The Paraxial.io Blog

Subscribe to stay up to date on new posts.

Security Vendors and Elixir Support

Michael Lubas, 2024-02-28

Many security vendors claim to support Elixir, yet when setup time comes the results are often disappointing. The chart above lists several common security tools and requirements for securing Elixir code, mapping features to the relevant vendors. Below are notes about how each vendor was assessed. Author contact: michael at this domain.

Continue Reading

Introducing Paraxial.io License Scan

Michael Lubas, 2024-02-14

Paraxial.io can now manage open source license compliance for Elixir applications. If your business regulates which licenses are allowed, or simply requires this information be recorded, Paraxial.io now automates this work. There is a serendipitous feature of this release: a dependency inventory can be obtained at compile time instead of runtime.

Continue Reading

Securing Elixir: The Why and How of Paraxial.io

Michael Lubas, 2024-02-07

When a web application is deployed on the internet, it is immediately going to be attacked. Businesses and organizations that rely on these apps have to safeguard the customer information and financial transactions flowing through them every day. Data breaches are a financial and legal nightmare that can be prevented.

Continue Reading

Secure Asset Management in Elixir with Paraxial.io

Michael Lubas, 2024-01-24

In March 2017 an important security patch for Apache Struts was released, due to a vulnerability with public examples showing how to break into a running server. Apache Struts is to Java what Rails is to Ruby, and Phoenix is to Elixir. Equifax, a major credit bureau, did not have an inventory of every server running Apache Struts, and in May 2017 the highest profile breach ever began with a hacked web server, ending with a $425 million settlement.

Continue Reading

Introducing Paraxial.io Email Reports

Michael Lubas, 2024-01-17

Paraxial.io continuously monitors your Elixir application, ensuring it is safe and free of security vulnerabilities. Today Paraxial.io can now send a weekly summary right to your inbox, keeping you informed on the security of your organization.

Continue Reading

Introducing Paraxial.io Slack Alerts

Michael Lubas, 2024-01-10

Paraxial.io monitors your application 24/7, detecting and blocking attacks. When an exploit attempt fails or a bot attack is blocked, it is a noteworthy event. Someone is attacking your work, and Paraxial.io kept it safe. Today you can now receive a Slack notification when this happens.

Continue Reading

Introducing the Paraxial.io GitHub App

Michael Lubas, 2024-01-03

Modern software development means code changes are pushed into production on a daily basis. A traditional penetration testing engagement provides a snapshot of an application’s security. True security requires automation, where every new change is analyzed.

Continue Reading

Webinar Recording: Introducing Paraxial.io 2.0

Michael Lubas, 2023-12-20

The webinar Introducing Paraxial.io 2.0 is live on the Paraxial.io YouTube channel:

Continue Reading

Introducing Paraxial.io 2.0

Michael Lubas, 2023-12-06

Today Paraxial.io 2.0 is live, delivering major improvements to help you secure your Elixir and Phoenix applications. How many internet facing Elixir apps do you currently have? When was the last time each one received a security scan? How many critical and high vulnerabilities are outstanding? Paraxial.io makes the complex task of understanding your security posture simple.

Continue Reading

Elixir Security Roadmap: A CTO Level Guide

Michael Lubas, 2023-11-15

This document is to help you prevent a data breach due to your Elixir web application being hacked. It covers strategic and technical work that is the most relevant for organizations using Elixir and Phoenix. Get your copy - https://paraxial.io/roadmap

Continue Reading

Elixir Security: A Business and Technical Perspective

Michael Lubas, 2023-11-14

My talk from ElixirConf 2023, Elixir Security: A Business and Technical Perspective, is up on YouTube. There are several security benefits to using Elixir, yet these are not very well known in industry. This talk can be used to introduce Elixir to a broader audience. It also covers techniques for securing your own code.

Continue Reading

Thinking Elixir 173: Web App Security Best Practices and Sobelow

Michael Lubas, 2023-10-18

Thank you to the Thinking Elixir podcast for having me as a guest for Episode 173: Web App Security Best Practices and Sobelow. Listen and make sure to subscribe on your podcast app.

Continue Reading

Elixir Security: Real World Sobelow

Michael Lubas, 2023-10-04

Sobelow is the best static code analysis security tool for Elixir and Phoenix. If you are using Elixir in production today, it is highly recommended that all code is scanned with Sobelow, because it can detect critical vulnerabilities that lead to data breaches. This check is a requirement in many regulated industries, including finance and healthcare. Getting started with Sobelow is easy, using it effectively requires some work. Your first Sobelow scan will likely result in a high number of findings, some of which are false positives. Classifying all these findings is a significant project, daunting enough to stop many businesses from taking full advantage of Sobelow’s power.

