Node Security Experiments: A trip back in time.

1. Node Security Experiments
NODEVEMBER 2015

2. adam_baldwin
evilpacket

4. Node Security Project

5. Node Security Project

6. ONCE UPON A
TIME

7. MALICIOUS CODE
HOSTED ON NPM

9. ZOMG INSTALL
SCRIPTS
https://docs.npmjs.com/misc/scripts

10. npm i totallynotavirustrustmeimadolphin

11. JERKS DEVS

12. Distribution

13. SHA HASH EXPOSURE
5834be28bb632cd49ab3bbf78cef8b1983601f11

15. TYPOS

16. PUNCTUATION
CAUSES ERROR
ಠ_ಠ

17. SOCKET.IO
SOCKETIO
or

18. COFFEESCRIPT
COFFEE-SCRIPT
or

20. PASSWORDS

21. DEMO HERE?

22. AUDIT ALL THE THINGS

23. AUDIT ALL THE THINGS
12,000

24. AUDIT ALL THE THINGS
205,596

26. AUDIT ALL THE THINGS
FOR ALL THE THINGS

27. STATIC ANALYSIS

28. IDENTIFY
A PATTERN

29. SEARCH FOR
THAT PATTERN

30. CHALLENGES
• Storage & compute requirements
• node_modules & test directories
• modules like 'yourmom'
• /usr/bin/grep: Argument list too long
• keeping up with the massive # of packages

31. VALIDATE

32. REPEAT

33. detect-unsafe-regex
detect-buffer-noassert
detect-child-process
detect-disable-mustache-escape
detect-eval-with-expression
detect-no-csrf-before-method-override
https://github.com/nodesecurity/eslint-plugin-security
detect-non-literal-fs-filename
detect-non-literal-regexp
detect-non-literal-require
detect-object-injection
detect-possible-timing-attacks
detect-pseudoRandomBytes

34. github.com/evilpacket/cuddly-spork

35. nodesecurity.io/advisories

36. npm i nsp -g
cd your-fantastic-app
nsp check

37. RETIREJS
npm i retire -g

38. 184217 Modules
2890 Vulnerable

39. 22659 Modules
1675 Vulnerable
github.com/evilpacket/bower-retire.js-scan

40. BOWER
STATIC ANALYSIS

41. github.com/evilpacket/bower-burp-static-analysis
3949 Open redirection (DOM-based)
1950 Cross-site scripting (DOM-based)
956 DOM data manipulation (DOM-based)
818 Link manipulation (DOM-based)
103 HTML5 storage manipulation (DOM-based)
64 Client-side JSON injection (DOM-based)

42. BOTS?
Who else might be out there doing stuffs?

43. NOPE, NOT REALLY

44. BOT TRACKER
1 {
2 "name": "botbait",
3 "version": "1.0.1",
4 "description": "Not for human consumption.",
5 "main": "index.js",
6 "scripts": {
7 "test": "node index.js test;exit 0",
8 "start": "node index.js start;exit 0",
9 "preinstall": "node index.js preinstall;exit 0"
10 },
11 "keywords": [
12 "botbait"
13 ],
14 "author": "",
15 "license": "MIT"
16 }
CREATED 6-17-2015

45. 193.137.5.49npm test06-23-2015

46. WHAT NOW?

47. DETECTING MALICIOUS
MODULES

48. nodevember.evilpacket.net

49. BINARY MODULES & NODE CORE
1 var fs = require('fs');
2 var msg = require('msgpack');
3 //dddd 407d 7a
4 var data = fs.readFileSync('./crash')
5 msg.unpack(data);
$ node index.js
Segmentation fault

50. THANK YOU
nodesecurity.io/report