Slashdot Mirror
Ruby On Rails Exploit Used To Build IRC Botnet
Trailrunner7 writes "Developers who have not updated their Ruby on Rails installations with a five-month-old security patch would do well to secure the Web development framework now. Exploit code has surfaced for CVE-2013-0156 that is being used to build a botnet of compromised servers. Exploit code has been publicly available since the vulnerability was disclosed in January on Github and Metasploit, yet the vulnerability had not been exploited on a large scale until now, said security researcher Jeff Jarmoc."
One reason your web server firewall might want to block IRC connections to arbitrary hosts.
what the heck IS ruby on rails? is it two separate things, or one thing? is it like PHP or CSS? I'm bewildered by the technological change on the web. not that I did not say technological advancement, just technological change.
Fix is here.
http://www.asp.net/
From TFA:
There’s no authentication performed, so an enterprising individual could hijack these bots fairly easily by joining the IRC server and issuing the appropriate commands.
So, basically we could take control of theses servers and force them to update to the newest version of rails?
Its a poorly designed flavour of the month language with a poorly designed API intended for web use all wrapped up in a stupid alliterative name
No. And quite a few good reasons to block them.
That said, most webservers have no firewall to speak of in front of them and are run by "administrators" who don't even know how to configure the hosts's software firewall properly to block unwanted traffic (or on shared hosting where the host has no interest in the complexities of managing the software firewall for multiple users).
until someone makes a Bitcoin farming botnet out of all these Ruby on Rails hosts?
That's a damned good point...I wish someone would pop in here and give us some of the secret inner workings of the HOSTS file...
It's a locomotive-driven precious stone.
/* No Comment */
Yeah, took a while to get rid of the plague in the Middle Ages as well, didn't it?
I am being forced to learn RoR as part of my job. Should I shoot myself?
"Its a poorly designed flavour of the month language with a poorly designed API intended for web use all wrapped up in a stupid alliterative name"
It's a well-designed and successful framework that has been in mainstream use now for around 10 years.
This "vulnerability" only applies to applications in which the developers did not alter the default value of a cryptographic key, as they are supposed to do. It's roughly the equivalent of leaving your house key in the front door lock.
Why the framework has been catching so much flak over what is actually a developer issue is beyond my understanding. There are, and have been, clear plain-English instructions that the value of that key should be changed for every new application you create.
You blame users for not changing the default password (cryptographic key) on their WiFi router... you don't blame the router manufacturer. So why fault this framework because some people didn't change the default "password"??? Makes no sense.
Ruby is a programming language. The "Rails" part of Ruby on Rails is a framework. It's roughly equivalent to the difference between C# and .NET.
(1) Rails and Ruby was virtually unheard of until 2007-2008 and definitely was not in mainstream use until that time.
(2) This vulnerability has nothing to do with "cryptographic key"; it is related to the fact that default YAML parser allows serializing/deserializing and executing arbitrary Ruby code (including objects) and ActiveSupport didn't properly sanitize the input.
"(1) Rails and Ruby was virtually unheard of until 2007-2008 and definitely was not in mainstream use until that time."
That's pretty funny. I got my degree in Web development in 2005, and we had been studying it for a year. I then went to work for a company that had similarly been using it in production for about a year.
"(2) This vulnerability has nothing to do with "cryptographic key"; it is related to the fact that default YAML parser allows serializing/deserializing and executing arbitrary Ruby code (including objects) and ActiveSupport didn't properly sanitize the input."
Yes, it does. The vulnerability does not exist if the key for the authentication token is not changed from the default.