1
00:00:15,720 --> 00:00:17,840
You're looking at the side of my head.

2
00:00:18,020 --> 00:00:19,680
Everything's kind of weird and purple.

3
00:00:19,680 --> 00:00:21,040
Does it show up the same way for you?

4
00:00:21,060 --> 00:00:23,100
You're looking at the side of my head.

5
00:00:23,400 --> 00:00:24,900
Everything's kind of weird and purple.

6
00:00:24,900 --> 00:00:26,340
Does it show up the same way for you?

7
00:00:26,660 --> 00:00:27,460
Mute.

8
00:00:37,470 --> 00:00:38,270
Awesome.

9
00:00:39,470 --> 00:00:49,010
All right, well, it is 9.30, so we can get started with the first Q&A of the day here at DEF CON Safe Mode.

10
00:00:49,010 --> 00:00:50,030
My name is PLiberty9.

11
00:00:50,030 --> 00:00:52,870
I'm here with my fellow goon, Fallible.

12
00:00:52,870 --> 00:00:53,770
Hey, Fallible.

13
00:00:54,210 --> 00:00:55,170
Greetings.

14
00:00:55,690 --> 00:00:59,150
And we are also here with our first speaker of the day.

15
00:00:59,150 --> 00:01:09,470
We are here with Feng Xiao, who is going to answer your questions all about his presentation, Discovering Hidden Properties to Attack the Node.js Ecosystem.

16
00:01:09,470 --> 00:01:10,570
Hey, Feng, how's it going?

17
00:01:10,570 --> 00:01:11,210
Hi.

18
00:01:11,210 --> 00:01:12,110
Hi, good.

19
00:01:12,110 --> 00:01:13,210
How are you guys?

20
00:01:13,210 --> 00:01:14,570
We're doing great.

21
00:01:14,570 --> 00:01:15,890
It's awesome to have you here.

22
00:01:15,890 --> 00:01:17,310
Watched your presentation.

23
00:01:17,310 --> 00:01:19,210
You did an incredible job with that.

24
00:01:19,210 --> 00:01:22,030
Highly recommend that people go check that out.

25
00:01:22,030 --> 00:01:24,490
It's available on YouTube.

26
00:01:24,490 --> 00:01:27,070
DEF CON has those videos up.

27
00:01:27,350 --> 00:01:35,950
And you can also ask questions to Feng on the Discord channel at the TrackOneLiveQA channel.

28
00:01:35,950 --> 00:01:42,830
So yeah, we have a few questions that are coming in, so we can ask him some of those questions.

29
00:01:43,330 --> 00:01:44,210
Let's see.

30
00:01:44,210 --> 00:01:45,610
Let me actually start with one.

31
00:01:45,610 --> 00:01:47,370
Let me get this one out there as a start.

32
00:01:47,370 --> 00:01:50,730
So this is not your first time presenting at DEF CON, is it?

33
00:01:50,730 --> 00:01:53,990
So how many times have you given DEF CON presentations?

34
00:01:55,050 --> 00:02:04,170
Okay, so before the SIGMO talk, I only came to DEF CON once, and that is my first time SIGMO talk.

35
00:02:04,170 --> 00:02:06,710
It's in 2018.

36
00:02:07,010 --> 00:02:15,610
So in that talk, I present some new vulnerabilities that I discussed in software-defined networks.

37
00:02:15,850 --> 00:02:19,330
So this is actually my second time at DEF CON.

38
00:02:20,310 --> 00:02:24,650
That's fantastic, and we're really glad you decided to come back and join us again.

39
00:02:25,550 --> 00:02:34,810
Somebody was trying to ask if we were going to do first-time rituals with you, but we don't have to, because you're an old hat with this.

40
00:02:35,910 --> 00:02:38,050
You've already done that, so that's awesome.

41
00:02:39,070 --> 00:02:42,350
Let's see, we've got some questions coming in yet.

42
00:02:42,370 --> 00:02:56,830
Feng, one of the questions that we were kind of wondering about with your research that you did on the node.js ecosystem is what type of people should use the tool that you released?

43
00:02:56,950 --> 00:02:59,530
I know you mentioned the tool in your presentation.

