: http://www.keenertech.com We’re also looking for some good Rubyists…

Empfohlen

Intro to Malware Analysis
Intro to Malware AnalysisIntro to Malware Analysis
Intro to Malware Analysis
wremes
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Study
securityxploded
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul Alvarez
EC-Council
 
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of MalwaresAdvanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
securityxploded
 
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
securityxploded
 
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
securityxploded
 
Pentesting with Metasploit
Pentesting with MetasploitPentesting with Metasploit
Pentesting with Metasploit
Prakashchand Suthar
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
xabean
 

Empfohlen

Intro to Malware Analysis
Intro to Malware AnalysisIntro to Malware Analysis
Intro to Malware Analysis
wremes
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Study
securityxploded
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul Alvarez
EC-Council
 
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of MalwaresAdvanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
securityxploded
 
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
securityxploded
 
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
securityxploded
 
Pentesting with Metasploit
Pentesting with MetasploitPentesting with Metasploit
Pentesting with Metasploit
Prakashchand Suthar
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
xabean
 
Reversing & malware analysis training part 1 lab setup guide
Reversing & malware analysis training part 1 lab setup guideReversing & malware analysis training part 1 lab setup guide
Reversing & malware analysis training part 1 lab setup guide
securityxploded
 
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
Advanced Malware Analysis Training Session 6 - Malware Sandbox AnalysisAdvanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
securityxploded
 
Dll preloading-attack
Dll preloading-attackDll preloading-attack
Dll preloading-attack
Cysinfo Cyber Security Community
 
Advanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing AutomationAdvanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing Automation
securityxploded
 
Primer on password security
Primer on password securityPrimer on password security
Primer on password security
securityxploded
 
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware AnalysisReversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
securityxploded
 
Reversing malware analysis training part10 exploit development basics
Reversing malware analysis training part10 exploit development basicsReversing malware analysis training part10 exploit development basics
Reversing malware analysis training part10 exploit development basics
Cysinfo Cyber Security Community
 
Reversing & Malware Analysis Training Part 13 - Future Roadmap
Reversing & Malware Analysis Training Part 13 - Future RoadmapReversing & Malware Analysis Training Part 13 - Future Roadmap
Reversing & Malware Analysis Training Part 13 - Future Roadmap
securityxploded
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memory
securityxploded
 
Bruteforce basic presentation_file - linx
Bruteforce basic presentation_file - linxBruteforce basic presentation_file - linx
Bruteforce basic presentation_file - linx
idsecconf
 
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory ForensicsAdvanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
securityxploded
 
Reversing & malware analysis training part 2 introduction to windows internals
Reversing & malware analysis training part 2 introduction to windows internalsReversing & malware analysis training part 2 introduction to windows internals
Reversing & malware analysis training part 2 introduction to windows internals
securityxploded
 
Advanced Malware Analysis Training Session 8 - Introduction to Android
Advanced Malware Analysis Training Session 8 - Introduction to AndroidAdvanced Malware Analysis Training Session 8 - Introduction to Android
Advanced Malware Analysis Training Session 8 - Introduction to Android
securityxploded
 
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
Advanced Malware Analysis Training Session 4 - Anti-Analysis TechniquesAdvanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
securityxploded
 
Anatomy of Exploit Kits
Anatomy of Exploit KitsAnatomy of Exploit Kits
Anatomy of Exploit Kits
securityxploded
 
Reversing malware analysis training part6 practical reversing
Reversing malware analysis training part6 practical reversingReversing malware analysis training part6 practical reversing
Reversing malware analysis training part6 practical reversing
Cysinfo Cyber Security Community
 
So. many. vulnerabilities. Why are containers such a mess and what to do abou...
So. many. vulnerabilities. Why are containers such a mess and what to do abou...So. many. vulnerabilities. Why are containers such a mess and what to do abou...
So. many. vulnerabilities. Why are containers such a mess and what to do abou...
Eric Smalling
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
Prakashchand Suthar
 
Docker and-daily-devops
Docker and-daily-devopsDocker and-daily-devops
Docker and-daily-devops
Satria Ady Pradana
 
