WEBVTT 00:15.720 --> 00:17.840 You're looking at the side of my head. 00:18.020 --> 00:19.680 Everything's kind of weird and purple. 00:19.680 --> 00:21.040 Does it show up the same way for you? 00:21.060 --> 00:23.100 You're looking at the side of my head. 00:23.400 --> 00:24.900 Everything's kind of weird and purple. 00:24.900 --> 00:26.340 Does it show up the same way for you? 00:26.660 --> 00:27.460 Mute. 00:37.470 --> 00:38.270 Awesome. 00:39.470 --> 00:49.010 All right, well, it is 9.30, so we can get started with the first Q&A of the day here at DEF CON Safe Mode. 00:49.010 --> 00:50.030 My name is PLiberty9. 00:50.030 --> 00:52.870 I'm here with my fellow goon, Fallible. 00:52.870 --> 00:53.770 Hey, Fallible. 00:54.210 --> 00:55.170 Greetings. 00:55.690 --> 00:59.150 And we are also here with our first speaker of the day. 00:59.150 --> 01:09.470 We are here with Feng Xiao, who is going to answer your questions all about his presentation, Discovering Hidden Properties to Attack the Node.js Ecosystem. 01:09.470 --> 01:10.570 Hey, Feng, how's it going? 01:10.570 --> 01:11.210 Hi. 01:11.210 --> 01:12.110 Hi, good. 01:12.110 --> 01:13.210 How are you guys? 01:13.210 --> 01:14.570 We're doing great. 01:14.570 --> 01:15.890 It's awesome to have you here. 01:15.890 --> 01:17.310 Watched your presentation. 01:17.310 --> 01:19.210 You did an incredible job with that. 01:19.210 --> 01:22.030 Highly recommend that people go check that out. 01:22.030 --> 01:24.490 It's available on YouTube. 01:24.490 --> 01:27.070 DEF CON has those videos up. 01:27.350 --> 01:35.950 And you can also ask questions to Feng on the Discord channel at the TrackOneLiveQA channel. 01:35.950 --> 01:42.830 So yeah, we have a few questions that are coming in, so we can ask him some of those questions. 01:43.330 --> 01:44.210 Let's see. 01:44.210 --> 01:45.610 Let me actually start with one. 01:45.610 --> 01:47.370 Let me get this one out there as a start. 01:47.370 --> 01:50.730 So this is not your first time presenting at DEF CON, is it? 01:50.730 --> 01:53.990 So how many times have you given DEF CON presentations? 01:55.050 --> 02:04.170 Okay, so before the SIGMO talk, I only came to DEF CON once, and that is my first time SIGMO talk. 02:04.170 --> 02:06.710 It's in 2018. 02:07.010 --> 02:15.610 So in that talk, I present some new vulnerabilities that I discussed in software-defined networks. 02:15.850 --> 02:19.330 So this is actually my second time at DEF CON. 02:20.310 --> 02:24.650 That's fantastic, and we're really glad you decided to come back and join us again. 02:25.550 --> 02:34.810 Somebody was trying to ask if we were going to do first-time rituals with you, but we don't have to, because you're an old hat with this. 02:35.910 --> 02:38.050 You've already done that, so that's awesome. 02:39.070 --> 02:42.350 Let's see, we've got some questions coming in yet. 02:42.370 --> 02:56.830 Feng, one of the questions that we were kind of wondering about with your research that you did on the node.js ecosystem is what type of people should use the tool that you released? 02:56.950 --> 02:59.530 I know you mentioned the tool in your presentation. 02:59.530 --> 03:04.730 Maybe you want to mention that a little bit, and what kind of people should be using that sort of thing? 03:05.790 --> 03:20.290 Yeah, so this is... according to our research, we found this is kind of widespread problems, and many Git report or PM project has this problem. 03:20.290 --> 03:24.970 So we believe that there are two kinds of people that may want to use this tool. 03:24.990 --> 03:30.790 The first kind of people is about the developers. 03:30.850 --> 03:43.570 I believe they can use this tool to detect their own software, so that they can catch and discover all these hidden properties before they release a version. 03:43.770 --> 03:53.450 And a second type of people that we think can use this tool is some white hats, pen testers, or hackers. 03:53.450 --> 04:04.850 When they want to do some security analysis, maybe they can use this tool to detect some vulnerabilities or problems within their targets. 04:05.070 --> 04:05.570 Yes . 04:06.030 --> 04:06.750 Excellent. 