Slashdot Mirror

← Back to Stories (view on slashdot.org)

MIT Bug Finder Uncovers Flaws In Web Apps In 64 Seconds (csoonline.com)

Posted by BeauHD on from the record-time dept.

itwbennett quotes a report from CSO: A new tool from MIT exploits some of the idiosyncrasies in the Ruby on Rails programming framework to quickly uncover new ones, writes Katherine Noyes. In tests on 50 popular web applications written using Ruby on Rails, the system found 23 previously undiagnosed security flaws, and it took no more than 64 seconds to analyze any given program. Ruby on Rails is distinguished from other frameworks because it defines even its most basic operations in libraries. MIT's researchers took advantage of that fact by rewriting those libraries so that the operations defined in them describe their own behavior in a logical language.

24 comments

  1. Bug Bounties by Anonymous Coward · · Score: 0

    Quick, everyone! Use this tool and collect bug bounties before they're all gone.

  2. Looks like Perls NYTProf by Anonymous Coward · · Score: 1

    From what I can tell, it seems like it might be something like a code analysis tool that swapped in a logger to profile methods called along with some metadata (time spent in subroutine, etc).

    http://open.blogs.nytimes.com/2008/03/05/the-new-york-times-perl-profiler/?_r=0

    BUT ON AN APP!
    or am i missing something?

    1. Re:Looks like Perls NYTProf by Anonymous Coward · · Score: 2, Informative

      It seems that you can read more about it here:
      http://news.mit.edu/2016/patching-web-applications-0415
      It mentions that it was done by professor Daniel Jackson and postdoc Joseph Near. Joseph Near seems to have page here:
      http://www.cs.berkeley.edu/~jnear/
      Under software you can find "Derailer" and "Rubicon" (but not "Space) and under theses you can find this PhD:
      http://dspace.mit.edu/handle/1721.1/99841
      A short overview of the three pieces of software is given on page 15

  3. Useful for debugging, not for attack by Anonymous Coward · · Score: 0

    MIT's researchers took advantage of that fact by rewriting those libraries so that the operations defined in them describe their own behavior in a logical language.

    The summary seems to imply that this would notify other people of vulnerabilities, but it's actually something that requires full source code access; it sits between your code and the rails library, trying to figure out whether you're doing something problematic or not. Useful to developers, in that it can uncover bugs they added.

  4. Some prominent Rubyists jumped to Rust. by Anonymous Coward · · Score: 0

    One important thing to keep in mind about Rust is that it has attracted some people who were notable Rubyists in the past. They jumped ship when the Ruby on Rails hype started really dying down a few years ago, once more and more people finally clued in and realized that Ruby and Rails are often problematic.

    If prominent Ruby software like Ruby on Rails has this many flaws, why should we believe that Rust, if it's being developed by former Rubyists, won't suffer from similar problems?

    1. Re:Some prominent Rubyists jumped to Rust. by Anonymous Coward · · Score: 1

      Hipsters like hipster languages developed by hipsters.. what a shock.. The rest of us with real work to do use proven tools.

    2. Re:Some prominent Rubyists jumped to Rust. by U2xhc2hkb3QgU3Vja3M · · Score: 2

      Yeah! GW-BASIC, man!

    3. Re:Some prominent Rubyists jumped to Rust. by Anonymous Coward · · Score: 1

      They jumped ship when the Ruby on Rails hype started really dying down

      Good riddance. Rails is a cancer on the Ruby community.

  5. seems obvious by Gravis+Zero · · Score: 3, Funny

    the biggest flaw was that they were written in Ruby on Rails.

    --
    Anons need not reply. Questions end with a question mark.
  6. New Nicolas Cage movie by fabioalcor · · Score: 1

    Gone in 64 seconds.

    1. Re:New Nicolas Cage movie by Anonymous Coward · · Score: 0

      Nic Cage is like corn. Sometimes he's good, but he's been in an awful lot of shit

    2. Re:New Nicolas Cage movie by Anonymous Coward · · Score: 0

      That's because Cage takes roles that are "fun", he doesn't care much about the end result (he can't control the rest of production). He's having fun, and thus ends up in a lot of crappy movies. If you rewatch those crappy movies imagining that he's thinking: "This is great fun", or "I'm having a great time exploring this character", then your respect for Nicolas Cage might go up a bit. I mean, he could easily turn down the role, he's a great actor, but he gives the weaker film a chance because they're fun and might just advance the medium by accident.

      You can never tell if it will be a great movie until it's been made. I applaud Cage for taking risk.