Bh us 11_tsai_pan_weapons_targeted_attack_wp
Bh us 11_tsai_pan_weapons_targeted_attack_wpBh us 11_tsai_pan_weapons_targeted_attack_wp
Bh us 11_tsai_pan_weapons_targeted_attack_wp
geeksec80
 
Bhajan Poorn Hogi Aas
Bhajan Poorn Hogi AasBhajan Poorn Hogi Aas
Bhajan Poorn Hogi Aas
Mool Chand
 
Beautiful British Landscape Photographs
Beautiful British Landscape PhotographsBeautiful British Landscape Photographs
Beautiful British Landscape Photographs
CQ Marketing Academy
 

Weitere ähnliche Inhalte

Was ist angesagt?

Bruteforce basic presentation_file - linx
Bruteforce basic presentation_file - linxBruteforce basic presentation_file - linx
Bruteforce basic presentation_file - linx
idsecconf
 
So. many. vulnerabilities. Why are containers such a mess and what to do abou...
So. many. vulnerabilities. Why are containers such a mess and what to do abou...So. many. vulnerabilities. Why are containers such a mess and what to do abou...
So. many. vulnerabilities. Why are containers such a mess and what to do abou...
Eric Smalling
 
Bh us 11_tsai_pan_weapons_targeted_attack_wp
Bh us 11_tsai_pan_weapons_targeted_attack_wpBh us 11_tsai_pan_weapons_targeted_attack_wp
Bh us 11_tsai_pan_weapons_targeted_attack_wp
geeksec80
 

Was ist angesagt? (20)

Reversing & malware analysis training part 1 lab setup guide
Reversing & malware analysis training part 1 lab setup guideReversing & malware analysis training part 1 lab setup guide
Reversing & malware analysis training part 1 lab setup guide
 
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
Advanced Malware Analysis Training Session 6 - Malware Sandbox AnalysisAdvanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
 
Dll preloading-attack
Dll preloading-attackDll preloading-attack
Dll preloading-attack
 
Advanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing AutomationAdvanced Malware Analysis Training Session 5 - Reversing Automation
Advanced Malware Analysis Training Session 5 - Reversing Automation
 
Primer on password security
Primer on password securityPrimer on password security
Primer on password security
 
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware AnalysisReversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
 
Reversing malware analysis training part10 exploit development basics
Reversing malware analysis training part10 exploit development basicsReversing malware analysis training part10 exploit development basics
Reversing malware analysis training part10 exploit development basics
 
Reversing & Malware Analysis Training Part 13 - Future Roadmap
Reversing & Malware Analysis Training Part 13 - Future RoadmapReversing & Malware Analysis Training Part 13 - Future Roadmap
Reversing & Malware Analysis Training Part 13 - Future Roadmap
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memory
 
Bruteforce basic presentation_file - linx
Bruteforce basic presentation_file - linxBruteforce basic presentation_file - linx
Bruteforce basic presentation_file - linx
 
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory ForensicsAdvanced Malware Analysis Training Session 7 - Malware Memory Forensics
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
 
Reversing & malware analysis training part 2 introduction to windows internals
Reversing & malware analysis training part 2 introduction to windows internalsReversing & malware analysis training part 2 introduction to windows internals
Reversing & malware analysis training part 2 introduction to windows internals
 
Advanced Malware Analysis Training Session 8 - Introduction to Android
Advanced Malware Analysis Training Session 8 - Introduction to AndroidAdvanced Malware Analysis Training Session 8 - Introduction to Android
Advanced Malware Analysis Training Session 8 - Introduction to Android
 
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
Advanced Malware Analysis Training Session 4 - Anti-Analysis TechniquesAdvanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
 
Anatomy of Exploit Kits
Anatomy of Exploit KitsAnatomy of Exploit Kits
Anatomy of Exploit Kits
 
Reversing malware analysis training part6 practical reversing
Reversing malware analysis training part6 practical reversingReversing malware analysis training part6 practical reversing
Reversing malware analysis training part6 practical reversing
 
So. many. vulnerabilities. Why are containers such a mess and what to do abou...
So. many. vulnerabilities. Why are containers such a mess and what to do abou...So. many. vulnerabilities. Why are containers such a mess and what to do abou...
So. many. vulnerabilities. Why are containers such a mess and what to do abou...
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
 