04:06.950 --> 04:08.010 All right. 04:09.310 --> 04:13.950 Sorry, people have noticed that we're a little bit weird on our adjustments. 04:13.950 --> 04:15.910 We're trying to get that fixed as we go. 04:16.330 --> 04:17.770 Enjoy the testing and production. 04:17.770 --> 04:18.890 Sorry about that, folks. 04:20.310 --> 04:21.410 Yeah, for sure. 04:22.790 --> 04:23.830 Let's see. 04:24.050 --> 04:37.610 So, also, Feng, one of the things that you mentioned in the presentation where you had this discovery in Node.js, you also referenced Ruby on Rails and PHP. 04:38.130 --> 04:42.030 So, does it exist in those languages and platforms? 04:42.030 --> 04:44.410 And could it exist possibly in others? 04:44.410 --> 04:49.250 Should people try to go find this same vulnerability in other platforms? 04:49.670 --> 04:51.470 Okay, thanks for the question. 04:51.470 --> 05:05.160 So, as you guys have already observed in my presentations, the root cause of those vulnerabilities mainly comes from object sharing. 05:05.670 --> 05:17.590 So, if a language platform has such a feature, or some applications are using some kind of object sharing, then they could have a problem there. 05:17.590 --> 05:31.170 But why we are studying Node.js here is because to use the language, the flexibilities of JavaScript, the object, it can be really flexible. 05:31.170 --> 05:39.890 So , this empowers the hackers to propagate a lot of bad things into the programs. 05:39.890 --> 05:42.750 So, that's why we are studying Node.js. 05:42.750 --> 05:50.790 And we believe maybe there are other problems that are not discovered yet. 05:50.790 --> 05:59.030 But I think it is really a good direction to also explore this in other languages as well. 05:59.710 --> 06:00.670 Excellent. 06:01.390 --> 06:05.770 Alright, checking for some more questions from the audience. 06:06.730 --> 06:08.830 Here, I'll check for questions. 06:08.850 --> 06:13.830 Blavrty, would you see if you can get him, get that video up just a little bit higher too? 06:13.830 --> 06:14.630 Yeah, I think... 06:14.630 --> 06:19.690 One thing, I'm going to turn my camera off and just see if that bumps him up. 06:20.130 --> 06:21.610 I'm going to try the same. 06:32.000 --> 06:34.900 Oh yeah, now we are looking at who we want to actually see. 06:34.900 --> 06:35.720 Right , exactly. 06:35.720 --> 06:37.320 No one wants to see our faces. 06:42.430 --> 06:43.230 Alright. 06:45.150 --> 06:46.830 Cool, okay, back over. 06:46.870 --> 06:49.810 Let's see what else the community has to say. 06:51.690 --> 06:52.610 Okay. 06:53.510 --> 06:58.350 So yeah, Deadly Cob wants to know, when will the tool be released? 06:58.350 --> 07:03.830 He says, or this person says, they are only seeing a coming soon on the repo at the moment. 07:04.610 --> 07:06.210 Okay, yeah, thanks for the question. 07:06.210 --> 07:10.090 So that is one thing that I would like to mention in the Q&A. 07:10.270 --> 07:21.770 So, for now, as you guys may have observed from the presentations, there are several components in my talk, in the tools. 07:22.050 --> 07:32.570 And honestly, from the perspective of user experience, it's not that well designed, so you have to print and type in some kind to use it. 07:32.570 --> 07:41.730 So what we are doing now is, first, we are cleaning up the project code, and also we are making documents for it. 07:41.730 --> 07:50.830 So probably a short answer is that we are going to release it no later by the end of August. 07:50.910 --> 07:52.450 Oh, excellent. 07:52.450 --> 07:54.070 So that's great to hear. 07:54.970 --> 07:58.750 Alright, let's see that. 07:58.750 --> 08:00.150 Okay, cool. 08:00.730 --> 08:10.390 Let's see, who else do we have on there that wants to ask questions of our first speaker? 08:10.390 --> 08:18.150 Yeah, when an OK text is coming in, would it be possible to talk more about the differences between HPA and prototype pollution? 08:18.730 --> 08:19.850 Okay, cool, thanks. 08:19.850 --> 08:21.430 Thanks for the question. 08:21.430 --> 08:41.530 And so, for prototype pollution in JavaScript, we are talking about some kind of a text that tempers the prototype object, which is a special type of object in the JavaScript languages. 