44
00:02:59,530 --> 00:03:04,730
Maybe you want to mention that a little bit, and what kind of people should be using that sort of thing?

45
00:03:05,790 --> 00:03:20,290
Yeah, so this is... according to our research, we found this is kind of widespread problems, and many Git report or PM project has this problem.

46
00:03:20,290 --> 00:03:24,970
So we believe that there are two kinds of people that may want to use this tool.

47
00:03:24,990 --> 00:03:30,790
The first kind of people is about the developers.

48
00:03:30,850 --> 00:03:43,570
I believe they can use this tool to detect their own software, so that they can catch and discover all these hidden properties before they release a version.

49
00:03:43,770 --> 00:03:53,450
And a second type of people that we think can use this tool is some white hats, pen testers, or hackers.

50
00:03:53,450 --> 00:04:04,850
When they want to do some security analysis, maybe they can use this tool to detect some vulnerabilities or problems within their targets.

51
00:04:05,070 --> 00:04:05,570
Yes .

52
00:04:06,030 --> 00:04:06,750
Excellent.

53
00:04:06,950 --> 00:04:08,010
All right.

54
00:04:09,310 --> 00:04:13,950
Sorry, people have noticed that we're a little bit weird on our adjustments.

55
00:04:13,950 --> 00:04:15,910
We're trying to get that fixed as we go.

56
00:04:16,330 --> 00:04:17,770
Enjoy the testing and production.

57
00:04:17,770 --> 00:04:18,890
Sorry about that, folks.

58
00:04:20,310 --> 00:04:21,410
Yeah, for sure.

59
00:04:22,790 --> 00:04:23,830
Let's see.

60
00:04:24,050 --> 00:04:37,610
So, also, Feng, one of the things that you mentioned in the presentation where you had this discovery in Node.js, you also referenced Ruby on Rails and PHP.

61
00:04:38,130 --> 00:04:42,030
So, does it exist in those languages and platforms?

62
00:04:42,030 --> 00:04:44,410
And could it exist possibly in others?

63
00:04:44,410 --> 00:04:49,250
Should people try to go find this same vulnerability in other platforms?

64
00:04:49,670 --> 00:04:51,470
Okay, thanks for the question.

65
00:04:51,470 --> 00:05:05,160
So, as you guys have already observed in my presentations, the root cause of those vulnerabilities mainly comes from object sharing.

66
00:05:05,670 --> 00:05:17,590
So, if a language platform has such a feature, or some applications are using some kind of object sharing, then they could have a problem there.

67
00:05:17,590 --> 00:05:31,170
But why we are studying Node.js here is because to use the language, the flexibilities of JavaScript, the object, it can be really flexible.

68
00:05:31,170 --> 00:05:39,890
So , this empowers the hackers to propagate a lot of bad things into the programs.

69
00:05:39,890 --> 00:05:42,750
So, that's why we are studying Node.js.

70
00:05:42,750 --> 00:05:50,790
And we believe maybe there are other problems that are not discovered yet.

71
00:05:50,790 --> 00:05:59,030
But I think it is really a good direction to also explore this in other languages as well.

72
00:05:59,710 --> 00:06:00,670
Excellent.

73
00:06:01,390 --> 00:06:05,770
Alright, checking for some more questions from the audience.

74
00:06:06,730 --> 00:06:08,830
Here, I'll check for questions.

75
00:06:08,850 --> 00:06:13,830
Blavrty, would you see if you can get him, get that video up just a little bit higher too?

76
00:06:13,830 --> 00:06:14,630
Yeah, I think...

77
00:06:14,630 --> 00:06:19,690
One thing, I'm going to turn my camera off and just see if that bumps him up.

78
00:06:20,130 --> 00:06:21,610
I'm going to try the same.

79
00:06:32,000 --> 00:06:34,900
Oh yeah, now we are looking at who we want to actually see.

80
00:06:34,900 --> 00:06:35,720
Right , exactly.

81
00:06:35,720 --> 00:06:37,320
No one wants to see our faces.

82
00:06:42,430 --> 00:06:43,230
Alright.

83
00:06:45,150 --> 00:06:46,830
Cool, okay, back over.

