...But Doesn't Rails Take Care of Security for Me?

on YouTube ↗43m

" summary

Rails' built‑in protections don't stop logic and deployment mistakes: an unscoped find lets anyone delete other users' payment methods ($2,800 bounty), a Mileage Plus API leaks reservations via a manipulable mpnumber, a Domino's app trusts client payment responses, Ashley Madison's bcrypt hashes get cracked by exploiting legacy md5 login keys (millions cracked), a missing rate limit on a Facebook beta lets six‑digit codes be brute forced, an Imgur endpoint enables server side request forgery ($2,000), and an open repo exposes the signed marshalled session key on Rails 3.2 allowing RCE and AWS access ($2,500).

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 9:39United
3. 12:53Dominos
4. 14:23XML
5. 16:48Ashley Madison
6. 18:03PHP Code
7. 21:50Passwords
8. 24:13Server side request forgery
9. 28:41Facebook admin panel
10. 34:48Summary

" related talks

• 31mRails Application Security in PracticeBryan Helmkamp · Ruby Midwest 2013
• 43mSecuring Your Rails AppJim Weirich, Matt Yoho · Ruby on Ales 2011
• 59mGoing Auth The Rails On A Crazy TrainJeff Jarmoc, Tomek Rabczak · Black Hat Europe 2015
• 34mThe World of Rails SecurityJustin Collins · RailsConf 2015
• 32mSecuring Your Rails AppJim Weirich, Matt Yoho · MountainWest RubyConf 2011
• 47mEsoteric Web Application VulnerabilitiesAndres Riancho · CODE BLUE 2016
• 37mThe Evolution of Rails SecurityJustin Collins · RailsConf 2018
• 31mRails' Insecure DefaultsBryan Helmkamp · RailsConf 2013