Hacking with Gems
summary
Shows concrete malicious gems: awesome Rails flash messages exfiltrates cleartext emails and passwords to a web service and writes them into public development.log; net_http_detector logs outbound posts and evals remote code to add a DB console giving full ActiveRecord shell; a compiled C extension creates assets.tar.gz of app source; be_truthy runs a rake extension at gem install to steal sudo passwords, enable SSH and create backdoor users. Six installs, ~3.8% adoption; use gem fetch/unpack, Little Snitch, FSEventer, or private gems to detect.
AI-written summary · about
chapters (22)
- 0:00Start
- 2:31what's in my app?
- 5:02development.log
- 6:11show me the hack
- 6:35how it works
- 7:17database what?
- 7:43hello db access!
- 8:07Little Snitch
- 9:12what it claims to do
- 9:55better_date_to_s.bundle
- 10:18behind the curtain
- 11:15truth time
- 11:50what it does
- 12:42file tree looks ok
- 13:30run the what file?
- 14:02there is no Rakefile
- 14:43gem fetch vs gem install
- 15:22the real file tree
- 16:32fseventer
- 19:30back to the truthy_gem
- 21:31being popular sucks
- 24:23usernames