08:41.930 --> 08:45.910 However, in our attack, that is not our target. 08:46.030 --> 08:54.970 For example, in our attack, we are tying some user application-specific attributes or something else. 08:54.970 --> 09:10.610 And also, you may already see, as you may already heard from my presentations, we have something that is closely related to the prototype, but it's not about modifying the prototype. 09:10.610 --> 09:19.790 Instead, we are trying to forge some attributes that can be found on the prototype and hijack the inheritance chain. 09:19.790 --> 09:26.790 So, yes, there is a big difference between HPA and prototype pollution. 09:27.130 --> 09:28.570 Excellent. 09:28.570 --> 09:31.390 Thanks for that question, OKTux. 09:31.390 --> 09:32.930 All right. 09:34.070 --> 09:35.510 Let's see. 09:37.310 --> 09:47.230 And I know sometimes when you give a presentation, I know from experience that sometimes you have to kind of leave things out, that you really want to focus on the main issues. 09:47.230 --> 10:02.910 Was there any kind of like extra tips or extra things that if you had more time, that you might have included anything else that maybe people can think about with regard to the vulnerabilities that you found, or anything else that they can kind of think about around your research? 10:03.630 --> 10:12.750 Yeah, so due to the time constraint, we always have to remove some very interesting things from the talk. 10:12.750 --> 10:29.790 And to be honest, if I have time, I really want to case study every vulnerability within the research, because that's what people are maybe expecting, and I think those probabilities are really interesting. 10:29.890 --> 10:38.410 So my answer is the first thing that I come up with when I want to add more to it, it is about those vulnerability case studies. 10:39.470 --> 10:40.430 Excellent. 10:40.810 --> 10:49.150 Is there anything that maybe other people who enjoyed your research could also kind of dig in and take a look at and possibly look for as well? 10:49.490 --> 10:58.530 So I know a lot of times people just want to kind of add on to research that they find, and they're like, that's really great stuff, maybe I can find the next thing with that. 10:58.530 --> 11:07.290 When you were doing your research, did you have other ideas of things that maybe you didn't have time to look into, and maybe other people would have time to kind of help out with? 11:08.790 --> 11:16.330 Yeah, so I think I can share with you some ideas about Node.js. 11:16.350 --> 11:23.550 So for Node.js, I found a lot of interesting applications. 11:23.550 --> 11:32.790 For example, I found that many applications are now deployed in the serverless platform. 11:33.210 --> 11:36.370 So I think that could be an interesting direction. 11:36.850 --> 11:45.190 Yes, so this is kind of a new environment, different from the traditional server environments. 11:45.390 --> 11:52.430 And there's a lot of Node.js programs running in the serverless platform. 11:52.430 --> 11:55.930 So yeah, maybe that could be one interesting direction. 11:55.930 --> 12:00.670 And maybe somebody can hear my thoughts. 12:00.670 --> 12:05.390 Maybe they can come up with some great ideas and present them in next year's DevCon. 12:05.390 --> 12:07.730 And I will be happy to see that. 12:09.510 --> 12:11.030 That's excellent. 12:11.030 --> 12:12.250 All right. 12:13.530 --> 12:18.050 Looking for more questions that people have for you here. 12:27.930 --> 12:32.830 As we all attempt to figure out our settings here. 12:32.830 --> 12:40.770 Thank you everybody, and especially Bung for joining us for this chaos of figuring out how to get this stream to work properly. 12:40.770 --> 12:43.030 You're our first guinea pig. 12:43.570 --> 12:51.910 And thank you everybody in the stream chat telling us some suggestions of how to fix stuff. 12:52.490 --> 12:56.330 We'll also go in and see if we can kill our Discord notification noises. 13:09.490 --> 13:12.610 So Bung, do you have any other thoughts about... 13:13.150 --> 13:24.570 I know that you kind of hit this already, but is there anything in the talk that you would have liked to have included, but you didn't get a chance to give to us in your presentation so far? 13:26.510 --> 13:31.090 So, there's a lot of details, right? 