Hacking With Gems
summary
Demonstrates four malicious gems that actually harvest plaintext passwords from Rails requests, expose a live DB console, exfiltrate source code (attempted but flaky), and enable SSH at gem install while stealing GemCutter credentials to propagate itself; shows this is trivial against a typical app with 39 gem dependencies and that a social-engineering stunt hit ~5% adoption at a conference (eight installs). Uses install‑time hooks, evaled remote code, fake “native extension” messages, and real tools to detect tampering like gem fetch + gem unpack and Little Snitch plus fs_eventer and ships a coleman canary gem to test danger.
AI-written summary · about
chapters (16)
- 0:00Start
- 6:17i like password
- 8:08a one way ticket to
- 9:33how it works
- 10:19database what?
- 11:18Little Snitch
- 11:47profit
- 14:11behind the curtain
- 15:58what it does
- 17:11source code looks good
- 18:03run the what file?
- 19:23gem fetch vs gem install
- 19:49the real file tree
- 24:54back in the be_truthy gem
- 31:22ruby gems goes down
- 37:27on install
