start	end	text
15720	17840	You're looking at the side of my head.
18020	19680	Everything's kind of weird and purple.
19680	21040	Does it show up the same way for you?
21060	23100	You're looking at the side of my head.
23400	24900	Everything's kind of weird and purple.
24900	26340	Does it show up the same way for you?
26660	27460	Mute.
37470	38270	Awesome.
39470	42750	All right, well, it is 9.30,
42750	46850	so we can get started with the first Q&A of the day
46850	49010	here at DEF CON Safe Mode.
49010	50030	My name is PLiberty9.
50030	52870	I'm here with my fellow goon, Fallible.
52870	53770	Hey, Fallible.
54210	55170	Greetings.
55690	59150	And we are also here with our first speaker of the day.
59150	61090	We are here with Feng Xiao,
61090	62790	who is going to answer your questions
62790	64530	all about his presentation,
64530	69470	Discovering Hidden Properties to Attack the Node.js Ecosystem.
69470	70570	Hey, Feng, how's it going?
70570	71210	Hi.
71210	72110	Hi, good.
72110	73210	How are you guys?
73210	74570	We're doing great.
74570	75890	It's awesome to have you here.
75890	77310	Watched your presentation.
77310	79210	You did an incredible job with that.
79210	82030	Highly recommend that people go check that out.
82030	84490	It's available on YouTube.
84490	87070	DEF CON has those videos up.
87350	90530	And you can also ask questions to Feng
90530	95950	on the Discord channel at the TrackOneLiveQA channel.
95950	99130	So yeah, we have a few questions that are coming in,
99130	102830	so we can ask him some of those questions.
103330	104210	Let's see.
104210	105610	Let me actually start with one.
105610	107370	Let me get this one out there as a start.
107370	110730	So this is not your first time presenting at DEF CON, is it?
110730	113990	So how many times have you given DEF CON presentations?
115050	118070	Okay, so before the SIGMO talk,
118070	120470	I only came to DEF CON once,
120470	124170	and that is my first time SIGMO talk.
124170	126710	It's in 2018.
127010	131510	So in that talk, I present some new vulnerabilities
131510	135610	that I discussed in software-defined networks.
135850	139330	So this is actually my second time at DEF CON.
140310	144650	That's fantastic, and we're really glad you decided to come back and join us again.
145550	151090	Somebody was trying to ask if we were going to do first-time rituals with you,
151090	154810	but we don't have to, because you're an old hat with this.
155910	158050	You've already done that, so that's awesome.
159070	162350	Let's see, we've got some questions coming in yet.
162370	166310	Feng, one of the questions that we were kind of wondering about
166310	170450	with your research that you did on the node.js ecosystem
171970	176830	is what type of people should use the tool that you released?
176950	179530	I know you mentioned the tool in your presentation.
179530	181790	Maybe you want to mention that a little bit,
181790	184730	and what kind of people should be using that sort of thing?
185790	191170	Yeah, so this is... according to our research,
191170	194890	we found this is kind of widespread problems,
194890	200290	and many Git report or PM project has this problem.
200290	204970	So we believe that there are two kinds of people that may want to use this tool.
204990	210790	The first kind of people is about the developers.
210850	213650	I believe they can use this tool to detect
213650	219470	their own software, so that they can catch and discover
219470	223570	all these hidden properties before they release a version.
223770	228190	And a second type of people that we think can use this tool
228190	233450	is some white hats, pen testers, or hackers.
233450	237810	When they want to do some security analysis,
237810	241810	maybe they can use this tool to detect some vulnerabilities
241810	244850	or problems within their targets.
245070	245570	Yes.
246030	248010	Excellent. All right.
249310	253950	Sorry, people have noticed that we're a little bit weird on our adjustments.
253950	255910	We're trying to get that fixed as we go.
256330	258890	Enjoy the testing and production. Sorry about that, folks.
260310	261410	Yeah, for sure.
262790	263830	Let's see.
264050	269370	So, also, Feng, one of the things that you mentioned in the presentation
269370	273390	where you had this discovery in Node.js,
273390	277610	you also referenced Ruby on Rails and PHP.