Continue Reading

Elixir/Phoenix Web Security Guide Released by EEF

Michael Lubas, 2023-09-21

Web Application Security Best Practices for BEAM Languages is a new document from the Erlang Ecosystem Foundation’s (EEF) Security Working Group, published September 5, 2023. It provides guidance for writing secure web applications with Elixir and Phoenix. The document is hosted on the Security WG site, alongside the Elixir Secure Coding and Deployment Hardening Guidelines. Feedback on this new release is welcome, open an issue or submit a PR via Github.

Continue Reading

Interview with Michael Frew, Owner of Gigalixir

Michael Lubas, 2023-09-12

Gigalixir is a platform as a service created for Elixir and Phoenix. Launched in 2017 by Jesse Shieh, the service is loved by Elixir developers and businesses alike. In December 2021, Michael Frew acquired Gigalixir from Jesse, becoming the new owner and operator.

Continue Reading

Elixir Saves Pinterest $2 Million a Year In Server Costs

Michael Lubas, 2023-08-28

The Elixir programming language is well known in the world of software where uptime is critical to business success. The official description states, “Elixir is a dynamic, functional language for building scalable and maintainable applications.” This is a humble summary of the enormous power Elixir contains, which has saved businesses millions of dollars per year across industries.

Continue Reading

Elixir is (Still) Safe

Michael Lubas, 2023-07-24

In March 2021 Nathan Long published Elixir is Safe, a post about the security benefits of using Elixir, which focused on memory and thread safety. It is an excellent article for programmers and executives about the security benefits of Elixir. In July 2023 I googled “Elixir is Safe”, and the first result was a snippet from the paper, “Vision for a Secure Elixir Ecosystem: An Empirical Study of Vulnerabilities in Elixir Programs”, which was published by the ACM in April 2022.

Continue Reading

Paraxial.io @ ElixirConf 2023

Paraxial.io, 2023-07-17

ElixirConf US 2023 is happening in Orlando, Florida on September 5th. Paraxial.io is excited to be a sponsor, and to provide security for the conference website. Our founder Michael Lubas is speaking and giving a training on Elixir security. Elixir is a fast growing ecosystem, and ElixirConf provides an important venue for developers, business leaders, and people learning Elixir to network and create meaningful connections. Make sure to stop by the Paraxial.io sponsor booth and say hello!

Continue Reading

Inspecting Elixir Dependencies at Runtime for Security

Michael Lubas, 2023-07-05

A common pattern in vulnerability response is that a library has a bad security problem, and you want to check what version is running in production. The syntax of most dependency specification files (including Elixir’s mix.exs) means the exact version running cannot be determined from the file alone. Consider a library where 2.0.3 is not vulnerable, but 2.0.4 is. The project’s mix file has "~> 2.0.0", meaning ">= 2.0.0 and < 2.1.0". The reply to “Are we vulnerable right now?” is an uncomfortable “Maybe, there’s not enough information here”.

Continue Reading

How to Learn Elixir Security, Curiosum Meetup Talk

Michael Lubas, 2023-06-20

Security is critical for businesses using Elixir in production. There are many resources available to learn more about Elixir security, however it can be difficult to decide where to start. Learn more about this important topic by watching How to Learn Elixir Security from the Curiosum Elixir meetup. YouTube: https://www.youtube.com/watch?v=3STSwMOivQA

Continue Reading

Exploit Guard: Open Source Runtime Application Self Protection for Elixir

Michael Lubas, 2023-06-12

Today Paraxial.io is excited to announce Exploit Guard, which adds runtime application self protection (RASP) to Paraxial.io Application Secure. This feature allows businesses using Elixir in production to detect and stop hacking attempts at runtime. The 2017 Equifax data breach started due to a remote code execution (RCE) vulnerability in Apache Struts, a Java framework. This incident resulted in a $425 million dollar settlement, and prompted businesses executives to begin asking questions about application security. Exploit Guard blocks RCE attacks in Elixir.

Continue Reading

Phoenix Application Security - ElixirConf 2023 Remote Training

Paraxial.io, 2023-05-24

When deploying your Phoenix application, it seems like there is a never ending list of security problems to worry about. XSS, CSRF, RCE, timing attacks, the list of acronyms and jargon goes on. How should you get started securing your Phoenix app? What is worth focusing on? This training will be an introduction to the web application security concepts most relevant to Phoenix applications, common vulnerabilities, and recommended best practices. This training is fully remote, September 1, 2023.