84
00:06:46,870 --> 00:06:49,810
Let's see what else the community has to say.

85
00:06:51,690 --> 00:06:52,610
Okay.

86
00:06:53,510 --> 00:06:58,350
So yeah, Deadly Cob wants to know, when will the tool be released?

87
00:06:58,350 --> 00:07:03,830
He says, or this person says, they are only seeing a coming soon on the repo at the moment.

88
00:07:04,610 --> 00:07:06,210
Okay, yeah, thanks for the question.

89
00:07:06,210 --> 00:07:10,090
So that is one thing that I would like to mention in the Q&A.

90
00:07:10,270 --> 00:07:21,770
So, for now, as you guys may have observed from the presentations, there are several components in my talk, in the tools.

91
00:07:22,050 --> 00:07:32,570
And honestly, from the perspective of user experience, it's not that well designed, so you have to print and type in some kind to use it.

92
00:07:32,570 --> 00:07:41,730
So what we are doing now is, first, we are cleaning up the project code, and also we are making documents for it.

93
00:07:41,730 --> 00:07:50,830
So probably a short answer is that we are going to release it no later by the end of August.

94
00:07:50,910 --> 00:07:52,450
Oh, excellent.

95
00:07:52,450 --> 00:07:54,070
So that's great to hear.

96
00:07:54,970 --> 00:07:58,750
Alright, let's see that.

97
00:07:58,750 --> 00:08:00,150
Okay, cool.

98
00:08:00,730 --> 00:08:10,390
Let's see, who else do we have on there that wants to ask questions of our first speaker?

99
00:08:10,390 --> 00:08:18,150
Yeah, when an OK text is coming in, would it be possible to talk more about the differences between HPA and prototype pollution?

100
00:08:18,730 --> 00:08:19,850
Okay, cool, thanks.

101
00:08:19,850 --> 00:08:21,430
Thanks for the question.

102
00:08:21,430 --> 00:08:41,530
And so, for prototype pollution in JavaScript, we are talking about some kind of a text that tempers the prototype object, which is a special type of object in the JavaScript languages.

103
00:08:41,930 --> 00:08:45,910
However, in our attack, that is not our target.

104
00:08:46,030 --> 00:08:54,970
For example, in our attack, we are tying some user application-specific attributes or something else.

105
00:08:54,970 --> 00:09:10,610
And also, you may already see, as you may already heard from my presentations, we have something that is closely related to the prototype, but it's not about modifying the prototype.

106
00:09:10,610 --> 00:09:19,790
Instead, we are trying to forge some attributes that can be found on the prototype and hijack the inheritance chain.

107
00:09:19,790 --> 00:09:26,790
So, yes, there is a big difference between HPA and prototype pollution.

108
00:09:27,130 --> 00:09:28,570
Excellent.

109
00:09:28,570 --> 00:09:31,390
Thanks for that question, OKTux.

110
00:09:31,390 --> 00:09:32,930
All right.

111
00:09:34,070 --> 00:09:35,510
Let's see.

112
00:09:37,310 --> 00:09:47,230
And I know sometimes when you give a presentation, I know from experience that sometimes you have to kind of leave things out, that you really want to focus on the main issues.

113
00:09:47,230 --> 00:10:02,910
Was there any kind of like extra tips or extra things that if you had more time, that you might have included anything else that maybe people can think about with regard to the vulnerabilities that you found, or anything else that they can kind of think about around your research?

114
00:10:03,630 --> 00:10:12,750
Yeah, so due to the time constraint, we always have to remove some very interesting things from the talk.

115
00:10:12,750 --> 00:10:29,790
And to be honest, if I have time, I really want to case study every vulnerability within the research, because that's what people are maybe expecting, and I think those probabilities are really interesting.

116
00:10:29,890 --> 00:10:38,410
So my answer is the first thing that I come up with when I want to add more to it, it is about those vulnerability case studies.

117
00:10:39,470 --> 00:10:40,430
Excellent.

118
00:10:40,810 --> 00:10:49,150
Is there anything that maybe other people who enjoyed your research could also kind of dig in and take a look at and possibly look for as well?