278130	282030	So, does it exist in those languages and platforms?
282030	284410	And could it exist possibly in others?
284410	289250	Should people try to go find this same vulnerability in other platforms?
289670	291470	Okay, thanks for the question.
291470	297050	So, as you guys have already observed in my presentations,
297050	305160	the root cause of those vulnerabilities mainly comes from object sharing.
305670	309790	So, if a language platform has such a feature,
309790	315190	or some applications are using some kind of object sharing,
315190	317590	then they could have a problem there.
317590	322530	But why we are studying Node.js here is because
322530	327530	to use the language, the flexibilities of JavaScript,
328190	331170	the object, it can be really flexible.
331170	339890	So, this empowers the hackers to propagate a lot of bad things into the programs.
339890	342750	So, that's why we are studying Node.js.
342750	350790	And we believe maybe there are other problems that are not discovered yet.
350790	359030	But I think it is really a good direction to also explore this in other languages as well.
359710	360670	Excellent.
361390	365770	Alright, checking for some more questions from the audience.
366730	368830	Here, I'll check for questions.
368850	373830	Blavrty, would you see if you can get him, get that video up just a little bit higher too?
373830	374630	Yeah, I think...
374630	379690	One thing, I'm going to turn my camera off and just see if that bumps him up.
380130	381610	I'm going to try the same.
392000	394900	Oh yeah, now we are looking at who we want to actually see.
394900	397320	Right, exactly. No one wants to see our faces.
402430	403230	Alright.
405150	409810	Cool, okay, back over. Let's see what else the community has to say.
411690	412610	Okay.
413510	418350	So yeah, Deadly Cob wants to know, when will the tool be released?
418350	423830	He says, or this person says, they are only seeing a coming soon on the repo at the moment.
424610	426210	Okay, yeah, thanks for the question.
426210	430090	So that is one thing that I would like to mention in the Q&A.
430270	435530	So, for now, as you guys may have observed from the presentations,
435530	441770	there are several components in my talk, in the tools.
442050	449090	And honestly, from the perspective of user experience, it's not that well designed,
449090	452570	so you have to print and type in some kind to use it.
452570	457290	So what we are doing now is, first, we are cleaning up the project code,
457290	461730	and also we are making documents for it.
461730	470830	So probably a short answer is that we are going to release it no later by the end of August.
470910	474070	Oh, excellent. So that's great to hear.
474970	480150	Alright, let's see that. Okay, cool.
480730	490390	Let's see, who else do we have on there that wants to ask questions of our first speaker?
490390	493170	Yeah, when an OK text is coming in,
493170	498150	would it be possible to talk more about the differences between HPA and prototype pollution?
498730	501430	Okay, cool, thanks. Thanks for the question.
501430	511250	And so, for prototype pollution in JavaScript,
511250	517150	we are talking about some kind of a text that tempers the prototype object,
517150	521530	which is a special type of object in the JavaScript languages.
521930	525910	However, in our attack, that is not our target.
526030	534970	For example, in our attack, we are tying some user application-specific attributes or something else.
534970	542770	And also, you may already see, as you may already heard from my presentations,
542770	546530	we have something that is closely related to the prototype,
546530	550610	but it's not about modifying the prototype.
550610	556830	Instead, we are trying to forge some attributes that can be found on the prototype
556830	559790	and hijack the inheritance chain.
559790	566790	So, yes, there is a big difference between HPA and prototype pollution.
567130	571390	Excellent. Thanks for that question, OKTux.
571390	575510	All right. Let's see.
577310	581070	And I know sometimes when you give a presentation,
581070	584370	I know from experience that sometimes you have to kind of leave things out,
584370	587230	that you really want to focus on the main issues.
587230	592910	Was there any kind of like extra tips or extra things that if you had more time,
592910	596370	that you might have included anything else that maybe people can think about
596370	599250	with regard to the vulnerabilities that you found,
599250	602910	or anything else that they can kind of think about around your research?
