CSC/ECE 517 Fall 2009/wiki1b 8 rubysecurity - Revision history

Hunter: Final

2009-09-29T01:30:38Z

Final

← Older revision		Revision as of 01:30, 29 September 2009
Line 12:		Line 12:
	----		----
	These weaknesses are related to insecure ways in which data is sent and received between separate components, modules, programs, processes, threads, or systems.		These weaknesses are related to insecure ways in which data is sent and received between separate components, modules, programs, processes, threads, or systems.

	This section contains the programming errors such as Improper Input validation, improper encoding of output,SQL injection etc., and five other error types.		This section contains the programming errors such as Improper Input validation, improper encoding of output,SQL injection etc., and five other error types.

Line 315:		Line 314:

	==Security Features Comparison of Rails with other Application Frameworks==		==Security Features Comparison of Rails with other Application Frameworks==
			In this section we compare some of the security features of Rails with two of the most common application frameworks, Springs and Struts.

	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"

Hunter: spacing

2009-09-29T01:27:07Z

spacing

Show changes

Hunter: /* Use of Insufficiently Random Values */ spacing

2009-09-29T01:14:45Z

Use of Insufficiently Random Values: spacing

← Older revision		Revision as of 01:14, 29 September 2009
Line 247:		Line 247:
	----		----
	Good randomness is necessary for the security features implemented in our web application using cryptographic algorithms to be effective and useful. If our application is using a normal [http://en.wikipedia.org/wiki/Pseudo-random_number_generator Pseudo Random Number Generator] then it is easy for the attacker to guess the next random number after some number of trials.		Good randomness is necessary for the security features implemented in our web application using cryptographic algorithms to be effective and useful. If our application is using a normal [http://en.wikipedia.org/wiki/Pseudo-random_number_generator Pseudo Random Number Generator] then it is easy for the attacker to guess the next random number after some number of trials.
	Randomness is needed to produce session IDs and for generating nonces to prevent replay attacks.		Randomness is needed to produce session IDs and for generating nonces to prevent replay attacks.

	Rails make sure that the random number generated is random enough so that the attacker has very less probability of guessing the random number. For example, for generating session IDs in Rails, first a random number is generated where the random string is the current time, a random number between 0 and 1, the process id number of the Ruby interpreter (also basically a random number) and a constant string. This random string is then hashed using [http://en.wikipedia.org/wiki/MD5 MD5] and the resulting value is stored as session ID. The method to produce a random string is rand.		Rails make sure that the random number generated is random enough so that the attacker has very less probability of guessing the random number. For example, for generating session IDs in Rails, first a random number is generated where the random string is the current time, a random number between 0 and 1, the process id number of the Ruby interpreter (also basically a random number) and a constant string. This random string is then hashed using [http://en.wikipedia.org/wiki/MD5 MD5] and the resulting value is stored as session ID. The method to produce a random string is rand.

	If you needed a random integer to simulate a roll of a six-sided die, you'd use: 1 + rand(6). A roll in craps could be simulated with 2 + rand (6) + rand(6) [http://www.codeodor.com/index.cfm/2007/3/25/Ruby-random-numbers/1042 [20]].		If you needed a random integer to simulate a roll of a six-sided die, you'd use: 1 + rand(6). A roll in craps could be simulated with 2 + rand (6) + rand(6) [http://www.codeodor.com/index.cfm/2007/3/25/Ruby-random-numbers/1042 [20]].

	Finally, if you just need a random float, just call rand with no arguments.		Finally, if you just need a random float, just call rand with no arguments.

Hunter: /* External Control of File Name or Path */ spacing

2009-09-29T01:14:03Z

External Control of File Name or Path: spacing

← Older revision		Revision as of 01:14, 29 September 2009
Line 129:		Line 129:
	----		----
	When you use an outsider's input while constructing a filename, the resulting path could point outside of the intended directory. An attacker could combine multiple ".." or similar sequences to cause the operating system to navigate out of the restricted directory. Other file-related attacks are simplified by external control of a filename, such as symbolic link following, which causes your application to read or modify files that the attacker can't access directly.		When you use an outsider's input while constructing a filename, the resulting path could point outside of the intended directory. An attacker could combine multiple ".." or similar sequences to cause the operating system to navigate out of the restricted directory. Other file-related attacks are simplified by external control of a filename, such as symbolic link following, which causes your application to read or modify files that the attacker can't access directly.

