Escape Security Flaws

Rate this content
Bookmark

An elevator pitch for security - yay! I know, security is often frustrating or even annoying. But we all work in tech and at some point, security always becomes a topic. Let's discover a real-world security flaw and what we can learn from it to prevent such incidents. It's gonna be fun, I promise. 

This talk has been presented at React Day Berlin 2023, check out the latest edition of this React Conference.

Watch video on a separate page

FAQ

The speaker is Hendrik.

Hendrik addresses web security in his talk.

Hendrik describes an incident where he accidentally accessed private photos from an escape room experience due to weak security measures.

The security flaw was a weak five-digit numeric code used to protect the photos, which could be easily bypassed with a script.

The escape room company implemented throttling and blocked access to all photos, improving the security of their service.

Hendrik shares his experience to inspire others to challenge design decisions and improve web security.

Hendrik uses the analogy of a cat learning to use a door handle to explain how easily the security flaw could be exploited.

Hendrik suggests using stronger codes, implementing throttling, blocking access to older data, and considering SaaS products for security.

Throttling is a mechanism to limit or block traffic from the same IP address if there is a high volume of requests, helping to prevent attacks.

Hendrik hopes to inspire others to ask critical questions and make better design decisions to enhance web security.

Henrik Fricke
Henrik Fricke
7 min
08 Dec, 2023

Comments

Sign in or register to post your comment.
Video Summary and Transcription
The Talk discusses web security and the importance of strong code protection. It highlights a vulnerability where a weak five-digit numeric code was used, allowing easy access to sensitive content. The speaker emphasizes the need for throttling as a mechanism to prevent attacks. The company implemented throttling and blocked access to photos to improve security. However, stronger code and additional measures, such as limiting access to specific IP addresses and timeframes, are still needed.
Available in Español: Escapar de los fallos de seguridad

1. Introduction to Web Security

Short description:

Hello, my name is Hendrik. Today, I want to talk about web security. I accidentally got access to some spicy content due to weak code protection. A five-digit numeric code was used, making it easy to generate codes. Throttling is an important mechanism to prevent attacks, but it wasn't implemented.

So, hello, my name is Hendrik. And before I start, I need to disappoint you just a little bit because I won't talk about React today. And even worse, I want to talk about web security. So I hope you can enjoy my talk.

So I want to tell a story or share a story with you where I accidentally, and I promise accidentally got access to some pretty spicy content of like photos where people showed off posts with sex toys or even consumed alcohol. So what has happened? Well, back in October 2022, I visited an escape room with some friends. And so after the experience, the staff member came to us and did a group photo.

So in our case, it was just a boring group photo. And so after that, they gave us a little piece of paper that looked like that. And so on the piece of paper, there was our randomly generated code as well as the date of the experience, right? So the experience was super handy. So you would just go on the website, enter your code and boom, you can find the photos you can easily access and loan them and share with your friends. So great user experience. What could possibly go wrong here?

Well, it's like maybe similar to the cat, right? So imagine you have a room and you want to protect the room. So the solution is, well, you just close the door and your room is safe, right? Until the cat understands how to use the door handle. So coming back to my story, basically, I was the cat and I was playing around with the door handle and see how it works. So it turns out, actually, they used a pretty weak code to protect the photos, right? So it was a five digit numeric code, meaning we had only 90,000 possible codes per day. And I'm pretty sure every one of you could easily write a script to generate codes. And so the only thing you have to do is you just write another script and submitting the form over and over and over again, and just hoping you would find an actual code. Yeah, maybe that's what I did. And it turns out it works. And so just as a quick comparison, you can see it here on the table. If you would just use a six digit numeric code, you would already increase the complexity to 900,000 codes. And for me, it's always like, think about it. If you would sit in our product design meeting, at some point you have to decide, okay, what kind of code are we going to use? And they chose a five digit numeric one. Just imagine they would have chosen the six digit or even included alphanumeric, they would have increased the complexity quite a lot.

So even if you have like the strongest code on earth, if you give me enough compute, probably money and time, I could still try my best to find random codes. So another mechanism we need in place is throttling. So throttling means if you get a lot of traffic coming from the same IP address, you probably at some point want to limit the traffic or block the IP address completely. And that's a pretty strong mechanism to prevent attacks. And so guess what? They didn't implement any throttling.

2. Improving Security Measures

Short description:

There was no door or door handle, making the room easily accessible. After discovering sensitive content, I shared my findings with the company. They implemented throttling and blocked access to photos, improving security. However, stronger code is still needed. Traffic must now come from different IP addresses and access to photos is limited to a specific timeframe.