119
00:10:49,490 --> 00:10:58,530
So I know a lot of times people just want to kind of add on to research that they find, and they're like, that's really great stuff, maybe I can find the next thing with that.

120
00:10:58,530 --> 00:11:07,290
When you were doing your research, did you have other ideas of things that maybe you didn't have time to look into, and maybe other people would have time to kind of help out with?

121
00:11:08,790 --> 00:11:16,330
Yeah, so I think I can share with you some ideas about Node.js.

122
00:11:16,350 --> 00:11:23,550
So for Node.js, I found a lot of interesting applications.

123
00:11:23,550 --> 00:11:32,790
For example, I found that many applications are now deployed in the serverless platform.

124
00:11:33,210 --> 00:11:36,370
So I think that could be an interesting direction.

125
00:11:36,850 --> 00:11:45,190
Yes, so this is kind of a new environment, different from the traditional server environments.

126
00:11:45,390 --> 00:11:52,430
And there's a lot of Node.js programs running in the serverless platform.

127
00:11:52,430 --> 00:11:55,930
So yeah, maybe that could be one interesting direction.

128
00:11:55,930 --> 00:12:00,670
And maybe somebody can hear my thoughts.

129
00:12:00,670 --> 00:12:05,390
Maybe they can come up with some great ideas and present them in next year's DevCon.

130
00:12:05,390 --> 00:12:07,730
And I will be happy to see that.

131
00:12:09,510 --> 00:12:11,030
That's excellent.

132
00:12:11,030 --> 00:12:12,250
All right.

133
00:12:13,530 --> 00:12:18,050
Looking for more questions that people have for you here.

134
00:12:27,930 --> 00:12:32,830
As we all attempt to figure out our settings here.

135
00:12:32,830 --> 00:12:40,770
Thank you everybody, and especially Bung for joining us for this chaos of figuring out how to get this stream to work properly.

136
00:12:40,770 --> 00:12:43,030
You're our first guinea pig.

137
00:12:43,570 --> 00:12:51,910
And thank you everybody in the stream chat telling us some suggestions of how to fix stuff.

138
00:12:52,490 --> 00:12:56,330
We'll also go in and see if we can kill our Discord notification noises.

139
00:13:09,490 --> 00:13:12,610
So Bung, do you have any other thoughts about...

140
00:13:13,150 --> 00:13:24,570
I know that you kind of hit this already, but is there anything in the talk that you would have liked to have included, but you didn't get a chance to give to us in your presentation so far?

141
00:13:26,510 --> 00:13:31,090
So, there's a lot of details, right?

142
00:13:31,570 --> 00:13:34,330
You know, I researched for a large project.

143
00:13:34,330 --> 00:13:39,790
Actually, I have been working on this project for almost about one year.

144
00:13:39,790 --> 00:13:43,850
So there's a lot of details and things I would like to add to it.

145
00:13:43,850 --> 00:13:49,670
Actually, a good thing about that is we are going to release our code, right?

146
00:13:49,670 --> 00:13:54,910
So many people can know a lot of details about our research.

147
00:13:55,750 --> 00:14:02,750
Also, we have the time to release our white paper, and I have been working on it for a while.

148
00:14:02,890 --> 00:14:12,170
So, if it is possible, I can also share my Twitter account.

149
00:14:12,230 --> 00:14:18,650
So maybe people who are interested in this research can follow me, or I can also follow back.

150
00:14:18,650 --> 00:14:27,410
And I will update the status of this work when I release something new.

151
00:14:28,890 --> 00:14:30,190
That's a good idea.

152
00:14:30,190 --> 00:14:33,330
I'm sure there's a lot of people who would be interested in knowing more about that.

153
00:14:33,330 --> 00:14:34,390
And good work.

154
00:14:34,390 --> 00:14:38,430
We'll make sure we get that out to anybody who wants to see it.

155
00:14:38,430 --> 00:14:43,090
Actually , we'll probably post that in the TrackOne channel.

156
00:14:44,850 --> 00:14:48,270
So I'll get that in there while we keep chatting.

157
00:14:58,690 --> 00:15:01,310
Alright, so you told us some of what you've been working on.

158
00:15:01,310 --> 00:15:04,230
You told us what you're aiming at to do next.

