You're looking at the side of my head.
Everything's kind of weird and purple.
Does it show up the same way for you?
You're looking at the side of my head.
Everything's kind of weird and purple.
Does it show up the same way for you?
Mute.
Awesome.
All right, well, it is 9.30,
so we can get started with the first Q&A of the day
here at DEF CON Safe Mode.
My name is PLiberty9.
I'm here with my fellow goon, Fallible.
Hey, Fallible.
Greetings.
And we are also here with our first speaker of the day.
We are here with Feng Xiao,
who is going to answer your questions
all about his presentation,
Discovering Hidden Properties to Attack the Node.js Ecosystem.
Hey, Feng, how's it going?
Hi.
Hi, good.
How are you guys?
We're doing great.
It's awesome to have you here.
Watched your presentation.
You did an incredible job with that.
Highly recommend that people go check that out.
It's available on YouTube.
DEF CON has those videos up.
And you can also ask questions to Feng
on the Discord channel at the TrackOneLiveQA channel.
So yeah, we have a few questions that are coming in,
so we can ask him some of those questions.
Let's see.
Let me actually start with one.
Let me get this one out there as a start.
So this is not your first time presenting at DEF CON, is it?
So how many times have you given DEF CON presentations?
Okay, so before the SIGMO talk,
I only came to DEF CON once,
and that is my first time SIGMO talk.
It's in 2018.
So in that talk, I present some new vulnerabilities
that I discussed in software-defined networks.
So this is actually my second time at DEF CON.
That's fantastic, and we're really glad you decided to come back and join us again.
Somebody was trying to ask if we were going to do first-time rituals with you,
but we don't have to, because you're an old hat with this.
You've already done that, so that's awesome.
Let's see, we've got some questions coming in yet.
Feng, one of the questions that we were kind of wondering about
with your research that you did on the node.js ecosystem
is what type of people should use the tool that you released?
I know you mentioned the tool in your presentation.
Maybe you want to mention that a little bit,
and what kind of people should be using that sort of thing?
Yeah, so this is... according to our research,
we found this is kind of widespread problems,
and many Git report or PM project has this problem.
So we believe that there are two kinds of people that may want to use this tool.
The first kind of people is about the developers.
I believe they can use this tool to detect
their own software, so that they can catch and discover
all these hidden properties before they release a version.
And a second type of people that we think can use this tool
is some white hats, pen testers, or hackers.
When they want to do some security analysis,
maybe they can use this tool to detect some vulnerabilities
or problems within their targets.
Yes.
Excellent. All right.
Sorry, people have noticed that we're a little bit weird on our adjustments.
We're trying to get that fixed as we go.
Enjoy the testing and production. Sorry about that, folks.
Yeah, for sure.
Let's see.
So, also, Feng, one of the things that you mentioned in the presentation
where you had this discovery in Node.js,
you also referenced Ruby on Rails and PHP.
So, does it exist in those languages and platforms?
And could it exist possibly in others?
Should people try to go find this same vulnerability in other platforms?
Okay, thanks for the question.
So, as you guys have already observed in my presentations,
the root cause of those vulnerabilities mainly comes from object sharing.
So, if a language platform has such a feature,
or some applications are using some kind of object sharing,
then they could have a problem there.
But why we are studying Node.js here is because
to use the language, the flexibilities of JavaScript,
the object, it can be really flexible.
So, this empowers the hackers to propagate a lot of bad things into the programs.
So, that's why we are studying Node.js.
And we believe maybe there are other problems that are not discovered yet.
But I think it is really a good direction to also explore this in other languages as well.
Excellent.
Alright, checking for some more questions from the audience.
Here, I'll check for questions.
Blavrty, would you see if you can get him, get that video up just a little bit higher too?
Yeah, I think...
One thing, I'm going to turn my camera off and just see if that bumps him up.
I'm going to try the same.
Oh yeah, now we are looking at who we want to actually see.
Right, exactly. No one wants to see our faces.
Alright.
Cool, okay, back over. Let's see what else the community has to say.
Okay.
So yeah, Deadly Cob wants to know, when will the tool be released?
He says, or this person says, they are only seeing a coming soon on the repo at the moment.
Okay, yeah, thanks for the question.
So that is one thing that I would like to mention in the Q&A.
So, for now, as you guys may have observed from the presentations,
there are several components in my talk, in the tools.