13:31.570 --> 13:34.330 You know, I researched for a large project. 13:34.330 --> 13:39.790 Actually, I have been working on this project for almost about one year. 13:39.790 --> 13:43.850 So there's a lot of details and things I would like to add to it. 13:43.850 --> 13:49.670 Actually, a good thing about that is we are going to release our code, right? 13:49.670 --> 13:54.910 So many people can know a lot of details about our research. 13:55.750 --> 14:02.750 Also, we have the time to release our white paper, and I have been working on it for a while. 14:02.890 --> 14:12.170 So, if it is possible, I can also share my Twitter account. 14:12.230 --> 14:18.650 So maybe people who are interested in this research can follow me, or I can also follow back. 14:18.650 --> 14:27.410 And I will update the status of this work when I release something new. 14:28.890 --> 14:30.190 That's a good idea. 14:30.190 --> 14:33.330 I'm sure there's a lot of people who would be interested in knowing more about that. 14:33.330 --> 14:34.390 And good work. 14:34.390 --> 14:38.430 We'll make sure we get that out to anybody who wants to see it. 14:38.430 --> 14:43.090 Actually , we'll probably post that in the TrackOne channel. 14:44.850 --> 14:48.270 So I'll get that in there while we keep chatting. 14:58.690 --> 15:01.310 Alright, so you told us some of what you've been working on. 15:01.310 --> 15:04.230 You told us what you're aiming at to do next. 15:06.510 --> 15:13.670 It sounds like you're open for more people to come up with other thoughts and some other research directions for you. 15:13.990 --> 15:26.930 I'm sure I would like to know, and I'm sure some other folks would like to know as well, are you open for... I guess I'm not sure exactly where I was trying to go on that one. 15:26.930 --> 15:35.630 Other than, if people want to come to you and talk about this further, you've given them your Twitter. 15:38.550 --> 15:40.590 There's a... well, let me step back. 15:40.590 --> 15:43.950 I'll think of my question a little bit harder and come up with another one. 15:43.950 --> 15:52.850 In the meantime, tell us more about how you came upon this research. 15:54.510 --> 15:59.370 Oh, you mean how do I discover all these things, right? 16:02.230 --> 16:03.190 Please. 16:04.190 --> 16:12.670 Yeah, so the process I discovered this vulnerability is kind of like... 16:12.670 --> 16:22.150 since I'm enjoying eyeballing the source codes of an open source project to discover vulnerabilities. 16:22.150 --> 16:30.650 So when I take a look at some of my targets, I kind of discover some properties that's kind of like... 16:30.650 --> 16:43.210 okay, it seems that I can modify them, but there's no document, API documentation mentioned about them. 16:43.210 --> 16:47.470 So that's why I just try to include those properties. 16:47.470 --> 16:56.110 And in terms of that, yes, I can override those original values and do something bad. 16:56.110 --> 17:01.970 This is just the very beginning of our multi-making cases of that. 17:01.970 --> 17:05.390 So that's why we come up with our new tools. 17:07.510 --> 17:09.110 That's an interesting way. 17:09.110 --> 17:19.910 So it sounds like then you spend a certain amount of your time as you're doing whatever your day job is, hunting around and finding ways that things are broken. 17:19.910 --> 17:32.250 So can you give us a little bit more thought into some of the other folks who are coming up and working on their own projects. 17:32.250 --> 17:36.770 How do you identify when you are finding something that would be a good DEF CON talk? 17:36.770 --> 17:40.690 How do you identify something that you'd like to pursue further? 17:41.410 --> 17:43.630 Okay, thanks for the question. 17:43.630 --> 17:53.210 So I would say, yeah, I have some thoughts about how to make a DEF CON talk or Black Hat talk like that. 17:53.210 --> 18:04.370 So for me, if I can find some results or some new findings, which I think, first, this can be used in some real-world settings. 