Continue Reading

How Elixir Solves a Difficult Security Problem

Michael Lubas, 2023-05-03

The authentication mechanism had been subject to numerous design reviews and penetration tests. The owners were confident that no feasible means existed of attacking the mechanism to gain unauthorized access.

Continue Reading

Elixir Security: A Guide to Fixing Sobelow Findings

Michael Lubas, 2023-04-24

Sobelow is the static analysis tool for finding security issues in Elixir and Phoenix code. If you’re using Elixir in production, running Sobelow is highly recommended, because it automatically checks for common security issues. Today, detailed guidance on how to triage, verify, and fix each finding is included in Paraxial.io Application Secure. Enterprise customers can also request professional assistance when fixing reported vulnerabilities. This guide is open source, for the benefit of the Elixir community, on the Paraxial.io Github - https://github.com/paraxialio/sobelow_guide

Continue Reading

Elixir Security: What's the impact of DoS due to atom creation?

Michael Lubas, 2023-04-05

In Elixir and Erlang, the atom is a basic type, a constant whose value is its own name. There is a hard limit on the number of atoms that can be created, the default is 1_048_576. If external user input results in atoms being created at runtime, this can cause the entire system to crash. There is an obvious question raised from all this, “If my application is vulnerable, what is the impact?”

Continue Reading

Elixir Security: Sobelow 0.12.1 Released, Adds LiveView Support

Michael Lubas, 2023-03-30

Sobelow version 0.12.1 was released recently, adding support for HEEx templates, which are used in Phoenix LiveView. Sobelow is a static analysis tool for finding security issues in Elixir and Phoenix code. If you’re using Elixir in production, running Sobelow is highly recommended, because it automatically checks for common security issues.

Continue Reading

Elixir/Phoenix Security: What is CSRF via Action Reuse?

Michael Lubas, 2023-03-28

The typical description of cross site request forgery (CSRF) involves a POST request being triggered without a secure token. If there’s a state changing HTML form making a POST, with a CSRF token, that’s validated by the server, that should be secure. Consider a web application where both a GET and POST request can perform the same state changing action. This is likely not the developer’s intention, but that is the root of most security problems in software.

Continue Reading

Announcing Potion Shop - An Open Source Vulnerable Elixir/Phoenix App for Security Education

Michael Lubas, 2023-03-21

Potion Shop is a Phoenix application vulnerable to common web security issues, such as RCE, XSS, and CSRF. Software developers interested in learning more about Elixir security can examine the source code and functionality of Potion Shop, to better understand how these vulnerabilities occur in a Phoenix project.

Continue Reading

Interview with Holden Oullette: Elixir Security, the Sobelow Project, and Scaling Developer Education

Michael Lubas, 2023-03-06

Michael: Hi Holden, what are you currently working on? How is it related to Elixir?

Continue Reading

Elixir/Phoenix Security: Remote Code Execution and Serialisation

Michael Lubas, 2023-02-28

In a Phoenix application, is the code :erlang.binary_to_term(user_input, [:safe]) secure? The answer is no, as the Erlang documentation states, “The safe option ensures the data is safely processed by the Erlang runtime but it does not guarantee the data is safe to your application. You must always validate data from untrusted sources.” Unsafe usage of binary_to_term/2 can lead to a remote code execution (RCE) vulnerability in your application. This means an attacker sends a string of input, which executes malicious code on your production server.

Continue Reading

Paraxial.io on Elixir Mix Episode 208: How To Secure Your Elixir Application With Michael Lubas

Paraxial.io, 2023-02-24

Our founder Michael was on the Elixir Mix podcast this week, discussing bot defense, Elixir application security, and how developers can learn more about these topics. Listen now.

Continue Reading

Elixir/Phoenix Security: Rate Limits for Authentication with Hammer

Michael Lubas, 2023-02-22

Phoenix applications with user accounts share a common set of features: a login page, account creation, and password reset via an email. These systems are exposed to bot attacks, and developers should be aware of the risks that the public internet imposes on their software. This article will show a risk assessment of a Phoenix application’s login system, and how to use the Hammer library to rate limit the number of requests to each endpoint based on IP address.

Continue Reading

Elixir/Phoenix Security Live Coding: Preventing SQL Injection in Ecto

Michael Lubas, 2023-02-16

Learn how to prevent SQL injection in Elixir/Phoenix applications during this live coding webinar. The founder of Paraxial.io, Michael Lubas, will walk through an example Phoenix application, showing secure and insecure Ecto code examples, and how an SQL injection attack works.