And honestly, from the perspective of user experience, it's not that well designed,
so you have to print and type in some kind to use it.
So what we are doing now is, first, we are cleaning up the project code,
and also we are making documents for it.
So probably a short answer is that we are going to release it no later by the end of August.
Oh, excellent. So that's great to hear.
Alright, let's see that. Okay, cool.
Let's see, who else do we have on there that wants to ask questions of our first speaker?
Yeah, when an OK text is coming in,
would it be possible to talk more about the differences between HPA and prototype pollution?
Okay, cool, thanks. Thanks for the question.
And so, for prototype pollution in JavaScript,
we are talking about some kind of a text that tempers the prototype object,
which is a special type of object in the JavaScript languages.
However, in our attack, that is not our target.
For example, in our attack, we are tying some user application-specific attributes or something else.
And also, you may already see, as you may already heard from my presentations,
we have something that is closely related to the prototype,
but it's not about modifying the prototype.
Instead, we are trying to forge some attributes that can be found on the prototype
and hijack the inheritance chain.
So, yes, there is a big difference between HPA and prototype pollution.
Excellent. Thanks for that question, OKTux.
All right. Let's see.
And I know sometimes when you give a presentation,
I know from experience that sometimes you have to kind of leave things out,
that you really want to focus on the main issues.
Was there any kind of like extra tips or extra things that if you had more time,
that you might have included anything else that maybe people can think about
with regard to the vulnerabilities that you found,
or anything else that they can kind of think about around your research?
Yeah, so due to the time constraint, we always have to remove some very interesting things from the talk.
And to be honest, if I have time, I really want to case study every vulnerability within the research,
because that's what people are maybe expecting,
and I think those probabilities are really interesting.
So my answer is the first thing that I come up with when I want to add more to it,
it is about those vulnerability case studies.
Excellent. Is there anything that maybe other people who enjoyed your research
could also kind of dig in and take a look at and possibly look for as well?
So I know a lot of times people just want to kind of add on to research that they find,
and they're like, that's really great stuff, maybe I can find the next thing with that.
When you were doing your research, did you have other ideas of things that maybe you didn't have time to look into,
and maybe other people would have time to kind of help out with?
Yeah, so I think I can share with you some ideas about Node.js.
So for Node.js, I found a lot of interesting applications.
For example, I found that many applications are now deployed in the serverless platform.
So I think that could be an interesting direction.
Yes, so this is kind of a new environment, different from the traditional server environments.
And there's a lot of Node.js programs running in the serverless platform.
So yeah, maybe that could be one interesting direction.
And maybe somebody can hear my thoughts.
Maybe they can come up with some great ideas and present them in next year's DevCon.
And I will be happy to see that.
That's excellent. All right.
Looking for more questions that people have for you here.
As we all attempt to figure out our settings here.
Thank you everybody, and especially Bung for joining us for this chaos of figuring out how to get this stream to work properly.
You're our first guinea pig.
And thank you everybody in the stream chat telling us some suggestions of how to fix stuff.
We'll also go in and see if we can kill our Discord notification noises.
So Bung, do you have any other thoughts about...
I know that you kind of hit this already, but is there anything in the talk that you would have liked to have included, but you didn't get a chance to give to us in your presentation so far?
So, there's a lot of details, right?
You know, I researched for a large project. Actually, I have been working on this project for almost about one year.
So there's a lot of details and things I would like to add to it.
Actually, a good thing about that is we are going to release our code, right?
So many people can know a lot of details about our research.
Also, we have the time to release our white paper, and I have been working on it for a while.
So, if it is possible, I can also share my Twitter account.
So maybe people who are interested in this research can follow me, or I can also follow back.
And I will update the status of this work when I release something new.
That's a good idea. I'm sure there's a lot of people who would be interested in knowing more about that.
And good work. We'll make sure we get that out to anybody who wants to see it.
Actually, we'll probably post that in the TrackOne channel.
So I'll get that in there while we keep chatting.
Alright, so you told us some of what you've been working on. You told us what you're aiming at to do next.
It sounds like you're open for more people to come up with other thoughts and some other research directions for you.
I'm sure I would like to know, and I'm sure some other folks would like to know as well,
are you open for... I guess I'm not sure exactly where I was trying to go on that one.
Other than, if people want to come to you and talk about this further, you've given them your Twitter.
There's a... well, let me step back. I'll think of my question a little bit harder and come up with another one.