18:04.370 --> 18:13.910 For example, if I found some vulnerabilities that is exploitable in the production environment, I would say, yes, this could be some DEF CON or Black Hat talk. 18:14.390 --> 18:42.790 And also, if you really think this is a widespread or widely seen problem, maybe you should consider building something, some tools or at least some screens, so that people can use your tools or use your things and make all the process of discovering vulnerabilities easier. 18:42.790 --> 18:46.610 Yes, so that's two things I think could be useful. 18:46.610 --> 18:47.710 I like that. 18:47.710 --> 18:52.710 So you're starting small and you're building up things that are potentially useful. 18:52.710 --> 19:03.790 And then once you have small things that you can start to release, you start to build a community around that, build additional motivation, additional activity. 19:04.530 --> 19:05.810 Yeah. 19:06.150 --> 19:12.470 Yeah, I think also it's great to point out one of the points that Phuong just made. 19:12.470 --> 19:24.930 When you start thinking about what is going to be good research and showing it around, I know a lot of times people think like, this is not really interesting to anybody else but me, and it's not going to make a great talk anywhere. 19:24.930 --> 19:27.490 And I know a lot of people have that kind of thought. 19:27.490 --> 19:38.850 And my experience has always been that there's definitely other people that want to hear your research, and that you should definitely try to share that kind of information and research anywhere you can. 19:38.850 --> 19:43.790 So that was a great point that Phuong was making up, giving to us there. 19:43.790 --> 19:55.950 There is also another question for you here that seems interesting from Soft Tortilla, that wants to know, can you elaborate on the expected difficulty of getting those 12 CVEs patched? 19:55.950 --> 19:59.210 Do you think there's going to be much difficulty with getting those fixed? 20:00.010 --> 20:01.810 Oh, that's an interesting question. 20:01.810 --> 20:02.370 Yes. 20:02.370 --> 20:08.250 So for the vulnerability patching process, I do have some words to share with you guys. 20:08.250 --> 20:14.990 So, yes, at the very beginning, I found that people are not expecting those vulnerabilities. 20:15.310 --> 20:22.090 And they just think that, OK, so this seems like some minor issues, I don't want to patch it. 20:22.630 --> 20:29.530 But things go very differently after all my research proceed. 20:29.530 --> 20:39.350 So I found more and more, and many people in the industry, companies start to look at these problems. 20:39.370 --> 20:43.270 And after things become in these ways, things change. 20:43.270 --> 20:51.870 For example, there are some commercial scanners starting to alert such vulnerabilities. 20:51.870 --> 21:03.090 And some vendors who previously declined to patch those bugs have to patch them now. 21:03.090 --> 21:13.870 Because those vulnerability scanners start to say something like, whoa, this has vulnerabilities, you cannot use those libraries. 21:13.870 --> 21:20.290 So yes, this is kind of like a process that nobody knows your research, and you are kind of like nobody. 21:20.290 --> 21:26.710 But after you are getting more results, people are starting to look at it. 21:26.710 --> 21:33.770 And they will say, whoa, this is really interesting and important problems, and I want to patch it. 21:33.770 --> 21:38.610 Because it is already affecting our package usage. 21:39.530 --> 21:40.650 Excellent. 21:40.850 --> 21:49.470 And you also, at the beginning of that, mentioned that sometimes people think like, this isn't a big deal, so I'm not going to bother patching it. 21:49.470 --> 22:02.770 But for people that might not have seen your presentation yet, I believe that you were able to take user input, bypass protections, and were you able to show SQL injection during your presentation? 22:04.830 --> 22:06.230 Excuse me? 22:06.270 --> 22:18.270 And how far were you able to kind of... and how critical were the vulnerabilities that you were able to kind of take the exploits that you were doing in your presentation? 