Beyond the Basics: Securing JS Applications
summary
Code lets an attacker turn an innocuous math evaluator into a remote backdoor that writes a hello.txt then spawns a reverse shell to the attacker IP, enabling lateral movement and IAM privilege escalation via an instance role. Recommends manual code review plus automated vulnerability management that scans containers and images on change. Notes browser ML inference reduces latency but makes the model a browser-side model download, warns of malicious libraries/backdoors and denial of wallet risks from unprotected Lambdas.
AI-written summary · about
chapters (15)
- 0:00intro
- 0:22preamble
- 1:11reality
- 3:46understanding the cyber attack chain
- 9:45code review
- 14:20why use js for machine learning?
- 15:11security considerations
- 16:34how to secure the librairies and frameworks?
- 18:08automated vulnerability management
- 19:06network isolation
- 20:07how about iam privilege escalation?
- 21:40restrictive iam permissions
- 23:19how about denial of wallet attacks?
- 25:24recap
- 26:08thanks
related talks
27mBeyond the Basics: Securing JavaScript Applications
27mSecuring The Gateway And Mitigating Risks In LLM API Integration
40mSecuring your dependencies
58mPractical Secure Development and Operations with JavaScript in 2020
15m“Security” in the JavaScript ecosystem
34mWeb security explored through horror movies
40mHostile JavaScript: Attacking and Defending the Browser
33mOffensive Javascript Techniques for Red Teamers