% This file (c) copyright Sander Bos, 2013.
%
% License of this file: CC BY-NC-SA 3.0
% <https://creativecommons.org/licenses/by-nc-sa/3.0/>.
%
% This file holds the source for slides used in a talk held by Sander Bos
% at the FrOSCon 2013 conference <https://www.froscon.de/>
% on August 25th, 2013, in Sankt Augustin (near Bonn), Germany.
%
% The PDF slides as shown on beamer in the talk are licensed equally to this file.
% However, all other talk content, i.e., the talk as a whole
% (and, therewith, the FrOSCon organization's recording of it)
% is NOT necessarily, and NOT automatically,
% licensed equally to this file or to the slides;
% in fact, as noted below, its license is CC BY-NC-ND 3.0.
%
% In all cases, all content and work is (c) copyright Sander Bos, 2013.
%
% This file is based on the generic-ornate-15min-45min.en.tex file
% from the latex-beamer package, copyright Till Tantau,
% and used as allowed by its license.
%
% Quick, but not double checked, Debian PDF build instructions for this file:
% install the `texlive', `latex-beamer', and `latex-mk' packages,
% then run "latex-mk --pdflatex sander_bos_securing_froscon_froscon_2013.tex".



\documentclass{beamer}

\mode<presentation>
{
  \usetheme{Warsaw}

  \setbeamercovered{transparent}
}

\usepackage[english]{babel}

\usepackage[latin1]{inputenc}

\title
  {Securing FrOSCon}
\subtitle
  {How one conference's talk proposal led to securing conferences across the globe}

\author
  {Sander Bos}

\date
  {August 25th, 2013 \\
   FrOSCon 2013 \\
   Sankt Augustin, Germany}

\subject{Talks}

\AtBeginSection[]
{
  \begin{frame}<beamer>{Outline}
    \tableofcontents[currentsection,currentsubsection]
  \end{frame}
}

\AtBeginSubsection[]
{
  \begin{frame}<beamer>{Outline}
    \tableofcontents[currentsection,currentsubsection]
  \end{frame}
}

\begin{document}

\begin{frame}
  \titlepage
\end{frame}

\begin{frame}{Outline}
  \tableofcontents
\end{frame}

\section{Introduction}

\begin{frame}{Speaker introduction}
  \begin{itemize}
    \item
      Sander Bos
    \item
      Unix, free software
    \item
      System administration, security, talks
    \item
      NetBSD Security Advisory 2013-008 (OHM2013 talk)
      % SA: http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2013-008.txt.asc
  \end{itemize}
\end{frame}

\begin{frame}{Talk introduction}
  \begin{itemize}
    \item
      Fixing OHM2013 conference
    \item
      Fixing other conferences
    \item
      Sharing knowledge, spreading awareness
    \item
      Better securing FrOSCon / frab
  \end{itemize}
\end{frame}

\begin{frame}{Copyright, Licensing, Recording}
  \begin{itemize}
    \item
      Copyright: Sander Bos
    \item
      Slides and slide sources: CC BY-NC-SA 3.0
      % https://creativecommons.org/licenses/by-nc-sa/3.0
    \item
      Other talk content, FrOSCon recording: CC BY-NC-ND 3.0
    \begin{itemize}
      \item
      https://creativecommons.org/licenses/by-nc-nd/3.0
    \end{itemize}
    \item
      Other recordings: requested not to be made
  \end{itemize}
\end{frame}

\begin{frame}{Relicensing?  No.}
  \begin{itemize}
    \item
      Relicensing: disallowed by copyright nature...
    \begin{itemize}
      \item
        No uploading to YouTube, Vimeo, ...
      \item
        Viewing this there?  Please use legitimate source instead, e.g., ccc.de
      \item
        Commercial usage is license infringement on itself
    \end{itemize}
    \item
      Please respect people's privacy, also concerning talk recordings
  \end{itemize}
\end{frame}

\section{Main}

\subsection{Where the journey started}

\begin{frame}{OHM2013 CfP Submittal Issues}
  \begin{itemize}
    \item
      CfP server (``frab'') down; how to log out?
    \item
      Full session state in cookie; delete it
    \item
      Decoding cookie for fun, seeing it's signed
    \item
      Secret signing tokens are at times in RCS...
  \end{itemize}
\end{frame}

\begin{frame}{Hacking A Conference, Unintentionally}
  \begin{itemize}
    \item
      OHM2013 secret token on GitHub: config/initializers/secret\_token.rb
      % OHM2013 frab repository: https://github.com/ohm2013/frab
    \item
      Abuse: theory, test, practice
    \item
      Affected: upstream, OHM2013, FrOSCon, FOSSCON
      % Conference Web sites: https://ohm2013.org/, http://fosscon.org/
    \item
      At risk or also affected: FOSDEM, BSDCan, PGCon, possibly others
      % Sites: https://www.fosdem.org/, https://www.bsdcan.org/, https://www.pgcon.org/
  \end{itemize}
\end{frame}

\begin{frame}{Other Security Issues Encountered}
  \begin{itemize}
    \item
      HTTPS to HTTP redirects
    \begin{itemize}
      \item
        Due to network setup
    \end{itemize}
    \item
      Insecure cookies
    \begin{itemize}
      \item
        Transmitted over HTTP
    \end{itemize}
    \item
      Getting things fixed
    \begin{itemize}
      \item
        Real quick action (good!)
    \end{itemize}
  \end{itemize}
\end{frame}