Continue Reading

Why Does Paraxial.io Focus on Elixir Security?

Michael Lubas, 2023-02-15

Paraxial.io is an application security platform created for Elixir. The two primary use cases are defense against malicious web bots and vulnerability management. Similar tools on the market today include reCaptcha, Snyk, and Cloudflare bot defense. Paraxial.io’s backend is written in Elixir, all our customers are using Elixir, and even this blog is a Phoenix application running Dashbit’s NimblePublisher.

Continue Reading

What is Paraxial.io? A CTO Level Introduction

Michael Lubas, 2023-02-04

Paraxial.io is an application security platform designed for Elixir and Phoenix. We provide an alternative to tools such as Snyk, reCaptcha, and Cloudflare bot defense. You may have questions about these statements, such as, “Why do businesses buy this software?”.

Continue Reading

Elixir Dependency Security: Mix, Hex, and Understanding the Ecosystem

Michael Lubas, 2023-01-24

Dependencies in a software project are a frequent source of security concern. The ability to detect outdated packages, and update to the latest version without breaking the project, is necessary for modern teams. In Elixir, dependencies are hosted by the Hex package manager, and managed by the Mix build tool. To better understand the ecosystem, let’s examine the different components in detail.

Continue Reading

Announcing Vulnerability Scanning and Management for Elixir

Paraxial.io, 2023-01-05

Paraxial.io now supports vulnerability scanning and management for Elixir applications. This is done via a mix task, which can be integrated into your CI/CD pipeline, that uploads the result of each scan to the Paraxial.io backend for tracking and reporting. This fulfills the compliance requirements for a number of security standards, and gives your team actionable metrics on the security of your project.

Continue Reading

Rocket Validator Stops Spam Users with Paraxial.io

Paraxial.io, 2023-01-04

Rocket Validator helps website owners detect accessibility and HTML issues in their pages. The founder, Jaime Iniesta, was dealing with an annoying problem: spam user registrations. Bots would register for the service, but these signups were spam, not real humans. Jaime decided to create a Paraxial.io account, and create honeypot forms for the bots to submit. What happened next?

Continue Reading

Elixir/Phoenix Security: Denial of Service Due to Atom Exhaustion

Michael Lubas, 2023-01-03

In Elixir, the atom is a basic type, a constant whose value is its own name. Atoms are often hard-coded, meaning the atom :red appears in source code, and is not dynamically created at runtime or compile time. However, it is possible for your application to accept user input, then create a new atom based on that input, for example:

Continue Reading

Paraxial.io on Thinking Elixir Episode 131: Start Securing Elixir and Phoenix

Paraxial.io, 2022-12-28

Our founder Michael Lubas was on the Thinking Elixir Podcast this week, discussing Phoenix security and useful resources to get started defending your own applications. https://podcast.thinkingelixir.com/131

Continue Reading

Elixir/Phoenix Security: How attackers bypass IP based rate limiting

Michael Lubas, 2022-12-20

“Limit the number of login attempts for one IP address to 5 in a 30 second period” is a standard rule for many web applications, and makes sense from the perspective of a site owner dealing with malicious credential stuffing. With the rise of cloud computing, it has become much easier for an attacker to access thousands of different IP addresses, for free, to bypass IP based blocking. This article will use a Phoenix application to demonstrate what the attack looks like, and how Paraxial.io stops it.

Continue Reading

Betafi Blocks Bots on Launch Day with Paraxial.io

Paraxial.io, 2022-12-05

Betafi is a user research platform that makes it easy to capture and make sense of customer feedback sessions. User interviews, usability testing, and sharing business insights are all supported. Built on Elixir and Phoenix, the team at Betafi was preparing to launch on Product Hunt, and wanted to ensure the big launch day was not disrupted by bot attacks.

Continue Reading

Elixir/Phoenix Security: Introduction to Cross Site Request Forgery (CSRF)

Michael Lubas, 2022-12-05

Cross site request forgery (CSRF) is a type of vulnerability in web applications, where an attacker is able to forge commands from a victim user. For example, consider a social media website that is vulnerable to CSRF. An attacker creates a malicious website aimed at legitimate users. When a victim visits the malicious site, it triggers a POST request in the victim’s browser, sending a message that was written by the attacker. This results in the victim’s account making a post written by the attacker.