	This vulnerability can be overcome by using ''$SAFE'', which is a global security parameter that Ruby provides.		This vulnerability can be overcome by using ''$SAFE'', which is a global security parameter that Ruby provides.
	$SAFE controls a number of security features in the Ruby programming language. The higher you raise ''$SAFE'', the more restrictions the Ruby interpreter puts on your program. The ''$SAFE'' level [http://neworder.box.sk/news/18206 [12]] can only be raised, not lowered; malicious code cannot lower the ''$SAFE'' level to escalate privileges.		$SAFE controls a number of security features in the Ruby programming language. The higher you raise ''$SAFE'', the more restrictions the Ruby interpreter puts on your program. The ''$SAFE'' level [http://neworder.box.sk/news/18206 [12]] can only be raised, not lowered; malicious code cannot lower the ''$SAFE'' level to escalate privileges.

	There are 5 ''$SAFE'' levels, represented by the integers 0 through 4. To set a ''$SAFE'' level, assign an integer to ''$SAFE''. By default, ''$SAFE'' is set to 0. At this level, no extra checks will be performed by the Ruby interpreter. If, when you try to assign an integer to ''$SAFE'' that is less than the current value of ''$SAFE'', a SecurityError exception will be raised. In addition, you can run Ruby scripts with a higher ''$SAFE'' level by supplying the -T switch to the Ruby interpreter.		There are 5 ''$SAFE'' levels, represented by the integers 0 through 4. To set a ''$SAFE'' level, assign an integer to ''$SAFE''. By default, ''$SAFE'' is set to 0. At this level, no extra checks will be performed by the Ruby interpreter. If, when you try to assign an integer to ''$SAFE'' that is less than the current value of ''$SAFE'', a SecurityError exception will be raised. In addition, you can run Ruby scripts with a higher ''$SAFE'' level by supplying the -T switch to the Ruby interpreter.

	''$SAFE'' level 1 introduces the concept of tainted objects. Objects that accept input from external sources (files, sockets, environment variables, etc) will have the tainted flag set. This flag will follow all copies of the object, no matter how many times you filter or copy this object, it will always remain tainted. There are two methods that will help you manage tainted ''objects; Object#tainted?'' returns true if an object has the tainted flag set, and ''Object#untaint'' untaints the object.		''$SAFE'' level 1 introduces the concept of tainted objects. Objects that accept input from external sources (files, sockets, environment variables, etc) will have the tainted flag set. This flag will follow all copies of the object, no matter how many times you filter or copy this object, it will always remain tainted. There are two methods that will help you manage tainted ''objects; Object#tainted?'' returns true if an object has the tainted flag set, and ''Object#untaint'' untaints the object.

Line 151:		Line 154:
	path is tainted		path is tainted
	Caught security exception: Insecure operation - initialize		Caught security exception: Insecure operation - initialize

	One cannot open files whose names are tainted strings.''$SAFE'' level one alone can make your Ruby programs much more secure. It forces you to be vigilant with input validation.		One cannot open files whose names are tainted strings.''$SAFE'' level one alone can make your Ruby programs much more secure. It forces you to be vigilant with input validation.