603630	612750	Yeah, so due to the time constraint, we always have to remove some very interesting things from the talk.
612750	621350	And to be honest, if I have time, I really want to case study every vulnerability within the research,
621350	624770	because that's what people are maybe expecting,
624770	629790	and I think those probabilities are really interesting.
629890	635310	So my answer is the first thing that I come up with when I want to add more to it,
635310	638410	it is about those vulnerability case studies.
639470	644130	Excellent. Is there anything that maybe other people who enjoyed your research
644130	649150	could also kind of dig in and take a look at and possibly look for as well?
649490	653870	So I know a lot of times people just want to kind of add on to research that they find,
653870	658530	and they're like, that's really great stuff, maybe I can find the next thing with that.
658530	664170	When you were doing your research, did you have other ideas of things that maybe you didn't have time to look into,
664170	667290	and maybe other people would have time to kind of help out with?
668790	676330	Yeah, so I think I can share with you some ideas about Node.js.
676350	683550	So for Node.js, I found a lot of interesting applications.
683550	692790	For example, I found that many applications are now deployed in the serverless platform.
693210	696370	So I think that could be an interesting direction.
696850	705190	Yes, so this is kind of a new environment, different from the traditional server environments.
705390	712430	And there's a lot of Node.js programs running in the serverless platform.
712430	715930	So yeah, maybe that could be one interesting direction.
715930	720670	And maybe somebody can hear my thoughts.
720670	725390	Maybe they can come up with some great ideas and present them in next year's DevCon.
725390	727730	And I will be happy to see that.
729510	732250	That's excellent. All right.
733530	738050	Looking for more questions that people have for you here.
747930	752830	As we all attempt to figure out our settings here.
752830	760770	Thank you everybody, and especially Bung for joining us for this chaos of figuring out how to get this stream to work properly.
760770	763030	You're our first guinea pig.
763570	771910	And thank you everybody in the stream chat telling us some suggestions of how to fix stuff.
772490	776330	We'll also go in and see if we can kill our Discord notification noises.
789490	792610	So Bung, do you have any other thoughts about...
793150	804570	I know that you kind of hit this already, but is there anything in the talk that you would have liked to have included, but you didn't get a chance to give to us in your presentation so far?
806510	811090	So, there's a lot of details, right?
811570	819790	You know, I researched for a large project. Actually, I have been working on this project for almost about one year.
819790	823850	So there's a lot of details and things I would like to add to it.
823850	829670	Actually, a good thing about that is we are going to release our code, right?
829670	834910	So many people can know a lot of details about our research.
835750	842750	Also, we have the time to release our white paper, and I have been working on it for a while.
842890	852170	So, if it is possible, I can also share my Twitter account.
852230	858650	So maybe people who are interested in this research can follow me, or I can also follow back.
858650	867410	And I will update the status of this work when I release something new.
868890	873330	That's a good idea. I'm sure there's a lot of people who would be interested in knowing more about that.
873330	878430	And good work. We'll make sure we get that out to anybody who wants to see it.
878430	883090	Actually, we'll probably post that in the TrackOne channel.
884850	888270	So I'll get that in there while we keep chatting.
898690	904230	Alright, so you told us some of what you've been working on. You told us what you're aiming at to do next.
906510	913670	It sounds like you're open for more people to come up with other thoughts and some other research directions for you.
913990	919470	I'm sure I would like to know, and I'm sure some other folks would like to know as well,
919470	926930	are you open for... I guess I'm not sure exactly where I was trying to go on that one.
926930	935630	Other than, if people want to come to you and talk about this further, you've given them your Twitter.
938550	943950	There's a... well, let me step back. I'll think of my question a little bit harder and come up with another one.
943950	952850	In the meantime, tell us more about how you came upon this research.
954510	959370	Oh, you mean how do I discover all these things, right?
962230	963190	Please.
964190	972670	Yeah, so the process I discovered this vulnerability is kind of like...
972670	982150	since I'm enjoying eyeballing the source codes of an open source project to discover vulnerabilities.