In the meantime, tell us more about how you came upon this research.
Oh, you mean how do I discover all these things, right?
Please.
Yeah, so the process I discovered this vulnerability is kind of like...
since I'm enjoying eyeballing the source codes of an open source project to discover vulnerabilities.
So when I take a look at some of my targets, I kind of discover some properties that's kind of like...
okay, it seems that I can modify them, but there's no document, API documentation mentioned about them.
So that's why I just try to include those properties.
And in terms of that, yes, I can override those original values and do something bad.
This is just the very beginning of our multi-making cases of that.
So that's why we come up with our new tools.
That's an interesting way.
So it sounds like then you spend a certain amount of your time as you're doing whatever your day job is,
hunting around and finding ways that things are broken.
So can you give us a little bit more thought into some of the other folks who are coming up
and working on their own projects.
How do you identify when you are finding something that would be a good DEF CON talk?
How do you identify something that you'd like to pursue further?
Okay, thanks for the question.
So I would say, yeah, I have some thoughts about how to make a DEF CON talk or Black Hat talk like that.
So for me, if I can find some results or some new findings,
which I think, first, this can be used in some real-world settings.
For example, if I found some vulnerabilities that is exploitable in the production environment,
I would say, yes, this could be some DEF CON or Black Hat talk.
And also, if you really think this is a widespread or widely seen problem,
maybe you should consider building something, some tools or at least some screens,
so that people can use your tools or use your things and make all the process of discovering vulnerabilities easier.
Yes, so that's two things I think could be useful.
I like that. So you're starting small and you're building up things that are potentially useful.
And then once you have small things that you can start to release,
you start to build a community around that, build additional motivation, additional activity.
Yeah.
Yeah, I think also it's great to point out one of the points that Phuong just made.
When you start thinking about what is going to be good research and showing it around,
I know a lot of times people think like, this is not really interesting to anybody else but me,
and it's not going to make a great talk anywhere. And I know a lot of people have that kind of thought.
And my experience has always been that there's definitely other people that want to hear your research,
and that you should definitely try to share that kind of information and research anywhere you can.
So that was a great point that Phuong was making up, giving to us there.
There is also another question for you here that seems interesting from Soft Tortilla,
that wants to know, can you elaborate on the expected difficulty of getting those 12 CVEs patched?
Do you think there's going to be much difficulty with getting those fixed?
Oh, that's an interesting question. Yes.
So for the vulnerability patching process, I do have some words to share with you guys.
So, yes, at the very beginning, I found that people are not expecting those vulnerabilities.
And they just think that, OK, so this seems like some minor issues, I don't want to patch it.
But things go very differently after all my research proceed.
So I found more and more, and many people in the industry, companies start to look at these problems.
And after things become in these ways, things change.
For example, there are some commercial scanners starting to alert such vulnerabilities.
And some vendors who previously declined to patch those bugs have to patch them now.
Because those vulnerability scanners start to say something like,
whoa, this has vulnerabilities, you cannot use those libraries.
So yes, this is kind of like a process that nobody knows your research, and you are kind of like nobody.
But after you are getting more results, people are starting to look at it.
And they will say, whoa, this is really interesting and important problems, and I want to patch it.
Because it is already affecting our package usage.
Excellent. And you also, at the beginning of that, mentioned that sometimes people think like,
this isn't a big deal, so I'm not going to bother patching it.
But for people that might not have seen your presentation yet,
I believe that you were able to take user input, bypass protections,
and were you able to show SQL injection during your presentation?
Excuse me?
And how far were you able to kind of... and how critical were the vulnerabilities
that you were able to kind of take the exploits that you were doing in your presentation?
Like some of the exploits that you were able to do, and how far were you able to take it?
Yeah, so the final attack effects really depends on the type of those attack targets, right?
So for the case study or the motivating example in our presentations,
we are attacking some web frameworks.
So we can build examples to demonstrate to people that, okay, you see, if we bypass this,
if we bypass your protections, we can do something really bad.
But for some other modules, the attack effects seems more vague,
which means people will say, well, it seems like some minor logic bugs,
but it turns out that those minor logic bugs also can be a really big problem
when they are being exploited with other modules.
Excellent.
Let's see.
Fallible, were you able to find any others in there?
If not, I know that there's a couple other questions, but I wanted to see if you had one that you pulled out.
