Cluj JSHeroes 2017 - Liran Tal on Node.js Security
3 likes•463 views
This document discusses security issues with Node.js and best practices to address them. It describes security horror stories from malicious npm packages deleting files ("rimrafall") and packages with similar names to popular ones downloading instead. Other issues covered include NoSQL injections, regular expression denial of service attacks, and insecure dependencies. The document recommends using Helmet to set secure HTTP headers, avoiding writing your own regular expressions, using libraries like validator.js for validation, and integrating Snyk to check for vulnerabilities in dependencies. The key takeaway is the importance of secure development practices like input validation, output encoding, and dependency management for Node.js applications.
![• ^([01]?dd?|2[0-4]d|25[0-5]).([01]?d
d?|2[0-4]d|25[0-5]).([01]?dd?|
2[0-4]d|25[0-5]).([01]?dd?|2[0-4]d|
25[0-5])$](https://image.slidesharecdn.com/node-170609114232/85/Cluj-JSHeroes-2017-Liran-Tal-on-Node-js-Security-60-320.jpg)
![Matching an IP address
• ^([01]?dd?|2[0-4]d|25[0-5]).([01]?d
d?|2[0-4]d|25[0-5]).([01]?dd?|
2[0-4]d|25[0-5]).([01]?dd?|2[0-4]d|
25[0-5])$](https://image.slidesharecdn.com/node-170609114232/85/Cluj-JSHeroes-2017-Liran-Tal-on-Node-js-Security-61-320.jpg)
![^([a-zA-Z0-9])$
• Match words and numbers](https://image.slidesharecdn.com/node-170609114232/85/Cluj-JSHeroes-2017-Liran-Tal-on-Node-js-Security-63-320.jpg)
![^([a-zA-Z0-9]+s?)$
• Match words and numbers
• Allow spaces in between (duh)](https://image.slidesharecdn.com/node-170609114232/85/Cluj-JSHeroes-2017-Liran-Tal-on-Node-js-Security-64-320.jpg)
![^([a-zA-Z0-9]+s?)+$
• Match words and numbers
• Allow spaces in between (duh)
• Repeat](https://image.slidesharecdn.com/node-170609114232/85/Cluj-JSHeroes-2017-Liran-Tal-on-Node-js-Security-65-320.jpg)
Cluj JSHeroes 2017 - Liran Tal on Node.js Security
- 1. Node.js Security: Breaking The Loop Liran Tal Engineering Manager @ Nielsen Marketing Cloud March 2017
- 9. Node.JS is JavaScript JavaScript is Everywhere
- 10. Security Horror Stories in Node.JS
- 11. Fail #1
- 12. By January 2015 ◇ rimrafall package published to npm
- 13. rimrafall ◇ npm pre-install script $ rm –rf /*
- 15. Fail #2
- 16. validator.js ◇ helps validate and sanitize strings
- 18. $ npm install validator.js --save
- 20. malicious modules of similar names
- 21. 3,500,000 socket.io 2,000 socketio malicious modules of similar names
- 22. Fail #3
- 24. seemingly innocent tutorial to learn from
- 31. Security by HTTP Headers1
- 32. The Big 3
- 33. The Big 3
- 34. 1. Strict-Transport-Security 2. X-Frame-Options 3. Content-Security-Policy The Big 3
- 35. 1. Strict-Transport-Security The Big 3 Browsers enforce secure (HTTPS) connections to the server Security by HTTP Headers
- 36. 1. Strict-Transport-Security The Big 3 http://www.bank.com <a href=“https://bank.com/login"> http://www.bank.com/login Security by HTTP Headers
- 37. 1. Strict-Transport-Security The Big 3 http://www.bank.com https://www.bank.com Security by HTTP Headers
- 38. 2. X-Frame-Options The Big 3 Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on Security by HTTP Headers
- 39. 2. X-Frame-Options The Big 3 Security by HTTP Headers
- 40. 2. X-Frame-Options The Big 3 Security by HTTP Headers
- 41. 3. Content-Security-Policy The Big 3 Whitelist Trusted Content Security by HTTP Headers
- 42. 3. Content-Security-Policy The Big 3 Whitelist Trusted Content Security by HTTP Headers
- 43. 1. Strict-Transport-Security 2. X-Frame-Options 3. Content-Security-Policy The Big 3 Security by HTTP Headers
- 44. 1. Strict-Transport-Security 2. X-Frame-Options 3. Content-Security-Policy The Big 3 Security by HTTP Headers
- 46. Putting it all together with Helmet and ExpressJS
- 50. What is going on here?
- 51. No HTTP body in ExpressJS it relies on bodyParser lib
- 52. ExpressJS uses bodyParser library to access HTTP body payload
- 53. ExpressJS uses bodyParser library to access HTTP body payload
- 56. Validate Input ◇ Validate Length and Type ◇ Validate & Sanitize input to expected type ◇ Parameters Binding ◇ Security in Depth
- 58. ReDoS 3 Regular Expressions DoS
- 61. Matching an IP address • ^([01]?dd?|2[0-4]d|25[0-5]).([01]?d d?|2[0-4]d|25[0-5]).([01]?dd?| 2[0-4]d|25[0-5]).([01]?dd?|2[0-4]d| 25[0-5])$
- 62. Let’s Match Song Titles Can you help with the regex?
- 63. ^([a-zA-Z0-9])$ • Match words and numbers
- 64. ^([a-zA-Z0-9]+s?)$ • Match words and numbers • Allow spaces in between (duh)
- 65. ^([a-zA-Z0-9]+s?)+$ • Match words and numbers • Allow spaces in between (duh) • Repeat
- 67. ReDoS Attacks ◇ Catastrophic Backtracking ◇ Exploits greedy quantifiers ◇ Simple regex are vulnerable too: /^(a+)+$/
- 68. Regex DoS is a Real Problem ◇2017 - ms ◇2016 - Hawk ◇2016 - Tough Cookie ◇2016 - Moment ◇2015 - Uglify ◇2014 - Marked ◇2013 - Validator.js
- 70. University of Birmingham UK http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf
- 71. Best Practice #1 ◇ DO NOT WRITE YOUR OWN REGEX
- 72. Best Practice #2 ◇ DO NOT WRITE YOUR OWN REGEX
- 73. Best Practice #3 ◇Validator Node.js Module
- 75. Best Practice #4 ◇ safe-regex node.js module ◇ checks regex complexity/backtracking vulnerability
- 79. Are my dependencies vulnerable? ask yourself
- 82. snyk ◇ check cve db for known issues ◇ check installed node_modules dir ◇ provides patch-level fix ◇ provides interactive patch wizard
- 83. SecurityOps Integrated Security into your build pipeline
- 84. 1 2 3 Employ Secure HTTP headers with Helmet Be mindful to NoSQL Injections Summary 4 Snyk to secure Your npm dependencies Avoid writing your own RegEx