982150	990650	So when I take a look at some of my targets, I kind of discover some properties that's kind of like...
990650	1003210	okay, it seems that I can modify them, but there's no document, API documentation mentioned about them.
1003210	1007470	So that's why I just try to include those properties.
1007470	1016110	And in terms of that, yes, I can override those original values and do something bad.
1016110	1021970	This is just the very beginning of our multi-making cases of that.
1021970	1025390	So that's why we come up with our new tools.
1027510	1029110	That's an interesting way.
1029110	1037070	So it sounds like then you spend a certain amount of your time as you're doing whatever your day job is,
1037070	1039910	hunting around and finding ways that things are broken.
1039910	1045530	So can you give us a little bit more thought into some of the other folks who are coming up
1045530	1052250	and working on their own projects.
1052250	1056770	How do you identify when you are finding something that would be a good DEF CON talk?
1056770	1060690	How do you identify something that you'd like to pursue further?
1061410	1063630	Okay, thanks for the question.
1063630	1073210	So I would say, yeah, I have some thoughts about how to make a DEF CON talk or Black Hat talk like that.
1073210	1079330	So for me, if I can find some results or some new findings,
1079330	1084370	which I think, first, this can be used in some real-world settings.
1084370	1089150	For example, if I found some vulnerabilities that is exploitable in the production environment,
1089150	1093910	I would say, yes, this could be some DEF CON or Black Hat talk.
1094390	1102430	And also, if you really think this is a widespread or widely seen problem,
1102430	1110790	maybe you should consider building something, some tools or at least some screens,
1110790	1122790	so that people can use your tools or use your things and make all the process of discovering vulnerabilities easier.
1122790	1126610	Yes, so that's two things I think could be useful.
1126610	1132710	I like that. So you're starting small and you're building up things that are potentially useful.
1132710	1136910	And then once you have small things that you can start to release,
1137210	1143790	you start to build a community around that, build additional motivation, additional activity.
1144530	1145810	Yeah.
1146150	1152470	Yeah, I think also it's great to point out one of the points that Phuong just made.
1152470	1157530	When you start thinking about what is going to be good research and showing it around,
1157530	1162790	I know a lot of times people think like, this is not really interesting to anybody else but me,
1162790	1167490	and it's not going to make a great talk anywhere. And I know a lot of people have that kind of thought.
1167490	1173650	And my experience has always been that there's definitely other people that want to hear your research,
1173650	1178850	and that you should definitely try to share that kind of information and research anywhere you can.
1178850	1183790	So that was a great point that Phuong was making up, giving to us there.
1183790	1189170	There is also another question for you here that seems interesting from Soft Tortilla,
1189170	1195950	that wants to know, can you elaborate on the expected difficulty of getting those 12 CVEs patched?
1195950	1199210	Do you think there's going to be much difficulty with getting those fixed?
1200010	1202370	Oh, that's an interesting question. Yes.
1202370	1208250	So for the vulnerability patching process, I do have some words to share with you guys.
1208250	1214990	So, yes, at the very beginning, I found that people are not expecting those vulnerabilities.
1215310	1222090	And they just think that, OK, so this seems like some minor issues, I don't want to patch it.
1222630	1229530	But things go very differently after all my research proceed.
1229530	1239350	So I found more and more, and many people in the industry, companies start to look at these problems.
1239370	1243270	And after things become in these ways, things change.
1243270	1251870	For example, there are some commercial scanners starting to alert such vulnerabilities.
1251870	1263090	And some vendors who previously declined to patch those bugs have to patch them now.
1263090	1269630	Because those vulnerability scanners start to say something like,
1269630	1273870	whoa, this has vulnerabilities, you cannot use those libraries.
1273870	1280290	So yes, this is kind of like a process that nobody knows your research, and you are kind of like nobody.
1280290	1286710	But after you are getting more results, people are starting to look at it.
1286710	1293770	And they will say, whoa, this is really interesting and important problems, and I want to patch it.
1293770	1298610	Because it is already affecting our package usage.