Continue Reading

Announcing Elixir and Phoenix Security Consulting Services

Michael Lubas, 2022-11-16

As Elixir and Phoenix adoption continues to increase in industry, the need for security expertise has grown as well. Finding engineers with a deep understanding of the Elixir ecosystem, and software security, is a difficult task.

Continue Reading

Securing Elixir/Phoenix Applications: 5 Tips to Get Started

Michael Lubas, 2022-11-16

There are a number of resources online related to Elixir and Phoenix security, however when it comes to securing your own project, determining where to begin is a difficult task. Here are five recommendations to get started improving the security of your application.

Continue Reading

Cross Site Scripting (XSS) Patterns in Phoenix

Michael Lubas, 2022-10-24

Cross Site Scripting (XSS) refers to a class of vulnerability in web applications, where an attacker is able to inject a script into the browsing context of a victim. The root cause of this vulnerability is untrusted user input being rendered in a web browser, where JavaScript written by an attacker is executed. If a website has user authentication, and an attacker is able to exploit XSS in the site, the end result is user accounts will be compromised.

Continue Reading

Detecting SQL Injection in Phoenix with Sobelow

Michael Lubas, 2022-10-06

SQL injection is a type of attack against a web application, where some malicious input is parsed by the underlying database, resulting in an unauthorized operation being performed. This can be the disclosure of sensitive data, modification of the database, or deletion of entire tables.

Continue Reading

Elixir code style, a brief example

Michael Lubas, 2022-09-14

Write a function in Elixir named build_string that takes 4 arguments:

Continue Reading

ElixirConf 2022 Teller Challenge Writeup

Michael Lubas, 2022-09-06

At this year’s ElixirConf Teller hosted a challenge in Elixir, write an Elixir client for a banking application to get the secret account number and balance. This is a writeup for the remote attendee instance, if you played this in-person at ElixirConf the setup was different.

Continue Reading

Setting User-Agent in Elixir with Finch, HTTPoison, Req, or Tesla

Michael Lubas, 2022-08-17

In 1996 Google co-founder Larry Page posted in comp.lang.java, Q: Setting User-Agent Field?. 26 years later, you may still need to set the User-Agent in your project. Here are four examples from the Elixir HTTP clients Finch, HTTPoison, Req, and Tesla.

Continue Reading

eBook Release: Inside a Web Bot Attack 🤖

Paraxial.io, 2022-08-10

It was an ordinary day at work for Peter, until he saw a spike in login attempts 1,000 times higher than average! Go inside the response to a bot attack and learn how Paraxial.io can keep your business secure.

Continue Reading

Paraxial.io Featured in ElixirCasts Episode 149

Paraxial.io, 2022-08-05

Paraxial.io was featured in the excellent ElixirCasts, a series of video tutorials on Elixir and Phoenix. The episode walks through the installation of Paraxial.io in less than seven minutes, and the configuration of a rule to stop automated credential stuffing attacks.

Continue Reading

Testing a Phoenix application for credential stuffing with Elixir, Floki, and HTTPoison

Michael Lubas, 2022-07-14

Credential stuffing is a type of attack performed against web applications, where the attacker uses username/password pairs from a data breach as input to a program, which performs automated login attempts against a victim application. This is a highly effective technique for stealing user accounts, because password reuse is so common.

Continue Reading

🎉 Announcing the Paraxial.io Beta Launch! 🎉

Paraxial.io, 2022-05-28

Paraxial.io protects your Elixir/Phoenix application from bots attempting automated logins, scraping, and disruption of service. Today we are happy to announce the beta program is open to new users!

Continue Reading

Classifying Data Center IP Addresses in Phoenix Web Applications with Radix Trees

Michael Lubas, 2022-05-10

Several cloud hosting companies publish the IP address ranges of their services. Examples include AWS, Azure, GCP, Oracle, and DigitalOcean. This information is useful to website owners, because the expected behavior of a client coming from a cloud server is different from a residential IP address. Consider a website that sells concert tickets, and wants to prevent bots from quickly purchasing all available tickets. The website owner notices that when tickets go on sale, hundreds of clients with data center IP addresses are making automated requests, purchasing tickets for resale before real visitors can.

Continue Reading

Throttling and Blocking Bad Requests in Phoenix Web Applications with PlugAttack

Paraxial.io, 2022-02-02

Web applications that accept username and password pairs for authentication may experience credential stuffing by malicious clients. We use the term “credential stuffing” to refer to the act of using credentials, taken from a website’s public data breach, to preform many authentication attempts against victim accounts on a different website. This tutorial will demonstrate how to mitigate credential stuffing against a Phoenix Framework application, using PlugAttack.

Continue Reading