Comments on: Owning Rails 2.0 Cookies at OWASP: Part II

By: b3nn

b3nn — Wed, 21 Nov 2007 13:56:54 +0000

Here’s a link to the rails-core mailing list where this topic is continued.

http://groups.google.com/group/rubyonrails-core/browse_thread/thread/769f64d0f4ad59af

To wrap up where things currently stand: Yes, the brute forcing of the cookie store hash is possible like this script demonstrates (so choose a strong password everyone!) And session replay is also possible (but there’s probably ways to fix that.) We seem to be in disagreement that this should be the default session store choice.

By: Jeremy Kemper

Jeremy Kemper — Wed, 21 Nov 2007 00:17:23 +0000

Correction: the cracker itself does use the HMAC. All the other links are wrong. The concern regarding session secret strength is totally valid. See the discussion on the rails-core mailing list for more.

By: Jeremy Kemper

Jeremy Kemper — Tue, 20 Nov 2007 22:50:48 +0000

I’m sorry to report that you spread FUD at the OWASP conference.

Remove the rev query parameter from the link to the cookie store source, or simply checkout Rails trunk anytime since March 3 2007, and reconsider your claim.

I find this lack of diligence inexcusable when it’s the basis for a talk at a security conference. Please consider correcting this and your earlier post.

There are legitimate concerns with the cookie store, but brute force attacks are not one of them.

By: PhishMe » Owning Rails 2.0 Cookies at OWASP

PhishMe » Owning Rails 2.0 Cookies at OWASP — Mon, 19 Nov 2007 19:16:40 +0000

[...] See the “Part II” post for the BustRailsCookie script. Digg [...]