1299530	1306130	Excellent. And you also, at the beginning of that, mentioned that sometimes people think like,
1306130	1309470	this isn't a big deal, so I'm not going to bother patching it.
1309470	1312710	But for people that might not have seen your presentation yet,
1312710	1317950	I believe that you were able to take user input, bypass protections,
1317950	1322770	and were you able to show SQL injection during your presentation?
1324830	1326230	Excuse me?
1326270	1331510	And how far were you able to kind of... and how critical were the vulnerabilities
1331510	1338270	that you were able to kind of take the exploits that you were doing in your presentation?
1338270	1344210	Like some of the exploits that you were able to do, and how far were you able to take it?
1345870	1355910	Yeah, so the final attack effects really depends on the type of those attack targets, right?
1355910	1362330	So for the case study or the motivating example in our presentations,
1362330	1366710	we are attacking some web frameworks.
1366710	1372570	So we can build examples to demonstrate to people that, okay, you see, if we bypass this,
1372570	1378230	if we bypass your protections, we can do something really bad.
1378230	1385930	But for some other modules, the attack effects seems more vague,
1385930	1393250	which means people will say, well, it seems like some minor logic bugs,
1395690	1401410	but it turns out that those minor logic bugs also can be a really big problem
1402430	1406710	when they are being exploited with other modules.
1407150	1408150	Excellent.
1410390	1411710	Let's see.
1412330	1415250	Fallible, were you able to find any others in there?
1415250	1420610	If not, I know that there's a couple other questions, but I wanted to see if you had one that you pulled out.
1420610	1424850	So there are some people talking, people are asking more about this,
1424850	1429810	something that you already answered a little bit about how you found that target.
1429810	1433710	I do have one other slight sidetrack question.
1433710	1436170	It says that you are a PhD student at Georgia Tech.
1436170	1439530	Are you willing to tell us what your thesis is about?
1440510	1441590	Oh, my thesis?
1441590	1443770	Okay, so that is my worry.
1443770	1446700	Okay, so I'm kind of...
1447570	1448490	You can say no.
1449330	1455310	I see myself as a kind of a hacker, which means whenever I find something interesting,
1455310	1456890	I will try to hack them.
1456890	1461490	So that's why previously I do some hacks in the software-defined networks,
1461490	1465770	which gave people an impression that I'm working on network security.
1465770	1470870	And now I'm attacking the Node.js, so people may think,
1470870	1473830	okay, so you are doing some web application security, right?
1473830	1481210	Yeah, but actually, I can tell you guys that my next goal may be in the hypervisor,
1481210	1487490	which is I'm going to work on something else at the X86 virtualization.
1487490	1492490	So I don't know what's going to be my thesis topic,
1492490	1500130	because traditionally people will have a unique or unified topic for their thesis.
1500130	1509030	But for me, it's more about hacking and building tools to detect those annoying issues.
1510870	1516810	So you're still trying to narrow down exactly what you want your thesis to be, huh?
1516810	1517290	Yeah.
1517290	1519090	That's exciting.
1525280	1532160	So Angel Ray asks, what's the biggest surprise you came across when doing this research?
1534680	1540160	So there's a lot of moments that I think really makes me happy.
1540160	1547640	For example, the moments I find the vulnerabilities from some widely used programs,
1547640	1550820	such as MongoDB or something else.
1550820	1554080	So that is some moments that make me really happy.
1554080	1563720	And also, when I found that my talk was accepted by DevCon,
1563720	1566040	that also made me really excited.
1570710	1571910	Excellent.
1574050	1574970	Okay.
1575070	1576670	What else do we have?
1576670	1581870	There's a lot of people in there chatting, talking some good stuff for you here, Feng.
1585970	1592290	How about one question is that for people who haven't really done vulnerability research,
1592290	1596910	what's your advice on how somebody can pick a target?
1597210	1600510	Your research here is on Node.js.
1600510	1602870	But if somebody else wants to do vulnerability research,
1602870	1606410	how should they go about starting that and choosing a target for that?
1606830	1608490	Thanks for the question.