159
00:15:06,510 --> 00:15:13,670
It sounds like you're open for more people to come up with other thoughts and some other research directions for you.

160
00:15:13,990 --> 00:15:26,930
I'm sure I would like to know, and I'm sure some other folks would like to know as well, are you open for... I guess I'm not sure exactly where I was trying to go on that one.

161
00:15:26,930 --> 00:15:35,630
Other than, if people want to come to you and talk about this further, you've given them your Twitter.

162
00:15:38,550 --> 00:15:40,590
There's a... well, let me step back.

163
00:15:40,590 --> 00:15:43,950
I'll think of my question a little bit harder and come up with another one.

164
00:15:43,950 --> 00:15:52,850
In the meantime, tell us more about how you came upon this research.

165
00:15:54,510 --> 00:15:59,370
Oh, you mean how do I discover all these things, right?

166
00:16:02,230 --> 00:16:03,190
Please.

167
00:16:04,190 --> 00:16:12,670
Yeah, so the process I discovered this vulnerability is kind of like...

168
00:16:12,670 --> 00:16:22,150
since I'm enjoying eyeballing the source codes of an open source project to discover vulnerabilities.

169
00:16:22,150 --> 00:16:30,650
So when I take a look at some of my targets, I kind of discover some properties that's kind of like...

170
00:16:30,650 --> 00:16:43,210
okay, it seems that I can modify them, but there's no document, API documentation mentioned about them.

171
00:16:43,210 --> 00:16:47,470
So that's why I just try to include those properties.

172
00:16:47,470 --> 00:16:56,110
And in terms of that, yes, I can override those original values and do something bad.

173
00:16:56,110 --> 00:17:01,970
This is just the very beginning of our multi-making cases of that.

174
00:17:01,970 --> 00:17:05,390
So that's why we come up with our new tools.

175
00:17:07,510 --> 00:17:09,110
That's an interesting way.

176
00:17:09,110 --> 00:17:19,910
So it sounds like then you spend a certain amount of your time as you're doing whatever your day job is, hunting around and finding ways that things are broken.

177
00:17:19,910 --> 00:17:32,250
So can you give us a little bit more thought into some of the other folks who are coming up and working on their own projects.

178
00:17:32,250 --> 00:17:36,770
How do you identify when you are finding something that would be a good DEF CON talk?

179
00:17:36,770 --> 00:17:40,690
How do you identify something that you'd like to pursue further?

180
00:17:41,410 --> 00:17:43,630
Okay, thanks for the question.

181
00:17:43,630 --> 00:17:53,210
So I would say, yeah, I have some thoughts about how to make a DEF CON talk or Black Hat talk like that.

182
00:17:53,210 --> 00:18:04,370
So for me, if I can find some results or some new findings, which I think, first, this can be used in some real-world settings.

183
00:18:04,370 --> 00:18:13,910
For example, if I found some vulnerabilities that is exploitable in the production environment, I would say, yes, this could be some DEF CON or Black Hat talk.

184
00:18:14,390 --> 00:18:42,790
And also, if you really think this is a widespread or widely seen problem, maybe you should consider building something, some tools or at least some screens, so that people can use your tools or use your things and make all the process of discovering vulnerabilities easier.

185
00:18:42,790 --> 00:18:46,610
Yes, so that's two things I think could be useful.

186
00:18:46,610 --> 00:18:47,710
I like that.

187
00:18:47,710 --> 00:18:52,710
So you're starting small and you're building up things that are potentially useful.

188
00:18:52,710 --> 00:19:03,790
And then once you have small things that you can start to release, you start to build a community around that, build additional motivation, additional activity.

189
00:19:04,530 --> 00:19:05,810
Yeah.

190
00:19:06,150 --> 00:19:12,470
Yeah, I think also it's great to point out one of the points that Phuong just made.

191
00:19:12,470 --> 00:19:24,930
When you start thinking about what is going to be good research and showing it around, I know a lot of times people think like, this is not really interesting to anybody else but me, and it's not going to make a great talk anywhere.

192
00:19:24,930 --> 00:19:27,490
And I know a lot of people have that kind of thought.