  7. AFTER rewriting the libraries it took seconds! by Anonymous Coward · · Score: 1

    how long did it take to rewrite the libraries?

  8. The Ruby world... by mi · · Score: 4, Insightful

    Many "cool and new" technologies started out with a rather dismissive and arrogant attitude towards predecessors — only to then encounter the same problems as other did before and have to solve them in a hurry, shooting yourself in the same extremity (with the same gun), and stepping on the same rake.

    From my experience, Ruby is especially bad at it. Release 1.9.2 not quite compatible with 1.9.1? What?!

    Published packages ("gems") not signed. Huh?

    So, when I hear about yet another problem in that world, all I can do is shrug...

    --
    In Soviet Washington the swamp drains you.
    1. Re:The Ruby world... by Anonymous Coward · · Score: 0

      Many "cool and new" technologies started out with a rather dismissive and arrogant attitude towards predecessors — only to then encounter the same problems as other did before and have to solve them in a hurry

      You've just summed up 95% of the Ruby community and platforms, especially Rails.

    2. Re:The Ruby world... by Anonymous Coward · · Score: 0

      Published packages ("gems") not signed. Huh?

      Sadly being a PHP developer, I sit here in my chair and watch the Composer takeover and scream silently in my head.

  9. Rust is the new Ruby. by Anonymous Coward · · Score: 0

    You're absolutely right. I think we're seeing the same thing happening with Rust. It's pretty much the new Ruby. So many Rustacean (yes, that is what they prefer to be called, believe it or not) ridicule C++ constantly. Yet we find that Rust isn't any better than C++, and Rust is actually often a whole lot worse! Rust's syntax makes C++'s look nice. Rust's semantics make C++'s easy to comprehend. Rust's standard library makes C++'s look like a work of fine art. Rust's ownership system makes C++'s RAII and smart pointers seem pleasant to use. The kids pushing Rust don't realize that the problems they're "solving" were already solved years, if not decades, ago by C++.

    1. Re:Rust is the new Ruby. by Anonymous Coward · · Score: 0

      Can you give some examples of these problems with Rust by showing some these problems with Rust vs C++ code examples?

      I often see users criticize a programming language when they are only just starting to learn that language or have only skimmed the documentation without properly learning it fully. It is easy to criticize a language with vague arguments. If you have been programming in C++ for 30 years and only been programming in Rust for 1 month, of course C++ would seem better to you. My point is that if you have mastered one language, it is always easy to fall back to that language instead of fully learning a newer language, because you already know how to accomplish everything in the language you mastered, so not only can you accomplish the task you need quicker, you won't run into any unforeseen problems because you already know what to expect from the language and you already know the limitations of that language and how to get around those limitations. It can be frustrating at times learning a new language, but there are times where working through those struggles is worth it.

    2. Re:Rust is the new Ruby. by tigersha · · Score: 4, Funny

      Always the same. CSS today is solving the same layout problems that X11 window managers did 25 years ago.
      And the CSS designers think this is ubercool.

      One of them discovered "Atomic Design" a while ago. http://patternlab.io/about.htm...

      This is a rediscovery of.....modularity! Yeah! Breaking up you work in modules! What a nifty idea!!!

      Something that CS and Programming language design thoroughly explored in the 1960s and 70s but whatever.

      --
      The dangers of excessive individualism are nothing compared to the oppressiveness of excessive collectivism
    3. Re:Rust is the new Ruby. by Spaham · · Score: 2

      Wow, I checked the link, and they indeed reinvented warm water !
      We're probably getting too old for this shyte.

    4. Re:Rust is the new Ruby. by Anonymous Coward · · Score: 1

      Yeah, but the difference is that they published it in a REAL BIG font, on a webpage that has all the text CENTERED, so that is wastes 90% of the realestate in the margins -- which it the totally hipster UX designer way of making websites.

    5. Re:Rust is the new Ruby. by Anonymous Coward · · Score: 0

      My biggest beef with Rust is that it was made by Mozilla which would be fine if they were not arrogantly "choking their chickens" on a bunch of crap instead of fixing the 30,000? (huge number) bugs in Firefox (their main job).

  10. Link? by Anonymous Coward · · Score: 0

    Can't find the tool....

  11. ahh ruby by joss · · Score: 1

    Python and Ruby are similar languages, and yet the cultures around the two are very different. A certain segment of Ruby has moved to node.js now.

    https://www.youtube.com/watch?...

    --
    http://rareformnewmedia.com/