CS 155

• Project 2:• Setup• Ruby on Rails primer• Tips for part A

• Bitbar

• Ruby on Rails App

• New users get 200 bitbars

• Can transfer bitbarsto other users

Part A: Attacks

Due May 11

Part B: Defenses

Due May 18

• Download VM

• VirtualBox: In Preferences->Network->Host-only Networks, add a new network (vboxnet0) if it doesn’t exist

• Start the VM. • proj2 directory has starter code

Route Map To Controller:bitbar/config/routes.rb

User Controller:bitbar/app/controllers/user_controller.rb

User Profile View:bitbar/app/views/user/profile.html.erb

http://blog.bigbinary.com/2013/03/19/cookies-on-rails.html

”Transfer 10 bitbars to attacker”

Victim’s bitbar cookies sent as auth!Victim logs in to Bitbar

Victim visits attacker website

Attacker’s Profile

User1’s Profile User 2’s Profile

User Bitbars

Attacker 10

User1 50

User2 100

User Bitbars

Attacker 11

User1 49

User2 100

User Bitbars

Attacker 12

User1 49

User2 99

Views

Views