Hunter: /* Incorrect Calculation */ examples

2009-09-29T01:13:07Z

Incorrect Calculation: examples

← Older revision		Revision as of 01:13, 29 September 2009
Line 194:		Line 194:
	----		----
	There are instances when the numerical operations lead to exceptions like Integer overflow [http://www.ruby-forum.com/topic/195251 [16]] and divide by zero errors. When attackers have some control over the inputs that are used in numeric calculations, this weakness can actually have security consequences.		There are instances when the numerical operations lead to exceptions like Integer overflow [http://www.ruby-forum.com/topic/195251 [16]] and divide by zero errors. When attackers have some control over the inputs that are used in numeric calculations, this weakness can actually have security consequences.
	Integer overflow exceptions also occur in ruby and they can be handled with the raise construct.		Integer overflow exceptions also occur in ruby and they can be handled with the ''raise'' construct. Ruby uses the kernel method ''raise'' to raise exceptions and uses a ''rescue'' clause to handle these exceptions.
	Integers overflow behavior of Ruby is as follows, the interpreter converts a Fixnums (30 bits) into a Bignums (unlimited precision integers).
	Ruby has an integer overflow vulnerability in the rb_ary_fill() function(as on Dec. 2008). For more details about the vulnerability refer [http://lwn.net/Articles/288566/ [17]].		The following example to calculate the factorial of the number will raise an exception when a negative number is passed as the argument.
			def factorial(n)
			raise "bad argument" if n < 1 #raise an exception if n is lesser than 1
			return 1 if n==1
			n*factorial(n-1)
			end

			The ''rescue'' clause can be used to handle the above exception as follows
			rescue => ex #store exception in variable ex
			puts "#{ex.class}: #{ex.message}" #Handle exception by printing message
			end
			Integers overflow behavior of Ruby is as follows: the interpreter converts a Fixnums (30 bits) into a Bignums (unlimited precision integers).
			Ruby has an integer overflow vulnerability in the ''rb_ary_fill()'' function(as on Dec. 2008). For more details about the vulnerability, refer [http://lwn.net/Articles/288566/ [17]].

	===CATEGORY: Porous Defenses===		===CATEGORY: Porous Defenses===

Hunter: /* Error Message Information Leak */ example

2009-09-29T00:54:56Z

Error Message Information Leak: example

← Older revision		Revision as of 00:54, 29 September 2009
Line 100:		Line 100:
	Improper error messages may leak out secrets to an attacker. The secrets could cover a wide range of valuable data, including personally identifiable information (PII), authentication credentials, and server configuration. Sometimes, they might seem like harmless secrets that are convenient for users and admins, such as the full installation path of the software.		Improper error messages may leak out secrets to an attacker. The secrets could cover a wide range of valuable data, including personally identifiable information (PII), authentication credentials, and server configuration. Sometimes, they might seem like harmless secrets that are convenient for users and admins, such as the full installation path of the software.
	Rails offer complete customization of default validation error messages it provides. change the entire contents of any validation error message. Make the application secure by reducing error message information leaks by writing customized ''error_messages_for'' helper.		Rails offer complete customization of default validation error messages it provides. change the entire contents of any validation error message. Make the application secure by reducing error message information leaks by writing customized ''error_messages_for'' helper.
			A scaffold generated code uses the ''error_messages_for'' helper method which will display a single box at the top of the form showing all errors in the form. This method takes the model object as a parameter. The following is an example syntax for this method.

			<%= error_messages_for(:student)%> # student is the model object under consideration

	===CATEGORY: Risky Resource Management===		===CATEGORY: Risky Resource Management===

Hunter: /* Improper Resource Shutdown or Release */ Example given

2009-09-29T00:48:19Z

Improper Resource Shutdown or Release: Example given

← Older revision		Revision as of 00:48, 29 September 2009
Line 172:		Line 172:
	System resources that have reached their end-of-life need to be dispose off correctly. Otherwise, your environment will become heavily congested or contaminated. This applies to memory, files, cookies, data structures, sessions, communication pipes, and so on. Attackers can exploit improper shutdown to maintain control over those resources well after you thought you got rid of them.		System resources that have reached their end-of-life need to be dispose off correctly. Otherwise, your environment will become heavily congested or contaminated. This applies to memory, files, cookies, data structures, sessions, communication pipes, and so on. Attackers can exploit improper shutdown to maintain control over those resources well after you thought you got rid of them.
	Ruby uses automatic garbage collectors [http://www.meshplex.org/wiki/Ruby/Ruby_on_Rails_programming_tutorials [14]] which overcomes this problem.		Ruby uses automatic garbage collectors [http://www.meshplex.org/wiki/Ruby/Ruby_on_Rails_programming_tutorials [14]] which overcomes this problem.
			Garbage collection is done through ''GC'' module as well as ''ObjectSpace'' module.
			In case of ''GC'' module, the code snippet

			GC.start # => nil
			initiates garbage collection unless manually disabled.
			In case of ''ObjectSpace'' module, the line

			ObjectSpace.garbage_collect
			initiates garbage collection.