22:18.270 --> 22:24.210 Like some of the exploits that you were able to do, and how far were you able to take it? 22:25.870 --> 22:35.910 Yeah, so the final attack effects really depends on the type of those attack targets, right? 22:35.910 --> 22:46.710 So for the case study or the motivating example in our presentations, we are attacking some web frameworks. 22:46.710 --> 22:58.230 So we can build examples to demonstrate to people that, okay, you see, if we bypass this, if we bypass your protections, we can do something really bad. 22:58.230 --> 23:26.710 But for some other modules, the attack effects seems more vague, which means people will say, well, it seems like some minor logic bugs, but it turns out that those minor logic bugs also can be a really big problem when they are being exploited with other modules. 23:27.150 --> 23:28.150 Excellent. 23:30.390 --> 23:31.710 Let's see. 23:32.330 --> 23:35.250 Fallible, were you able to find any others in there? 23:35.250 --> 23:40.610 If not, I know that there's a couple other questions, but I wanted to see if you had one that you pulled out. 23:40.610 --> 23:49.810 So there are some people talking, people are asking more about this, something that you already answered a little bit about how you found that target. 23:49.810 --> 23:53.710 I do have one other slight sidetrack question. 23:53.710 --> 23:56.170 It says that you are a PhD student at Georgia Tech. 23:56.170 --> 23:59.530 Are you willing to tell us what your thesis is about? 24:00.510 --> 24:01.590 Oh, my thesis? 24:01.590 --> 24:03.770 Okay, so that is my worry. 24:03.770 --> 24:06.700 Okay , so I'm kind of... 24:07.570 --> 24:08.490 You can say no. 24:09.330 --> 24:16.890 I see myself as a kind of a hacker, which means whenever I find something interesting, I will try to hack them. 24:16.890 --> 24:25.770 So that's why previously I do some hacks in the software-defined networks, which gave people an impression that I'm working on network security. 24:25.770 --> 24:33.830 And now I'm attacking the Node.js, so people may think, okay, so you are doing some web application security, right? 24:33.830 --> 24:47.490 Yeah, but actually, I can tell you guys that my next goal may be in the hypervisor, which is I'm going to work on something else at the X86 virtualization. 24:47.490 --> 25:00.130 So I don't know what's going to be my thesis topic, because traditionally people will have a unique or unified topic for their thesis. 25:00.130 --> 25:09.030 But for me, it's more about hacking and building tools to detect those annoying issues. 25:10.870 --> 25:16.810 So you're still trying to narrow down exactly what you want your thesis to be, huh? 25:16.810 --> 25:17.290 Yeah. 25:17.290 --> 25:19.090 That's exciting. 25:25.280 --> 25:32.160 So Angel Ray asks, what's the biggest surprise you came across when doing this research? 25:34.680 --> 25:40.160 So there's a lot of moments that I think really makes me happy. 25:40.160 --> 25:50.820 For example, the moments I find the vulnerabilities from some widely used programs, such as MongoDB or something else. 25:50.820 --> 25:54.080 So that is some moments that make me really happy. 25:54.080 --> 26:06.040 And also, when I found that my talk was accepted by DevCon, that also made me really excited. 26:10.710 --> 26:11.910 Excellent. 26:14.050 --> 26:14.970 Okay. 26:15.070 --> 26:16.670 What else do we have? 26:16.670 --> 26:21.870 There's a lot of people in there chatting, talking some good stuff for you here, Feng. 26:25.970 --> 26:36.910 How about one question is that for people who haven't really done vulnerability research, what's your advice on how somebody can pick a target? 26:37.210 --> 26:40.510 Your research here is on Node.js. 26:40.510 --> 26:46.410 But if somebody else wants to do vulnerability research, how should they go about starting that and choosing a target for that? 26:46.830 --> 26:48.490 Thanks for the question. 26:50.230 --> 26:53.710 I have been working on vulnerability research for a while. 26:53.710 --> 27:05.830 So my experience or my suggestion is that I can conclude two kinds of vulnerabilities that people may want to take a look at. 27:05.830 --> 27:11.370 So the first kind of vulnerability is like something in our talk. 27:11.370 --> 27:13.670 It's about some logic bugs. 27:13.670 --> 27:21.910 And people can find some ways to exploit those vulnerabilities and manipulate the program logics. 