An Adventure in Contingency Debugging: Ruby IO#read/IO#write Considered Harmful – NCC Group Research Skip to content NCC Group Research Making the world safer and more secure Menu Privacy Careers Disclosure Policy Technical Advisories Public Reports 2021 Research Report Contact Us An Adventure in Contingency Debugging: Ruby IO#read/IO#write Considered Harmful Jeff Dileo Research December 15, 2020 December 15, 2020 8 Minutes Recently, I was working on weaponizing a particular bug with a colleague. For reasons unfathomable to me, we’ve been implementing our exploit in Ruby. As part of this, we wrote a rinky-dink port scanner that attempts to find instances of the service on a given host because it has a propensity to pick random ports to listen on. This was necessary because one can only really fingerprint the service by sending it specific malformed messages and detecting whether a specific error message was returned. So color me surprised when my colleague messages me and tells me that they have the scanner working, but with the caveat that “when I run it in a Docker container it hangs on read and when I run it in a VM it works.” And so began a day of stark raving incredulity. require 'socket'