cktricky
104 lines
4.6 KiB
Plaintext
104 lines
4.6 KiB
Plaintext
<div class="widget">
|
|
<div class="widget-header">
|
|
<div class="title">
|
|
<span class="fs1" aria-hidden="true" data-icon=""></span> A6 - Sensitive Data Exposure - Clear-text storage of SSN(s)
|
|
</div>
|
|
</div>
|
|
<div class="widget-body">
|
|
<div id="accordion1" class="accordion no-margin">
|
|
<div class="accordion-group">
|
|
<div class="accordion-heading">
|
|
<a href="#collapseSSNOne" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
|
<i class="icon-info icon-white">
|
|
</i>
|
|
Description
|
|
</a>
|
|
</div>
|
|
<div class="accordion-body in collapse" id="collapseSSNOne" style="height: auto;">
|
|
<div class="accordion-inner">
|
|
<p class="desc">
|
|
The Railsgoat application stores and transmits Social Security Numbers insecurely.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="accordion-group">
|
|
<div class="accordion-heading">
|
|
<a href="#collapseSSNTwo" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
|
<i class="icon-bug icon-white">
|
|
</i>
|
|
Bug
|
|
</a>
|
|
</div>
|
|
<div class="accordion-body collapse" id="collapseSSNTwo" style="height: 0px;">
|
|
<div class="accordion-inner">
|
|
<p class="desc">
|
|
The Railsgoat application stores user's Social Security Numbers in plain-text within the database and because of this, it fails to adequately protect these numbers from theft. Additionally, the user's full SSN is sent back to the user within an HTTP response from the application.
|
|
</p>
|
|
<p class="desc">
|
|
The WorkInfo model (app/models/work_info.rb) is missing code to encrypt this data prior to storage. Additionally, while code exists to render only the last 4 numbers of an SSN, at no time is it used.
|
|
</p>
|
|
<pre class="ruby">
|
|
class WorkInfo < ActiveRecord::Base
|
|
attr_accessible :DoB, :SSN, :bonuses, :income, :years_worked
|
|
belongs_to :user
|
|
|
|
# We should probably use this
|
|
def last_four
|
|
"***-**-" << self.SSN[-4,4]
|
|
end
|
|
|
|
end
|
|
|
|
</pre>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="accordion-group">
|
|
<div class="accordion-heading">
|
|
<a href="#collapseSSNThree" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
|
<i class="icon-lightning icon-white">
|
|
</i>
|
|
Solution
|
|
</a>
|
|
</div>
|
|
<div class="accordion-body collapse" id="collapseSSNThree" style="height: 0px;">
|
|
<div class="accordion-inner">
|
|
<p><b>SSN Storage - SOLUTION</b></p>
|
|
<p class="desc">
|
|
There is a lot of guidance on adequately protecting sensitive data at rest and using a layered defensive approach. Make no mistake, this should not be your sole means of securing sensitive data. That being said, there are at least four precautions that should be taken.
|
|
<li>The sensitive data is encrypted everywhere, including backups</li>
|
|
<li>Only authorized users can access decrypted copies of the data </li>
|
|
<li>Use a strong algorithm</li>
|
|
<li>Strong key is generated, protected from unauthorized access, and key change is planned for.</li><br/>
|
|
One additional item to note with rails specifically, the framework makes it easy to determine the type of environment running, example:
|
|
<pre class="ruby">
|
|
Rails.env.production?
|
|
</pre>
|
|
...or
|
|
<pre class="ruby">
|
|
Rails.env.development?
|
|
</pre>
|
|
This allows developers to easily create different keys for development and production and should be considered an asset to utilize. While development keys are usually stored within the source code of most rails applications, and developers with access to the repo can download those keys, the same should NOT hold true for production keys.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="accordion-group">
|
|
<div class="accordion-heading">
|
|
<a style="background-color: rgb(181, 121, 158)" href="#collapseSSNFour" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
|
<i class="icon-aid icon-white">
|
|
</i>
|
|
Hint
|
|
</a>
|
|
</div>
|
|
<div class="accordion-body collapse" id="collapseSSNFour" style="height: 0px;">
|
|
<div class="accordion-inner">
|
|
My SSN seems pretty important, hope it's kept safe!
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div> |