	====Improper Initialization====		====Improper Initialization====

Hunter: /* Hard-Coded Password */

2009-09-29T00:32:03Z

Hard-Coded Password

← Older revision		Revision as of 00:32, 29 September 2009
Line 209:		Line 209:
	Then the [http://en.wikipedia.org/wiki/SHA_hash_functions SHA]is computed with following piece of code		Then the [http://en.wikipedia.org/wiki/SHA_hash_functions SHA]is computed with following piece of code
	private		private
	def self.encrypted_password(password, salt)		def self.encrypted_password(password,salt)
	string_to_hash = password + ~~“wibble”~~ + salt		string_to_hash=password + "something" + salt
	Digest::SHA1.hexdigest(string_to_hash)		Digest::SHA1.hexdigest(string_to_hash)
	end		end

	When an incoming authentication request arrives, the entered password is appended with a salt and hashed using [http://en.wikipedia.org/wiki/SHA_hash_functions SHA] 1 and it is stored in the password attribute of the user object. This is then compared to the stored password for that user in the database to check whether it is correct or not.		When an incoming authentication request arrives, the entered password is appended with a salt and hashed using [http://en.wikipedia.org/wiki/SHA_hash_functions SHA] 1 and it is stored in the password attribute of the user object. This is then compared to the stored password for that user in the database to check whether it is correct or not.

Hunter: /* Hard-Coded Password */

2009-09-29T00:28:36Z

Hard-Coded Password

← Older revision		Revision as of 00:28, 29 September 2009
Line 210:		Line 210:
	private		private
	def self.encrypted_password(password, salt)		def self.encrypted_password(password, salt)
	string_to_hash = password + “wibble” + salt		string_to_hash = password + “wibble” + salt
	Digest::SHA1.hexdigest(string_to_hash)		Digest::SHA1.hexdigest(string_to_hash)
	~~End~~		end
	When an incoming authentication request arrives, the entered password is appended with a salt and hashed using [http://en.wikipedia.org/wiki/SHA_hash_functions SHA] 1 and it is stored in the password attribute of the user object. This is then compared to the stored password for that user in the database to check whether it is correct or not.		When an incoming authentication request arrives, the entered password is appended with a salt and hashed using [http://en.wikipedia.org/wiki/SHA_hash_functions SHA] 1 and it is stored in the password attribute of the user object. This is then compared to the stored password for that user in the database to check whether it is correct or not.

Hunter: /* Cleartext Transmission of Sensitive Information */

2009-09-29T00:22:52Z

Cleartext Transmission of Sensitive Information

← Older revision		Revision as of 00:22, 29 September 2009
Line 72:		Line 72:
	This can be overcome in Rails by using [http://en.wikipedia.org/wiki/Transport_Layer_Security Secure Socket Layer (SSL)] for entire session.		This can be overcome in Rails by using [http://en.wikipedia.org/wiki/Transport_Layer_Security Secure Socket Layer (SSL)] for entire session.
	Assuming the SSL keys and certificates are setup and the Web server has been configured to use SSL.		Assuming the SSL keys and certificates are setup and the Web server has been configured to use SSL.
	Rails provides the ssl_requirement plug-in to use SSL in a rails application. Include it at the top of application.rb file present in the directory app/controllers, which effectively includes it in every controller [http://www.buildingwebapps.com/articles/6401-using-ssl-in-rails-applicati]:		Rails provides the ssl_requirement plug-in to use SSL in a rails application. Include it at the top of application.rb file present in the directory app/controllers, which effectively includes it in every controller [http://www.buildingwebapps.com/articles/6401-using-ssl-in-rails-applicati [6]]:
	include SslRequirement		include SslRequirement
	Now all that is needed to be specified is, at the top of each controller, which controller actions require SSL. For example :		Now all that is needed to be specified is, at the top of each controller, which controller actions require SSL. For example :