193
00:19:27,490 --> 00:19:38,850
And my experience has always been that there's definitely other people that want to hear your research, and that you should definitely try to share that kind of information and research anywhere you can.

194
00:19:38,850 --> 00:19:43,790
So that was a great point that Phuong was making up, giving to us there.

195
00:19:43,790 --> 00:19:55,950
There is also another question for you here that seems interesting from Soft Tortilla, that wants to know, can you elaborate on the expected difficulty of getting those 12 CVEs patched?

196
00:19:55,950 --> 00:19:59,210
Do you think there's going to be much difficulty with getting those fixed?

197
00:20:00,010 --> 00:20:01,810
Oh, that's an interesting question.

198
00:20:01,810 --> 00:20:02,370
Yes.

199
00:20:02,370 --> 00:20:08,250
So for the vulnerability patching process, I do have some words to share with you guys.

200
00:20:08,250 --> 00:20:14,990
So, yes, at the very beginning, I found that people are not expecting those vulnerabilities.

201
00:20:15,310 --> 00:20:22,090
And they just think that, OK, so this seems like some minor issues, I don't want to patch it.

202
00:20:22,630 --> 00:20:29,530
But things go very differently after all my research proceed.

203
00:20:29,530 --> 00:20:39,350
So I found more and more, and many people in the industry, companies start to look at these problems.

204
00:20:39,370 --> 00:20:43,270
And after things become in these ways, things change.

205
00:20:43,270 --> 00:20:51,870
For example, there are some commercial scanners starting to alert such vulnerabilities.

206
00:20:51,870 --> 00:21:03,090
And some vendors who previously declined to patch those bugs have to patch them now.

207
00:21:03,090 --> 00:21:13,870
Because those vulnerability scanners start to say something like, whoa, this has vulnerabilities, you cannot use those libraries.

208
00:21:13,870 --> 00:21:20,290
So yes, this is kind of like a process that nobody knows your research, and you are kind of like nobody.

209
00:21:20,290 --> 00:21:26,710
But after you are getting more results, people are starting to look at it.

210
00:21:26,710 --> 00:21:33,770
And they will say, whoa, this is really interesting and important problems, and I want to patch it.

211
00:21:33,770 --> 00:21:38,610
Because it is already affecting our package usage.

212
00:21:39,530 --> 00:21:40,650
Excellent.

213
00:21:40,850 --> 00:21:49,470
And you also, at the beginning of that, mentioned that sometimes people think like, this isn't a big deal, so I'm not going to bother patching it.

214
00:21:49,470 --> 00:22:02,770
But for people that might not have seen your presentation yet, I believe that you were able to take user input, bypass protections, and were you able to show SQL injection during your presentation?

215
00:22:04,830 --> 00:22:06,230
Excuse me?

216
00:22:06,270 --> 00:22:18,270
And how far were you able to kind of... and how critical were the vulnerabilities that you were able to kind of take the exploits that you were doing in your presentation?

217
00:22:18,270 --> 00:22:24,210
Like some of the exploits that you were able to do, and how far were you able to take it?

218
00:22:25,870 --> 00:22:35,910
Yeah, so the final attack effects really depends on the type of those attack targets, right?

219
00:22:35,910 --> 00:22:46,710
So for the case study or the motivating example in our presentations, we are attacking some web frameworks.

220
00:22:46,710 --> 00:22:58,230
So we can build examples to demonstrate to people that, okay, you see, if we bypass this, if we bypass your protections, we can do something really bad.

221
00:22:58,230 --> 00:23:26,710
But for some other modules, the attack effects seems more vague, which means people will say, well, it seems like some minor logic bugs, but it turns out that those minor logic bugs also can be a really big problem when they are being exploited with other modules.

222
00:23:27,150 --> 00:23:28,150
Excellent.

223
00:23:30,390 --> 00:23:31,710
Let's see.

224
00:23:32,330 --> 00:23:35,250
Fallible, were you able to find any others in there?

225
00:23:35,250 --> 00:23:40,610
If not, I know that there's a couple other questions, but I wanted to see if you had one that you pulled out.

226
00:23:40,610 --> 00:23:49,810
So there are some people talking, people are asking more about this, something that you already answered a little bit about how you found that target.