\subsection{The conference hack}

\begin{frame}{Overview}
  \begin{itemize}
    \item
      Login to server, receive cookie
    \begin{itemize}
      \item
        Note that no existing account is actually needed
    \end{itemize}
    \item
      Export cookie from browser
    \item
      Manipulate cookie using Ruby (decode, edit, recode, re-sign)
    \item
      Import cookie back into browser
    \item
      Connect to server: cookie will be accepted
  \end{itemize}
\end{frame}

\begin{frame}{Impact}
  \begin{itemize}
    \item
      Changing or inserting ``flash'' messages
    \begin{itemize}
      \item
        Quite harmless, but fun
    \end{itemize}
    \item
      Changing user ID
    \begin{itemize}
      \item
        Works for admin as well
    \end{itemize}
    \item
      Remote command execution
    \begin{itemize}
    \item
      Work of Charlie Somerville; pointed out by ``joernchen'' on frab GitHub
      % See: https://charlie.bz/blog/rails-3.2.10-remote-code-execution
    \end{itemize}
  \end{itemize}
\end{frame}

\begin{frame}{Exploit demonstration}
\end{frame}

\subsection{Securing FrOSCon (frab)}

\begin{frame}{Fixed}
  \begin{itemize}
    \item
       Secret token
    \item
       Secure cookies
    \item
       Change client side to server side storage
  \end{itemize}
\end{frame}

\begin{frame}{Suggestions / todo}
  \begin{itemize}
    \item
       No plain text passwords in database
    \item
       Secure password change form
    \item
       Don't let frab confirmation URLs log you in
    %
    % As another possible list item here, session fixation appeared
    % to be possible in at least one situation,
    % but this was not fully tested, so not made part of the talk
    %
    \item
       Remove froscon/frab GitHub repository (done, and wasn't FrOSCon's!)
       % We're talking https://github.com/froscon/frab here and,
       % despite its name, indeed wasn't actually used by FrOSCon
    \item
       Open up actual frab repository (or use upstream?)
    \item
       frab 1.0 release, with clear release notes
    \item
       Web site: fix TYPO3 / Web server HTTPS to HTTP redirects
  \end{itemize}
\end{frame}

\section{What can we learn from this?}

\begin{frame}{General Advice}
  \begin{itemize}
    \item
      Secure things from the start (opt-out, not opt-in)
    \begin{itemize}
      \item
        Source code, server installation, application configuration
    \end{itemize}
    \item
      No secrets in public source repositories (passwords found as well)
    \item
      Use of SSL (correctly), secure cookies, HSTS, check site redirects
    \item
      Critical fix: new release, clear notes along with it, SA, perhaps CVE, alert users actively
    \item
      Double check changes (Apache restart, deployment failure, ...)
  \end{itemize}
\end{frame}

\begin{frame}{Forking side effects}
  \begin{itemize}
    \item
      Bugs and vulnerabilities included for free
    \item
      Things fixed differently at places
    \item
      Projects diverge in ways not intended, resulting in less security
    \item
      The main project isn't improved as much as it could
  \end{itemize}
\end{frame}

\begin{frame}{Forking Revisited}
  \begin{itemize}
    \item
       Only fork when needed, not ``because it's possible''
    \item
       If you do fork, follow upstream's commits
    \item
       If you do fork, send critical patches upstream
    \item
       Public forks for bug reports may cause bit rot
    \item
       frab secret token issue still survives today...?
  \end{itemize}
\end{frame}

\section{Conclusion}

\begin{frame}{Summary}
  \begin{itemize}
    \item
      Web security can easily go wrong, even with the experts
    \item
      Old mistakes keep being repeated
    \begin{itemize}
      \item
        Lack of SSL, SSL errors, insecure cookies, redirect errors, secrets in RCS, ...
    \end{itemize}
   \item
     We \emph{really} need to, but also \emph{can}, do better
   \item
     Hope this talk helps with that respect
  \end{itemize}
\end{frame}

\begin{frame}
  \begin{itemize}
    \item
      frab (upstream): https://github.com/frab/frab
    \item
      Thanks to: FrOSCon, Peter Bex, FrOSCon Lisp subconference, you (the audience)
    \item
      Questions / comments?
  \end{itemize}
\end{frame}

\end{document}