So there are some people talking, people are asking more about this,
something that you already answered a little bit about how you found that target.
I do have one other slight sidetrack question.
It says that you are a PhD student at Georgia Tech.
Are you willing to tell us what your thesis is about?
Oh, my thesis?
Okay, so that is my worry.
Okay, so I'm kind of...
You can say no.
I see myself as a kind of a hacker, which means whenever I find something interesting,
I will try to hack them.
So that's why previously I do some hacks in the software-defined networks,
which gave people an impression that I'm working on network security.
And now I'm attacking the Node.js, so people may think,
okay, so you are doing some web application security, right?
Yeah, but actually, I can tell you guys that my next goal may be in the hypervisor,
which is I'm going to work on something else at the X86 virtualization.
So I don't know what's going to be my thesis topic,
because traditionally people will have a unique or unified topic for their thesis.
But for me, it's more about hacking and building tools to detect those annoying issues.
So you're still trying to narrow down exactly what you want your thesis to be, huh?
Yeah.
That's exciting.
So Angel Ray asks, what's the biggest surprise you came across when doing this research?
So there's a lot of moments that I think really makes me happy.
For example, the moments I find the vulnerabilities from some widely used programs,
such as MongoDB or something else.
So that is some moments that make me really happy.
And also, when I found that my talk was accepted by DevCon,
that also made me really excited.
Excellent.
Okay.
What else do we have?
There's a lot of people in there chatting, talking some good stuff for you here, Feng.
How about one question is that for people who haven't really done vulnerability research,
what's your advice on how somebody can pick a target?
Your research here is on Node.js.
But if somebody else wants to do vulnerability research,
how should they go about starting that and choosing a target for that?
Thanks for the question.
I have been working on vulnerability research for a while.
So my experience or my suggestion is that I can conclude two kinds of vulnerabilities
that people may want to take a look at.
So the first kind of vulnerability is like something in our talk.
It's about some logic bugs.
And people can find some ways to exploit those vulnerabilities
and manipulate the program logics.
So that's one direction.
And usually it is hard to directly find those vulnerabilities
without knowing the internal logics of the applications.
And the second category of vulnerability finding can be in the binary vulnerabilities,
which is something like memory corruption.
And nowadays there's a lot of research using automatic tools like fuzzers to find those vulnerabilities.
So those vulnerabilities actually, it is kind of a more easier job
because there's already some well-established concepts and tools,
such as AFL or something else.
So maybe if you are new to the vulnerability finding,
you may also take a look at those fuzzing things.
So you may find some interesting results.
In fact, vulnerabilities are everywhere, right?
So if you use those fuzz, you can get some results.
Excellent.
All right.
Looks like we're coming down to the end here.
This has flown right by.
We only got a couple minutes left with you.
So if anybody else has any questions that they want to get into,
put those on the TrackOneLive QA Discord channel.
Yeah, are you going to...
The question I would finish up with would be,
do you have a call to action for those of us watching?
Do you have something that,
additional research you would like somebody else to look at
that's tangentially related to what you work on?
Or how would you point other folks who are interested in this subject
towards more?
You mean more in Node.js?
Yes, or even specifically related to the attacks you have shown.
Yeah, so for Node.js, I mean,
there are some related attacks that people may be interested in looking at.
So I can list it here.
So, for example, product evolution.
Yes, so you may want to take a look at it.
And after you're looking at that,
you may find that there are some connections or some differences between this and our talk.
And after prototype pollutions,
you may also want to take a look at some well-known denial-of-service attacks in Node.js.
Denial-of-service attack is really a big issue for Node.js
due to the single-thread event handling model.
So if you search keywords like EOS or Node.js,
you can find a lot of useful results about how people attack the Node.js applications.
So that's kind of two research that I would like to mention here.
I appreciate that. Thank you.
So I really appreciate your willingness to come and, first off,
give a presentation here at DEF CON.
This is one of those community events that only happens because of the people like yourself
who come out and do the research and do the presentations.
So thank you very much.
And thank you for being our guinea pig on our QA streaming here.
If anybody has any additional questions,
we can continue to attempt to get those over,
or I would recommend looking at the Twitter account that I did link in the TrackOne channel.
Otherwise, we will go ahead and wrap this up.
Thank you everyone who had suggestions and considerations here,
and we'll go ahead and sign off.
So thank you all. Big wave.
Thanks, Will.
Thank you.