227
00:23:49,810 --> 00:23:53,710
I do have one other slight sidetrack question.

228
00:23:53,710 --> 00:23:56,170
It says that you are a PhD student at Georgia Tech.

229
00:23:56,170 --> 00:23:59,530
Are you willing to tell us what your thesis is about?

230
00:24:00,510 --> 00:24:01,590
Oh, my thesis?

231
00:24:01,590 --> 00:24:03,770
Okay, so that is my worry.

232
00:24:03,770 --> 00:24:06,700
Okay , so I'm kind of...

233
00:24:07,570 --> 00:24:08,490
You can say no.

234
00:24:09,330 --> 00:24:16,890
I see myself as a kind of a hacker, which means whenever I find something interesting, I will try to hack them.

235
00:24:16,890 --> 00:24:25,770
So that's why previously I do some hacks in the software-defined networks, which gave people an impression that I'm working on network security.

236
00:24:25,770 --> 00:24:33,830
And now I'm attacking the Node.js, so people may think, okay, so you are doing some web application security, right?

237
00:24:33,830 --> 00:24:47,490
Yeah, but actually, I can tell you guys that my next goal may be in the hypervisor, which is I'm going to work on something else at the X86 virtualization.

238
00:24:47,490 --> 00:25:00,130
So I don't know what's going to be my thesis topic, because traditionally people will have a unique or unified topic for their thesis.

239
00:25:00,130 --> 00:25:09,030
But for me, it's more about hacking and building tools to detect those annoying issues.

240
00:25:10,870 --> 00:25:16,810
So you're still trying to narrow down exactly what you want your thesis to be, huh?

241
00:25:16,810 --> 00:25:17,290
Yeah.

242
00:25:17,290 --> 00:25:19,090
That's exciting.

243
00:25:25,280 --> 00:25:32,160
So Angel Ray asks, what's the biggest surprise you came across when doing this research?

244
00:25:34,680 --> 00:25:40,160
So there's a lot of moments that I think really makes me happy.

245
00:25:40,160 --> 00:25:50,820
For example, the moments I find the vulnerabilities from some widely used programs, such as MongoDB or something else.

246
00:25:50,820 --> 00:25:54,080
So that is some moments that make me really happy.

247
00:25:54,080 --> 00:26:06,040
And also, when I found that my talk was accepted by DevCon, that also made me really excited.

248
00:26:10,710 --> 00:26:11,910
Excellent.

249
00:26:14,050 --> 00:26:14,970
Okay.

250
00:26:15,070 --> 00:26:16,670
What else do we have?

251
00:26:16,670 --> 00:26:21,870
There's a lot of people in there chatting, talking some good stuff for you here, Feng.

252
00:26:25,970 --> 00:26:36,910
How about one question is that for people who haven't really done vulnerability research, what's your advice on how somebody can pick a target?

253
00:26:37,210 --> 00:26:40,510
Your research here is on Node.js.

254
00:26:40,510 --> 00:26:46,410
But if somebody else wants to do vulnerability research, how should they go about starting that and choosing a target for that?

255
00:26:46,830 --> 00:26:48,490
Thanks for the question.

256
00:26:50,230 --> 00:26:53,710
I have been working on vulnerability research for a while.

257
00:26:53,710 --> 00:27:05,830
So my experience or my suggestion is that I can conclude two kinds of vulnerabilities that people may want to take a look at.

258
00:27:05,830 --> 00:27:11,370
So the first kind of vulnerability is like something in our talk.

259
00:27:11,370 --> 00:27:13,670
It's about some logic bugs.

260
00:27:13,670 --> 00:27:21,910
And people can find some ways to exploit those vulnerabilities and manipulate the program logics.

261
00:27:21,910 --> 00:27:23,690
So that's one direction.

262
00:27:23,690 --> 00:27:42,350
And usually it is hard to directly find those vulnerabilities without knowing the internal logics of the applications.

263
00:27:42,550 --> 00:27:53,150
And the second category of vulnerability finding can be in the binary vulnerabilities, which is something like memory corruption.

264
00:27:53,470 --> 00:28:00,650
And nowadays there's a lot of research using automatic tools like fuzzers to find those vulnerabilities.