So basically, that means there was no door, there was no door handle, basically the room was open and I could just break in without any problems. Well, it was aboard me on a Sunday and I realized, oh, hell, it's actually serious here. And also I mentioned that I found some spicy content because, that's because they also have a so-called party escape room experience where you can have some intimate private moments with your friends. And basically with the rest of the world, right? So I was like, okay, I need to share my findings somehow with the company. And so that's what I did. And a couple of weeks later, they reacted. And so at least they implemented throttling and also blocked access to all the photos. So they improved the security a little bit. Still, I would still suggest to implement stronger code, but at least it's now harder to attack the service because now the traffic would need to come from different IP addresses. And also you can only get access to the photos from the last 14 days, 7 days, I don't know the exact number. So they definitely improved it.

Check out more articles and videos

We constantly think of articles and videos that might spark Git people interest / skill us up or help building a stellar career

It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder
Node Congress 2022Node Congress 2022
26 min
It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder
Top Content
The talk discusses the importance of supply chain security in the open source ecosystem, highlighting the risks of relying on open source code without proper code review. It explores the trend of supply chain attacks and the need for a new approach to detect and block malicious dependencies. The talk also introduces Socket, a tool that assesses the security of packages and provides automation and analysis to protect against malware and supply chain attacks. It emphasizes the need to prioritize security in software development and offers insights into potential solutions such as realms and Deno's command line flags.
The State of Passwordless Auth on the Web
JSNation 2023JSNation 2023
30 min
The State of Passwordless Auth on the Web
Passwords are terrible and easily hacked, with most people not using password managers. The credential management API and autocomplete attribute can improve user experience and security. Two-factor authentication enhances security but regresses user experience. Passkeys offer a seamless and secure login experience, but browser support may be limited. Recommendations include detecting Passkey support and offering fallbacks to passwords and two-factor authentication.
5 Ways You Could Have Hacked Node.js
JSNation 2023JSNation 2023
22 min
5 Ways You Could Have Hacked Node.js
Top Content
The Node.js security team is responsible for addressing vulnerabilities and receives reports through HackerOne. The Talk discusses various hacking techniques, including DLL injections and DNS rebinding attacks. It also highlights Node.js security vulnerabilities such as HTTP request smuggling and certification validation. The importance of using HTTP proxy tunneling and the experimental permission model in Node.js 20 is emphasized. NearForm, a company specializing in Node.js, offers services for scaling and improving security.
Content Security Policy with Next.js: Leveling Up your Website's Security
React Summit US 2023React Summit US 2023
9 min
Content Security Policy with Next.js: Leveling Up your Website's Security
Top Content
Watch video: Content Security Policy with Next.js: Leveling Up your Website's Security
Lucas Estevão, a Principal UI Engineer and Technical Manager at Avenue Code, discusses how to implement Content Security Policy (CSP) with Next.js to enhance website security. He explains that CSP is a security layer that protects against cross-site scripting and data injection attacks by restricting browser functionality. The talk covers adding CSP to an XJS application using meta tags or headers, and demonstrates the use of the 'nonce' attribute for allowing inline scripts securely. Estevão also highlights the importance of using content security reports to identify and improve application security.
Let Me Show You How React Applications Get Hacked in the Real-World
React Advanced 2021React Advanced 2021
22 min
Let Me Show You How React Applications Get Hacked in the Real-World
Top Content
React's default security against XSS vulnerabilities, exploring and fixing XSS vulnerabilities in React, exploring control characters and security issues, exploring an alternative solution for JSON parsing, and exploring JSON input and third-party dependencies.
How React Applications Get Hacked in the Real-World
React Summit 2022React Summit 2022
7 min
How React Applications Get Hacked in the Real-World
How to hack a RealWorld live React application in seven minutes. Tips, best practices, and pitfalls when writing React code. XSS and cross-site scripting in React. React's secure by default, but not always. The first thing to discover: adding a link to a React application. React code vulnerability: cross-site scripting with Twitter link. React doesn't sanitize or output H ref attributes. Fix attempts: detect JavaScript, use dummy hashtag, transition to lowercase. Control corrector exploit. Best practices: avoid denialist approach, sanitize user inputs. React's lack of sanitization and output encoding for user inputs. Exploring XSS vulnerabilities and the need to pretty print JSON. The React JSON pretty package and its potential XSS risks. The importance of context encoding and secure coding practices.

