Tales from the Crypt
summary
A contrived Rails app shows concrete failures and fixes: a rollback to reenable CSRF protection after a Doge site triggers unauthorized orders, leaking up to ~20 large purchases; JSON endpoints expose decrypted card fields until output is restricted; missing strong parameters enables mass assignment that combines with a newline to produce a Sequel injection extracting emails and MD5 password hashes; remediation includes scoped queries to current_user, password resets, and running Brakeman in CI plus bundler audit and dynamic scans.
AI-written summary · about
chapters (26)
- 0:00Welcome
- 1:04Security breach chaos
- 2:56Order surge debugging
- 4:42XSS attack discovery
- 6:06CSRF token bypass
- 7:12Credit card fraud
- 8:14Order data exposure risks
- 9:38JSON endpoint vulnerabilities
- 11:02Password leak alerts
- 12:05Database access concerns
- 13:11Firewall and log discrepancies
- 14:16SQL injection via mass assignment
- 16:27Full attack chain
- 18:17Disastrous day reflection
- 19:23What went wrong
- 20:26Preventing breaches
- 21:51Speaker introductions
- 22:32Security incidents lessons
- 23:56Q&A and recommendations
- 26:23Monitoring strategies
- 27:48Vulnerability tracking
- 29:13Prioritizing security issues
- 31:00Security vs business needs
- 31:43Rails security misconceptions
- 32:46Keeping Rails updated
- 33:48Closing remarks
