The Node.js Highway: Attacks Are At Full Throttle
summary
Node.js is single‑threaded so CPU‑heavy code creates trivial DoS; a demo runs a 100‑million loop and ties up one core. V8’s Math.random plus MD5 password generation lets an attacker register three consecutive md5s, reverse them via a custom rainbow table and predict future passwords using a cloud cracker — the uploader hosts a 200 gigabyte rainbow table on Amazon and the attack succeeds. Other specifics: MongoDB queries accept Json operators enabling NoSQL injection and regex ReDoS that drives 25% CPU for 3–4 seconds; Express route handlers can be overwritten in memory so routes are hijacked until restart.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:11Agenda
- 3:37Architecture
- 4:49NoJS
- 5:25CPU Intensive Code
- 8:03Nodejs Web Server
- 8:58ThirdParty Components
- 9:29Example
- 11:30Random Number Prediction
- 12:37Rainbow Tables
- 15:35Demo
- 24:15MongoDB
- 24:46Document
- 30:32User Find
- 34:27NoJS vs Evil
- 37:08NoJS routing stack
- 37:45Add method
- 38:58Add page
- 39:09Route stack
- 39:52No tracking
related talks
43mGame of Hacks: The Mother of All Honeypots
29mA Node.js Security Roadmap
47mNode.js Security: Breaking The Loop
21mFreezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers
55mNode.js Security: Breaking The Loop
32mWriting Secure JavaScript Code
51mStranger Danger: Your Node.js Attack Surface Just Got Bigger
47mNode.js application (in)security