27:21.910 --> 27:23.690 So that's one direction. 27:23.690 --> 27:42.350 And usually it is hard to directly find those vulnerabilities without knowing the internal logics of the applications. 27:42.550 --> 27:53.150 And the second category of vulnerability finding can be in the binary vulnerabilities, which is something like memory corruption. 27:53.470 --> 28:00.650 And nowadays there's a lot of research using automatic tools like fuzzers to find those vulnerabilities. 28:00.650 --> 28:14.730 So those vulnerabilities actually, it is kind of a more easier job because there's already some well-established concepts and tools, such as AFL or something else. 28:14.730 --> 28:23.210 So maybe if you are new to the vulnerability finding, you may also take a look at those fuzzing things. 28:23.210 --> 28:26.170 So you may find some interesting results. 28:26.470 --> 28:29.330 In fact, vulnerabilities are everywhere, right? 28:29.330 --> 28:34.350 So if you use those fuzz, you can get some results. 28:34.450 --> 28:35.490 Excellent. 28:36.030 --> 28:36.990 All right. 28:36.990 --> 28:39.310 Looks like we're coming down to the end here. 28:39.310 --> 28:40.550 This has flown right by. 28:40.550 --> 28:42.370 We only got a couple minutes left with you. 28:42.370 --> 28:51.310 So if anybody else has any questions that they want to get into, put those on the TrackOneLive QA Discord channel. 28:51.490 --> 28:52.490 Yeah, are you going to... 28:52.490 --> 29:00.190 The question I would finish up with would be, do you have a call to action for those of us watching? 29:00.190 --> 29:08.430 Do you have something that, additional research you would like somebody else to look at that's tangentially related to what you work on? 29:08.430 --> 29:16.710 Or how would you point other folks who are interested in this subject towards more? 29:17.350 --> 29:20.030 You mean more in Node.js? 29:21.250 --> 29:28.870 Yes, or even specifically related to the attacks you have shown. 29:29.870 --> 29:38.790 Yeah, so for Node.js, I mean, there are some related attacks that people may be interested in looking at. 29:38.790 --> 29:41.090 So I can list it here. 29:41.090 --> 29:43.970 So, for example, product evolution. 29:43.970 --> 29:46.470 Yes, so you may want to take a look at it. 29:46.470 --> 29:53.370 And after you're looking at that, you may find that there are some connections or some differences between this and our talk. 29:53.390 --> 30:06.730 And after prototype pollutions, you may also want to take a look at some well-known denial-of-service attacks in Node.js. 30:07.210 --> 30:15.810 Denial-of-service attack is really a big issue for Node.js due to the single-thread event handling model. 30:15.810 --> 30:25.810 So if you search keywords like EOS or Node.js, you can find a lot of useful results about how people attack the Node.js applications. 30:26.090 --> 30:30.730 So that's kind of two research that I would like to mention here. 30:31.410 --> 30:32.750 I appreciate that. 30:32.750 --> 30:33.550 Thank you. 30:33.550 --> 30:40.470 So I really appreciate your willingness to come and, first off, give a presentation here at DEF CON. 30:40.470 --> 30:49.230 This is one of those community events that only happens because of the people like yourself who come out and do the research and do the presentations. 30:49.230 --> 30:50.190 So thank you very much. 30:50.190 --> 30:54.730 And thank you for being our guinea pig on our QA streaming here. 30:54.730 --> 31:09.410 If anybody has any additional questions, we can continue to attempt to get those over, or I would recommend looking at the Twitter account that I did link in the TrackOne channel. 31:09.410 --> 31:12.350 Otherwise, we will go ahead and wrap this up. 31:12.350 --> 31:19.450 Thank you everyone who had suggestions and considerations here, and we'll go ahead and sign off. 31:19.450 --> 31:20.410 So thank you all. 31:20.410 --> 31:21.310 Big wave. 31:21.730 --> 31:22.130 Thanks, Will. 31:22.130 --> 31:22.750 Thank you.