Docker and-daily-devops
Docker and-daily-devopsDocker and-daily-devops
Docker and-daily-devops
 
Bh us 11_tsai_pan_weapons_targeted_attack_wp
Bh us 11_tsai_pan_weapons_targeted_attack_wpBh us 11_tsai_pan_weapons_targeted_attack_wp
Bh us 11_tsai_pan_weapons_targeted_attack_wp
 

Andere mochten auch

Bhajan Poorn Hogi Aas
Bhajan Poorn Hogi AasBhajan Poorn Hogi Aas
Bhajan Poorn Hogi Aas
Mool Chand
 
Adjuvant Therapy In Uterine Sarcomas
Adjuvant Therapy In Uterine SarcomasAdjuvant Therapy In Uterine Sarcomas
Adjuvant Therapy In Uterine Sarcomas
Dr.T.Sujit :-)
 
Healthy nutrition rules
Healthy nutrition rulesHealthy nutrition rules
Healthy nutrition rules
Anar R Guliyev
 
приложение 4
приложение 4приложение 4
приложение 4
farcrys
 

Andere mochten auch (20)

Bhajan Poorn Hogi Aas
Bhajan Poorn Hogi AasBhajan Poorn Hogi Aas
Bhajan Poorn Hogi Aas
 
Beautiful British Landscape Photographs
Beautiful British Landscape PhotographsBeautiful British Landscape Photographs
Beautiful British Landscape Photographs
 
me
meme
me
 
Bitter Pill: Why Medical Costs Are Killing Us?
Bitter Pill: Why Medical Costs Are Killing Us?Bitter Pill: Why Medical Costs Are Killing Us?
Bitter Pill: Why Medical Costs Are Killing Us?
 
James Metcalfe's February Real Estate Update
James Metcalfe's February Real Estate UpdateJames Metcalfe's February Real Estate Update
James Metcalfe's February Real Estate Update
 
Food Advertising Awards
Food Advertising AwardsFood Advertising Awards
Food Advertising Awards
 
Adjuvant Therapy In Uterine Sarcomas
Adjuvant Therapy In Uterine SarcomasAdjuvant Therapy In Uterine Sarcomas
Adjuvant Therapy In Uterine Sarcomas
 
Power monica lat
Power monica latPower monica lat
Power monica lat
 
Re Shoot
Re ShootRe Shoot
Re Shoot
 
Exploring spatial pattern formation using a simple individual-based model
Exploring spatial pattern formation using a simple individual-based modelExploring spatial pattern formation using a simple individual-based model
Exploring spatial pattern formation using a simple individual-based model
 
Jupiterimages Calendar
Jupiterimages CalendarJupiterimages Calendar
Jupiterimages Calendar
 
SEO On A Budget
SEO On A BudgetSEO On A Budget
SEO On A Budget
 
20091217_EPE-B.Aigaiou_Tsigos
20091217_EPE-B.Aigaiou_Tsigos20091217_EPE-B.Aigaiou_Tsigos
20091217_EPE-B.Aigaiou_Tsigos
 
Healthy nutrition rules
Healthy nutrition rulesHealthy nutrition rules
Healthy nutrition rules
 
Five Disruptive Forces that are Shaking Up Indian Pharma!
Five Disruptive Forces that are Shaking Up Indian Pharma! Five Disruptive Forces that are Shaking Up Indian Pharma!
Five Disruptive Forces that are Shaking Up Indian Pharma!
 
2010 Uni Serv Skills Session Meeting Potential Of Online Meeting Spaces
2010 Uni Serv Skills Session Meeting Potential Of Online Meeting Spaces2010 Uni Serv Skills Session Meeting Potential Of Online Meeting Spaces
2010 Uni Serv Skills Session Meeting Potential Of Online Meeting Spaces
 
Presentatie e hvb pmonup definitie
Presentatie e hvb pmonup definitiePresentatie e hvb pmonup definitie
Presentatie e hvb pmonup definitie
 
приложение 4
приложение 4приложение 4
приложение 4
 
One week job india
One week job indiaOne week job india
One week job india
 
Chefs Choice Magazine Editorial Coverage Part II
Chefs Choice Magazine Editorial Coverage Part IIChefs Choice Magazine Editorial Coverage Part II
Chefs Choice Magazine Editorial Coverage Part II
 

