HODOR: Reducing Attack Surface on Node.js via System Call Limitation
summary
HODOR builds cross-language static-dynamic call graphs for JavaScript and native layers, applies JS-specific optimizations and partial context-sensitive C/C++ analysis, and generates Seccomp-based per-thread syscall whitelists for Node.js runtime. It implements timed filter installation to avoid thread inheritance, evaluates on 169 npm packages plus three real apps, and claims to cut syscall-enabled attack surface to about 20%, uncover hidden syscall needs in 23% of packages, reduce C/C++ permission by 71%, mitigate 73% of tested exploit patterns, with negligible runtime overhead.
AI-written summary · about
chapters (8)
- 0:00Introduction to Node.js
- 2:13Node.js architecture layers
- 4:28Security threats
- 5:57Proposed defense mechanism
- 8:59System design and analysis
- 12:07Addressing false positives
- 16:01Installation and runtime
- 19:06Evaluation and results
related talks
21mA Sense of Time for JavaScript and Node.js
29mA Node.js Security Roadmap
42mThe Node.js Highway: Attacks Are At Full Throttle
27mState of Node.js Security
24mThe Mad Science of Node
47mNode.js Security: Breaking The Loop
50mContainer Attack Surface Reduction Beyond Name Space Isolation
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!