Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (10)
Similar to ATLRUG Rails Security Presentation - 9/10/2014
Similar to ATLRUG Rails Security Presentation - 9/10/2014 (20)
More from jasnow
More from jasnow (20)
Recently uploaded
Recently uploaded (20)
ATLRUG Rails Security Presentation - 9/10/2014
- 1. Railsgoat
- 2. Introductions • Ken Johnson – CTO @nVisium – Former LivingSocialite – Develop heavily in Rails – Railsgoat Co-Author • Mike – Director of ProServ @nVisium – Former LivingSocialite – Isn’t here to defend himself, I can say what I want – Paler than me – Trendsetter of the “Skhaki”
- 3. Why? • Why not? • Lack of quality training available • Assist all of you!
- 5. Railsgoat Current Config • Rails 3.x • Custom Authentication • MySQL (optional) & SQLite • Mailcatcher • RSpec tests • **Easy to find credentials**
- 6. Railsgoat Upcoming Config • Rails 4.x • Devise Authentication (w/ Tutorials) • MySQL & SQLite (optional) • Mailcatcher • RSpec • Open to suggestions
- 7. MODEL LAYER
- 8. Model Layer – Mass Assignment • Mass- Assignment – Not a huge issue in Rails 4… unless you instantiate models with data *outside* of the controller – Rails 2 & 3 (don’t be ashamed, someone in this room is running 2.x) – Yes, very much a problem – Audit for fun & profit – Ready, set, hack!
- 9. Model Layer – Hashing/Encryption • Hashing vs. Encryption • Strong hashing algorithms • Strong encryption algorithms • Rack::Utils.secure_compare vs. “==“ • Be careful how you re-use
- 10. Model Layer – SQL Injection • ActiveRecord - Safe… well, sort of • http://rails-sqli.org/
- 12. Presentation Layer – XSS • XSS = Cross-Site Scripting (aka – html injection) • html_safe • JSON 3.2x
- 13. Presentation Layer – Browser Behavior • Cookies – Client-side vs. Server-side • Headers – CSP – secure_headers
- 14. LOGIC LAYER
- 15. Logic Layer – Insecure DOR • Do not trust users • Prevention
- 16. Logic Layer - RCE • Remote Code Execution – YAML – Marshal
- 17. Logic Layer – Regexp • Be careful with your Regular Expression • Subtle Logic Flaw (demo)
- 18. Logic Layer - CSRF • Somewhat well known aspects – Meta tag helper – On by default – protect_from_forgery filter • Not so well known… – `match` routes bypass – Chain of execution is not halted
- 19. Logic Layer – Session Handling • Logout – reset_session – Clear session values • Login – reset_session • before_filter(s) – Take a whitelist approach • Base access decisions off the current_user
- 20. Logic Layer - Redirection • redirect_to …. You scoundrel • Why does this matter? • URI.parse()
- 21. Logic Layer – Authentication Tips • Account Lock-Out • Password Complexity • Enumeration • Password Hashing • (heads-up) – Covering Devise auth in upcoming release of Railsgoat
- 23. Unit-Tests / Regression Testing • Railsgoat has examples – RSpec • Regression Testing – Why – How
- 24. DEFENSIVE TOOLS
- 25. Defensive Tools • Brakeman • Bundler-Audit • Ensnare • Rack-attack
- 26. ROADMAP
- 27. Roadmap • Use GitHub Issue Tracker • Recap of upgrade effort • Extensible so looking for more contributors
- 28. Q&A • Questions?
- 29. Free Subscription • Send an email to contact@seccasts.com • Subject line – ATLRUG Free Sub – We will setup on Friday
- 30. Contact • Twitter: – @cktricky – @mccabe615 • Email: – ken@nvisium.com – mike@nvisium.com • Railsgoat – http://railsgoat.cktricky.com
- 31. Thanks to the following • Al Snow • Jim Manico • Jack Mannino • Justin Collins • Neil Matatall • …and a bunch of other folks as well
- 32. THANK YOU ATLRUG
Editor's Notes
- Rails 2&3 - You can disable whitelisting, you can use blacklisting, you can simply add vulnerable attributes to the model (ouch)
- Session is reset but chain of execution is not halted