265
00:28:00,650 --> 00:28:14,730
So those vulnerabilities actually, it is kind of a more easier job because there's already some well-established concepts and tools, such as AFL or something else.

266
00:28:14,730 --> 00:28:23,210
So maybe if you are new to the vulnerability finding, you may also take a look at those fuzzing things.

267
00:28:23,210 --> 00:28:26,170
So you may find some interesting results.

268
00:28:26,470 --> 00:28:29,330
In fact, vulnerabilities are everywhere, right?

269
00:28:29,330 --> 00:28:34,350
So if you use those fuzz, you can get some results.

270
00:28:34,450 --> 00:28:35,490
Excellent.

271
00:28:36,030 --> 00:28:36,990
All right.

272
00:28:36,990 --> 00:28:39,310
Looks like we're coming down to the end here.

273
00:28:39,310 --> 00:28:40,550
This has flown right by.

274
00:28:40,550 --> 00:28:42,370
We only got a couple minutes left with you.

275
00:28:42,370 --> 00:28:51,310
So if anybody else has any questions that they want to get into, put those on the TrackOneLive QA Discord channel.

276
00:28:51,490 --> 00:28:52,490
Yeah, are you going to...

277
00:28:52,490 --> 00:29:00,190
The question I would finish up with would be, do you have a call to action for those of us watching?

278
00:29:00,190 --> 00:29:08,430
Do you have something that, additional research you would like somebody else to look at that's tangentially related to what you work on?

279
00:29:08,430 --> 00:29:16,710
Or how would you point other folks who are interested in this subject towards more?

280
00:29:17,350 --> 00:29:20,030
You mean more in Node.js?

281
00:29:21,250 --> 00:29:28,870
Yes, or even specifically related to the attacks you have shown.

282
00:29:29,870 --> 00:29:38,790
Yeah, so for Node.js, I mean, there are some related attacks that people may be interested in looking at.

283
00:29:38,790 --> 00:29:41,090
So I can list it here.

284
00:29:41,090 --> 00:29:43,970
So, for example, product evolution.

285
00:29:43,970 --> 00:29:46,470
Yes, so you may want to take a look at it.

286
00:29:46,470 --> 00:29:53,370
And after you're looking at that, you may find that there are some connections or some differences between this and our talk.

287
00:29:53,390 --> 00:30:06,730
And after prototype pollutions, you may also want to take a look at some well-known denial-of-service attacks in Node.js.

288
00:30:07,210 --> 00:30:15,810
Denial-of-service attack is really a big issue for Node.js due to the single-thread event handling model.

289
00:30:15,810 --> 00:30:25,810
So if you search keywords like EOS or Node.js, you can find a lot of useful results about how people attack the Node.js applications.

290
00:30:26,090 --> 00:30:30,730
So that's kind of two research that I would like to mention here.

291
00:30:31,410 --> 00:30:32,750
I appreciate that.

292
00:30:32,750 --> 00:30:33,550
Thank you.

293
00:30:33,550 --> 00:30:40,470
So I really appreciate your willingness to come and, first off, give a presentation here at DEF CON.

294
00:30:40,470 --> 00:30:49,230
This is one of those community events that only happens because of the people like yourself who come out and do the research and do the presentations.

295
00:30:49,230 --> 00:30:50,190
So thank you very much.

296
00:30:50,190 --> 00:30:54,730
And thank you for being our guinea pig on our QA streaming here.

297
00:30:54,730 --> 00:31:09,410
If anybody has any additional questions, we can continue to attempt to get those over, or I would recommend looking at the Twitter account that I did link in the TrackOne channel.

298
00:31:09,410 --> 00:31:12,350
Otherwise, we will go ahead and wrap this up.

299
00:31:12,350 --> 00:31:19,450
Thank you everyone who had suggestions and considerations here, and we'll go ahead and sign off.

300
00:31:19,450 --> 00:31:20,410
So thank you all.

301
00:31:20,410 --> 00:31:21,310
Big wave.

302
00:31:21,730 --> 00:31:22,130
Thanks, Will.

303
00:31:22,130 --> 00:31:22,750
Thank you.