Ähnlich wie Rails Security

3 secure design principles
3 secure design principles3 secure design principles
3 secure design principles
drewz lin
 
Break it while you make it: writing (more) secure software
Break it while you make it: writing (more) secure softwareBreak it while you make it: writing (more) secure software
Break it while you make it: writing (more) secure software
Leigh Honeywell
 
3.Secure Design Principles And Process
3.Secure Design Principles And Process3.Secure Design Principles And Process
3.Secure Design Principles And Process
phanleson
 
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
beltface
 
Neo word press meetup ehermits - how to keep your blog from being hacked 2012
Neo word press meetup ehermits - how to keep your blog from being hacked 2012Neo word press meetup ehermits - how to keep your blog from being hacked 2012
Neo word press meetup ehermits - how to keep your blog from being hacked 2012
Brian Layman
 
Testingfor Sw Security
Testingfor Sw SecurityTestingfor Sw Security
Testingfor Sw Security
ankitmehta21
 

Ähnlich wie Rails Security (20)

3 secure design principles
3 secure design principles3 secure design principles
3 secure design principles
 
Break it while you make it: writing (more) secure software
Break it while you make it: writing (more) secure softwareBreak it while you make it: writing (more) secure software
Break it while you make it: writing (more) secure software
 
Real World Application Threat Modelling By Example
Real World Application Threat Modelling By ExampleReal World Application Threat Modelling By Example
Real World Application Threat Modelling By Example
 
Protecting Your Key Asset – Data Protection Best Practices V2.0 Final
Protecting Your Key Asset – Data Protection Best Practices V2.0 FinalProtecting Your Key Asset – Data Protection Best Practices V2.0 Final
Protecting Your Key Asset – Data Protection Best Practices V2.0 Final
 
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
 
3.Secure Design Principles And Process
3.Secure Design Principles And Process3.Secure Design Principles And Process
3.Secure Design Principles And Process
 
Threat_Modelling.pdf
Threat_Modelling.pdfThreat_Modelling.pdf
Threat_Modelling.pdf
 
James Jara Portfolio 2014 - InfoSec White Paper- Part 5
James Jara Portfolio 2014 - InfoSec White Paper- Part 5James Jara Portfolio 2014 - InfoSec White Paper- Part 5
James Jara Portfolio 2014 - InfoSec White Paper- Part 5
 
Bridging the Gap
Bridging the GapBridging the Gap
Bridging the Gap
 
apsec 7 Golden Rules Data Leakage Prevention / DLP
apsec 7 Golden Rules Data Leakage Prevention / DLPapsec 7 Golden Rules Data Leakage Prevention / DLP
apsec 7 Golden Rules Data Leakage Prevention / DLP
 
Survey Presentation About Application Security
Survey Presentation About Application SecuritySurvey Presentation About Application Security
Survey Presentation About Application Security
 
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
Seeing Purple: Hybrid Security Teams for the Enterprise - BSides Jackson 2013
 
Owasp mobile top 10
Owasp mobile top 10Owasp mobile top 10
Owasp mobile top 10
 
I got 99 trends and a # is all of them
I got 99 trends and a # is all of themI got 99 trends and a # is all of them
I got 99 trends and a # is all of them
 
Bridging the Gap: Lessons in Adversarial Tradecraft
Bridging the Gap: Lessons in Adversarial TradecraftBridging the Gap: Lessons in Adversarial Tradecraft
Bridging the Gap: Lessons in Adversarial Tradecraft
 
Data Security And The Security
Data Security And The SecurityData Security And The Security
Data Security And The Security
 
Security Issues in OpenStack
Security Issues in OpenStackSecurity Issues in OpenStack
Security Issues in OpenStack
 
Neo word press meetup ehermits - how to keep your blog from being hacked 2012
Neo word press meetup ehermits - how to keep your blog from being hacked 2012Neo word press meetup ehermits - how to keep your blog from being hacked 2012
Neo word press meetup ehermits - how to keep your blog from being hacked 2012
 
Six Steps to SIEM Success
Six Steps to SIEM SuccessSix Steps to SIEM Success
Six Steps to SIEM Success
 
