Skip to main content

Security controls bypass or absence - Reversing Protection

Need​

Implementation of robust anti-reverse engineering protections

Context​

  • Usage of Ruby for building dynamic and object-oriented applications
  • Usage of Ruby on Rails framework for web application development

Description​

Non compliant code​

class UsersController < ApplicationController
  def login
    user = User.find_by(name: params[:name])
    if user && user.authenticate(params[:password])
      session[:user_id] = user.id
      redirect_to root_url, notice: "Logged in!"
    else
      flash.now.alert = "Name or password is invalid"
      render "new"
    end
  end
end

This code is a simple login function in a Ruby on Rails application. The function login in UsersController takes in parameters for name and password from the user input.

When the user submits the login form, the login function is called. It looks up the user by the submitted name using User.find_by(name: params[:name]). If a user with the submitted name is found and the submitted password is correct (checked by user.authenticate(params[:password])), the user's id is stored in the session (session[:user_id] = user.id) and the user is redirected to the root URL with a success message.

However, this code is vulnerable to reverse engineering because it does not implement any anti-reverse engineering protections. A sophisticated attacker could use reverse engineering tools and techniques to understand the login process, bypass the login function, or even extract sensitive data like user credentials.

For instance, the password authentication is done directly in the controller, and the password is sent in plaintext from the client to the server. This could be intercepted and reverse engineered.

Moreover, sensitive operations like user authentication should not be implemented directly in the controller. They should be encapsulated in service objects or model methods, which would make it harder for an attacker to reverse engineer the authentication process.

Lastly, the code does not implement any form of rate limiting or account lockout after a certain number of failed login attempts. This makes it easier for an attacker to perform a brute force attack by trying many different passwords until they find the correct one.

Steps​

  • Implement anti-reverse engineering protections in the application
  • Use obfuscation techniques to make the code harder to reverse engineer
  • Apply code encryption to protect sensitive information
  • Implement tamper detection mechanisms to detect and prevent reverse engineering attempts
  • Use code signing to ensure the integrity and authenticity of the code
  • Regularly update and patch the application to address any known vulnerabilities
  • Conduct regular security assessments and penetration testing to identify and fix any security weaknesses
  • Educate developers about secure coding practices and the importance of implementing reverse engineering protections

Compliant code​

require 'ruby-obfuscator'

class UsersController < ApplicationController
  def login
    user = User.find_by(name: params[:name])
    if user && user.authenticate(params[:password])
      session[:user_id] = user.id
      redirect_to root_url, notice: "Logged in!"
    else
      flash.now.alert = "Name or password is invalid"
      render "new"
    end
  end
end

# Obfuscate the code
obfuscated_code = RubyObfuscator.obfuscate(File.read('users_controller.rb'))
File.open('users_controller.rb', 'w') { |file| file.write(obfuscated_code) }

The updated code includes the use of the 'ruby-obfuscator' gem, which is a tool that obfuscates Ruby code to make it harder to reverse engineer. The obfuscation process transforms the code into an equivalent, but harder to understand version. This makes it more difficult for attackers to understand the code's logic and find vulnerabilities.

The 'ruby-obfuscator' gem is used to obfuscate the UsersController code. The obfuscated code is then written back to the 'users_controller.rb' file.

Please note that obfuscation is not a foolproof method of preventing reverse engineering. It is just one layer of security that can be used in conjunction with other methods such as code encryption, tamper detection, code signing, regular updates and patches, security assessments, penetration testing, and developer education.

Also, remember to add 'ruby-obfuscator' to your Gemfile and run bundle install to ensure the gem is installed in your application.

gem 'ruby-obfuscator'

This is a basic example of how to implement code obfuscation in a Ruby on Rails application. Depending on the complexity and specific requirements of your application, you may need to implement additional or different reverse engineering protections.

References​

Last updated on