1610230	1613710	I have been working on vulnerability research for a while.
1613710	1622270	So my experience or my suggestion is that I can conclude two kinds of vulnerabilities
1622270	1625830	that people may want to take a look at.
1625830	1631370	So the first kind of vulnerability is like something in our talk.
1631370	1633670	It's about some logic bugs.
1633670	1638270	And people can find some ways to exploit those vulnerabilities
1638270	1641910	and manipulate the program logics.
1641910	1643690	So that's one direction.
1643690	1656810	And usually it is hard to directly find those vulnerabilities
1656810	1662350	without knowing the internal logics of the applications.
1662550	1670850	And the second category of vulnerability finding can be in the binary vulnerabilities,
1670850	1673150	which is something like memory corruption.
1673470	1680650	And nowadays there's a lot of research using automatic tools like fuzzers to find those vulnerabilities.
1680650	1686210	So those vulnerabilities actually, it is kind of a more easier job
1686210	1691790	because there's already some well-established concepts and tools,
1691790	1694730	such as AFL or something else.
1694730	1699270	So maybe if you are new to the vulnerability finding,
1699270	1703210	you may also take a look at those fuzzing things.
1703210	1706170	So you may find some interesting results.
1706470	1709330	In fact, vulnerabilities are everywhere, right?
1709330	1714350	So if you use those fuzz, you can get some results.
1714450	1715490	Excellent.
1716030	1716990	All right.
1716990	1719310	Looks like we're coming down to the end here.
1719310	1720550	This has flown right by.
1720550	1722370	We only got a couple minutes left with you.
1722370	1725650	So if anybody else has any questions that they want to get into,
1725650	1731310	put those on the TrackOneLive QA Discord channel.
1731490	1732490	Yeah, are you going to...
1732490	1736550	The question I would finish up with would be,
1736550	1740190	do you have a call to action for those of us watching?
1740190	1741990	Do you have something that,
1741990	1745130	additional research you would like somebody else to look at
1745130	1748430	that's tangentially related to what you work on?
1748430	1754830	Or how would you point other folks who are interested in this subject
1754830	1756710	towards more?
1757350	1760030	You mean more in Node.js?
1761250	1768870	Yes, or even specifically related to the attacks you have shown.
1769870	1773690	Yeah, so for Node.js, I mean,
1773690	1778790	there are some related attacks that people may be interested in looking at.
1778790	1781090	So I can list it here.
1781090	1783970	So, for example, product evolution.
1783970	1786470	Yes, so you may want to take a look at it.
1786470	1788390	And after you're looking at that,
1788390	1793370	you may find that there are some connections or some differences between this and our talk.
1793390	1796180	And after prototype pollutions,
1796670	1806730	you may also want to take a look at some well-known denial-of-service attacks in Node.js.
1807210	1811470	Denial-of-service attack is really a big issue for Node.js
1811470	1815810	due to the single-thread event handling model.
1815810	1819750	So if you search keywords like EOS or Node.js,
1819750	1825810	you can find a lot of useful results about how people attack the Node.js applications.
1826090	1830730	So that's kind of two research that I would like to mention here.
1831410	1833550	I appreciate that. Thank you.
1833550	1838350	So I really appreciate your willingness to come and, first off,
1838350	1840470	give a presentation here at DEF CON.
1840470	1845610	This is one of those community events that only happens because of the people like yourself
1845610	1849230	who come out and do the research and do the presentations.
1849230	1850190	So thank you very much.
1850190	1854730	And thank you for being our guinea pig on our QA streaming here.
1854730	1857190	If anybody has any additional questions,
1857190	1861170	we can continue to attempt to get those over,
1861170	1869410	or I would recommend looking at the Twitter account that I did link in the TrackOne channel.
1869410	1872350	Otherwise, we will go ahead and wrap this up.
1872350	1877730	Thank you everyone who had suggestions and considerations here,
1877730	1879450	and we'll go ahead and sign off.
1879450	1881310	So thank you all. Big wave.
1881730	1882130	Thanks, Will.
1882130	1882750	Thank you.