Testingfor Sw Security
Testingfor Sw SecurityTestingfor Sw Security
Testingfor Sw Security
 

Mehr von David Keener

Mehr von David Keener (20)

Writing Killer Fight Scenes
Writing Killer Fight ScenesWriting Killer Fight Scenes
Writing Killer Fight Scenes
 
Build a Space Battle
Build a Space BattleBuild a Space Battle
Build a Space Battle
 
Creating an Adaptive Setting
Creating an Adaptive SettingCreating an Adaptive Setting
Creating an Adaptive Setting
 
Public Speaking for Writers
Public Speaking for WritersPublic Speaking for Writers
Public Speaking for Writers
 
21st Century Writer
21st Century Writer21st Century Writer
21st Century Writer
 
Titanic: The Forgotten Passengers
Titanic: The Forgotten PassengersTitanic: The Forgotten Passengers
Titanic: The Forgotten Passengers
 
Rails Tips and Best Practices
Rails Tips and Best PracticesRails Tips and Best Practices
Rails Tips and Best Practices
 
Elevator Up, Please!
Elevator Up, Please!Elevator Up, Please!
Elevator Up, Please!
 
Rails and the Apache SOLR Search Engine
Rails and the Apache SOLR Search EngineRails and the Apache SOLR Search Engine
Rails and the Apache SOLR Search Engine
 
Killer Business Models
Killer Business ModelsKiller Business Models
Killer Business Models
 
Building Facebook Apps
Building Facebook AppsBuilding Facebook Apps
Building Facebook Apps
 
Leveraging Rails to Build Facebook Apps
Leveraging Rails to Build Facebook AppsLeveraging Rails to Build Facebook Apps
Leveraging Rails to Build Facebook Apps
 
Quick Start: ActiveScaffold
Quick Start: ActiveScaffoldQuick Start: ActiveScaffold
Quick Start: ActiveScaffold
 
Creating Custom Charts With Ruby Vector Graphics
Creating Custom Charts With Ruby Vector GraphicsCreating Custom Charts With Ruby Vector Graphics
Creating Custom Charts With Ruby Vector Graphics
 
A Tour of Ruby On Rails
A Tour of Ruby On RailsA Tour of Ruby On Rails
A Tour of Ruby On Rails
 
Using Rails to Create an Enterprise App: A Real-Life Case Study
Using Rails to Create an Enterprise App: A Real-Life Case StudyUsing Rails to Create an Enterprise App: A Real-Life Case Study
Using Rails to Create an Enterprise App: A Real-Life Case Study
 
Practical JRuby
Practical JRubyPractical JRuby
Practical JRuby
 
Implementing OpenID for Your Social Networking Site
Implementing OpenID for Your Social Networking SiteImplementing OpenID for Your Social Networking Site
Implementing OpenID for Your Social Networking Site
 
Creating Dynamic Charts With JFreeChart
Creating Dynamic Charts With JFreeChartCreating Dynamic Charts With JFreeChart
Creating Dynamic Charts With JFreeChart
 
Quick Start: Rails
Quick Start: RailsQuick Start: Rails
Quick Start: Rails
 

Kürzlich hochgeladen

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc
 

Kürzlich hochgeladen (20)

Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 

Rails Security

  • 1. Rails Security : It’s Not Just a Good Idea By David Keener
  • 2. Introduction Why security matters Realistic goals Learning good practices …by looking at some bad practices Resources Some final thoughts
  • 3. Who Am I? Long-time Ruby/Rails developer Founder/Organizer – RubyNation & DevIgnition conferences Last 3 projects… - Online Video Contest: With $10K-plus prizes… - Bank: Online charitable donations via credit card - Cyber Security: <cannot discuss details> “School of hard knocks” for security
  • 4. Why Security Matters More personal data is moving online than ever before Social networks, retail sites, mobile devices, etc. The community of “bad actors” is growing and it’s international The Internet is everywhere If the data in your app has value, someone WILL try to get to it RSA is THE ultimate example There are serious legal ramifications to security breaches
  • 5. Realistic Goals Security is a BIG topic Nobody can cover it all in one talk Goal 1: Illustrate how important security is Goal 2: Demonstrate some good practices (and a few bad mistakes) Goal 3: Point you to some awesome resources
  • 6. “…out of 300 audited sites, 97% are vulnerable to attack” - From a Gartner Group survey
  • 7. 1. A Silly Vulnerability A newbie mistake… …here’s the exploit: curl –d ‘forum_id=1&message[subject]=foobar’ http://yoursite.com/forums
  • 8. 1. Mitigation Option 1: Include the before filter in proper controller Option 2: Create a NoAuth controller… - ApplicationController: before_filter :login_required - NoAuthController: skip_before_filter :login_required General Rule: “Default Deny” is your friend. Also: Be aware of code smells such as out-of-control before-filter stacks, filters with non-obvious side effects, etc.
  • 9. 2. Mass Assignment How many times have we seen this: Mass assignment is convenient…but it’s not safe.
  • 10. 2. Mitigation Mass assignment – only for fields with no security impact ALL models should use attr_accessible to specify fields that can be mass-assigned attr_accessible :first_name, :last_name, :email Other fields can be individually assigned if needed
  • 11. 3. Regexes What’s wrong with this code?
  • 12. 3. Mitigation The regular expression uses ^ and $ to match the start and end of the string In Ruby, this only matches a single line if multi-line input is provided Use A and z instead for input validation
  • 13. 4. File Uploads views/uploads/new.html.erb controllers/uploads.rb Uploads are prone to numerous potential security issues…
  • 14. 4. Problems The original file is left in the /tmp directory - Under a name like Rack*multipart*{random stuff} - Executable files could theoretically be executed by someone (BAD) The uploaded file is copied to $RAILS_ROOT/public/data - Under a name like Rack*multipart*{random stuff} - The file is web-accessible - Embedded JavaScript will have server access (BAD) - Could potentially see files uploaded by other users (PRIVACY) Uploaded files are never cleaned up File names can have collisions
  • 15. 4. Mitigations File in /tmp directory - Remove the file immediately after it has been copied File is copied to $RAILS_ROOT/public/data - Copy files to a non-web-accessible dir - Validate file types and eliminate undesirable files - Ensure that files are never left as executable Uploaded files never cleaned up - Delete files when no longer needed File names can have collisions - Add a unique ID as a filename prefix to prevent name collisions
  • 16. 5. Uploading XML Files What if I want to … upload and parse an XML File? It’s called an XML External Entity Expansion Attack…
  • 17. 5. Mitigation Options Option 1: Before parsing, regex for !DOCTYPE, !ELEMENT or !ENTITY and immediately reject the file - No need to be nice to the user Option 2: Disable entity expansions - Differs based on XML parser used
  • 18. 5. Mitigation - Nokogiri Parse settings - Validates the XML against the XSD - noent => No entity expansions - nonet => No network access - Does not actually do external entity expansions, but the infrastructure is there
  • 19. 5. Mitigation - REXML - Non-validating parser - entity_expansion_limit: raises exception if it finds any entity expansions - Not actually required to do entity expansions, but it seems to have some of the infrastructure
  • 20. Some Best Practices Here are a few more best practices Always sanitize user-provided input Rolling your own authentication is an anti-pattern…think twice - Use Devise, restful_authentication, CanCan, etc. Use database-backed session storage “Default Deny” is your friend Use SSL for secure logins in production
  • 21. Resources Rails Security Guide http://guides.rubyonrails.org/security.html OWASP Ruby on Rails Security Guide V2 https://www.owasp.org/index.php/Category:OWASP_Ruby_on_Ra ils_Security_Guide_V2 DHS Sensitive Systems Policy Directive 4300A http://www.uscg.mil/hq/cg9/NAIS/RFP/SectionJ/dhs-4300A- policy.pdf
  • 22. Conclusion Security matters... Compromising PII or financial info will always be BAD It’s easier to build security in from the beginning than to retrofit it later Make good security practices second nature now…they will pay off later The security of your app must be TESTED RSpec, Cucumber and similar tools are essential
  • 23. It’s smooth sailing If you build good security practices into your app…
  • 24. Questions Feel free to contact me: dkeener@keenertech.com david.keener@gd-ais.com Twitter: dkeener2010 Blog: http://www.keenertech.com We’re also looking for some good Rubyists…