Workshops on related topic

0 to Auth in an hour with ReactJS
React Summit 2023React Summit 2023
56 min
0 to Auth in an hour with ReactJS
WorkshopFree
Kevin Gao
Kevin Gao
Passwordless authentication may seem complex, but it is simple to add it to any app using the right tool. There are multiple alternatives that are much better than passwords to identify and authenticate your users - including SSO, SAML, OAuth, Magic Links, One-Time Passwords, and Authenticator Apps.
While addressing security aspects and avoiding common pitfalls, we will enhance a full-stack JS application (Node.js backend + React frontend) to authenticate users with OAuth (social login) and One Time Passwords (email), including:- User authentication - Managing user interactions, returning session / refresh JWTs- Session management and validation - Storing the session securely for subsequent client requests, validating / refreshing sessions- Basic Authorization - extracting and validating claims from the session token JWT and handling authorization in backend flows
At the end of the workshop, we will also touch other approaches of authentication implementation with Descope - using frontend or backend SDKs.
OWASP Top Ten Security Vulnerabilities in Node.js
JSNation 2024JSNation 2024
97 min
OWASP Top Ten Security Vulnerabilities in Node.js
Workshop
Marco Ippolito
Marco Ippolito
In this workshop, we'll cover the top 10 most common vulnerabilities and critical security risks identified by OWASP, which is a trusted authority in Web Application Security.During the workshop, you will learn how to prevent these vulnerabilities and develop the ability to recognize them in web applications.The workshop includes 10 code challenges that represent each of the OWASP's most common vulnerabilities. There will be given hints to help solve the vulnerabilities and pass the tests.The trainer will also provide detailed explanations, slides, and real-life examples in Node.js to help understand the problems better. Additionally, you'll gain insights from a Node.js Maintainer who will share how they manage security within a large project.It's suitable for Node.js Developers of all skill levels, from beginners to experts, it requires a general knowledge of web application and JavaScript.
Table of contents:- Broken Access Control- Cryptographic Failures- Injection- Insecure Design- Security Misconfiguration- Vulnerable and Outdated Components- Identification and Authentication Failures- Software and Data Integrity Failures- Security Logging and Monitoring Failures- Server-Side Request Forgery
How to Build Front-End Access Control with NFTs
JSNation 2024JSNation 2024
88 min
How to Build Front-End Access Control with NFTs
WorkshopFree
Solange Gueiros
Solange Gueiros
Understand the fundamentals of NFT technology and its application in bolstering web security. Through practical demonstrations and hands-on exercises, attendees will learn how to seamlessly integrate NFT-based access control mechanisms into their front-end development projects.
Finding, Hacking and fixing your NodeJS Vulnerabilities with Snyk
JSNation 2022JSNation 2022
99 min
Finding, Hacking and fixing your NodeJS Vulnerabilities with Snyk
WorkshopFree
Matthew Salmon
Matthew Salmon
npm and security, how much do you know about your dependencies?Hack-along, live hacking of a vulnerable Node app https://github.com/snyk-labs/nodejs-goof, Vulnerabilities from both Open source and written code. Encouraged to download the application and hack along with us.Fixing the issues and an introduction to Snyk with a demo.Open questions.
Bring Code Quality and Security to your CI/CD pipeline
DevOps.js Conf 2022DevOps.js Conf 2022
76 min
Bring Code Quality and Security to your CI/CD pipeline
WorkshopFree
Elena Vilchik
Elena Vilchik
In this workshop we will go through all the aspects and stages when integrating your project into Code Quality and Security Ecosystem. We will take a simple web-application as a starting point and create a CI pipeline triggering code quality monitoring for it. We will do a full development cycle starting from coding in the IDE and opening a Pull Request and I will show you how you can control the quality at those stages. At the end of the workshop you will be ready to enable such integration for your own projects.
Passwordless Auth to Servers: hands on with ASA
DevOps.js Conf 2022DevOps.js Conf 2022
32 min
Passwordless Auth to Servers: hands on with ASA
WorkshopFree
E. Dunham
E. Dunham
These days, you don't need a separate password for every website you log into. Yet thanks to tech debt and tradition, many DevOps professionals are still wrangling a host of SSH keys to access the servers where we sometimes need to be. With modern OAuth, a single login and second factor to prove your identity are enough to securely get you into every service that you're authorized to access. What if SSHing into servers was that easy? In this workshop, we'll use Okta's Advanced Server Access tool (formerly ScaleFT) to experience one way that the dream of sending SSH keys the way of the password has been realized.
- we'll discuss how ASA works and when it's the right tool for the job- we'll walk through setting up a free trial Okta account to use ASA from, and configuring the ASA gateway and server on Linux servers- we'll then SSH into our hosts with the ASA clients without needing to supply an SSH key from our laptops- we'll review the audit logs of our SSH sessions to examine what commands were run