Surviving Web Security - Node Interactive
•
2 j'aime•416 vues
Surviving Web Security - topics covered: - timing attacks - regular expression denial of service - insecure dependencies
Recommandé
Contenu connexe
Similaire à Surviving Web Security - Node Interactive
Similaire à Surviving Web Security - Node Interactive (8)
Dernier
Dernier (20)
Surviving Web Security - Node Interactive
- 2. Surviving Web Security Gergely Nemeth, RisingStack
- 4. ATTACK TREES
- 5. “formal, methodical way of describing the security of systems, based on varying attacks” Bruce Schneier ATTACK TREES
- 6. ATTACK TREES Open Safe Pick Lock Learn Combo Bad Setup Find it Written Learn From Target Blackmail Eavesdrop Bribe
- 8. ATTACK TREES Open Safe (P) Pick Lock (I) Learn Combo (P) Bad Setup (I) Find it Written (I) Learn From Target (P) Blackmail (I) Eavesdrop (I) Bribe (P) P = Possible I = Impossible
- 10. ATTACK TREES - DENIAL OF SERVICE Denial of Service Find Evil Regex Vulnerability Distributed Mass Traffic
- 11. ATTACK TREES - DENIAL OF SERVICE 1 ^(a+)+$ 2 3 4 5 a a a a a a a a Nondeterministic finite automaton
- 12. ATTACK TREES - DENIAL OF SERVICE ^(a+)+$ for the input “aaaaX” 16 possible paths
- 13. ATTACK TREES - DENIAL OF SERVICE ^(a+)+$ for the input “aaaaaaaaaaaaaaaaX” 65536 possible paths
- 14. ATTACK TREES - DENIAL OF SERVICE Regular Expression implementations may reach extreme situations that cause them to work very slowly
- 15. ATTACK TREES - DENIAL OF SERVICE Evil Regexes - Grouping with repetition - Inside the repeated group: - Repetition - Alternation with overlapping
- 16. WE HAVE A SINGLE THREAD
- 17. ATTACK TREES - DENIAL OF SERVICE
- 20. ATTACK TREES - USER ACCOUNT Get Access Modify Credentials Learn Password Bypass Access Control Get Access to Database Social Engineering Get Access to DMZ Listen on Transport Layer Guessing Insecure Dependencies
- 21. ATTACK TREES - USER ACCOUNT Get Access Modify Credentials Learn Password Bypass Access Control Get Access to Database Social Engineering Get Access to DMZ Listen on Transport Layer Guessing Insecure Dependencies
- 22. GUESSING - BRUTE FORCE systematically enumerating all possible candidates for the solution
- 23. GUESSING - BRUTE FORCE use a rate-limiter for your endpoints
- 24. GUESSING - BRUTE FORCE
- 25. GUESSING - TIMING ATTACKS compromise a cryptosystem by analyzing the time taken to execute cryptographic algorithms
- 26. GUESSING - TIMING ATTACKS
- 27. GUESSING - TIMING ATTACKS WRONG!
- 28. GUESSING - TIMING ATTACKS T R A C E T R A C E 1st iteration
- 29. GUESSING - TIMING ATTACKS T R A C E T R A C E 2nd iteration
- 30. GUESSING - TIMING ATTACKS T R A C E T R A C E 5th iteration
- 31. GUESSING - TIMING ATTACKS T R A C E T R I C K 1th iteration
- 32. GUESSING - TIMING ATTACKS T R A C E T R I C K 2nd iteration
- 33. GUESSING - TIMING ATTACKS T R A C E T R I C K 3rd iteration
- 34. GUESSING - TIMING ATTACKS T R A C E T R I C K 3rd iteration missmatch - no more iterations
- 35. GUESSING - TIMING ATTACKS the more letters match from the password, the more time it takes
- 36. GUESSING - TIMING ATTACKS ALWAYS USE FIXED-TIME COMPARISON
- 37. GUESSING - TIMING ATTACKS
- 39. ATTACK TREES - USER ACCOUNT Get Access Modify Credentials Learn Password Bypass Access Control Get Access to Database Social Engineering Get Access to DMZ Listen on Transport Layer Guessing Insecure Dependencies
- 40. YOU ARE WHAT YOU REQUIRE INSECURE DEPENDENCIES
- 42. INSECURE DEPENDENCIES node-uuid is downloaded 255.000 times daily, while 4.000+ modules depend on it
- 44. THE HUMAN FACTOR
- 45. ATTACK TREES - USER ACCOUNT Get Access Modify Credentials Learn Password Bypass Access Control Get Access to Database Social Engineering Get Access to DMZ Listen on Transport Layer Guessing Insecure Dependencies
- 46. 95% OF ALL SECURITY INCIDENTS INVOLVE HUMAN ERROR
- 47. WE ARE THE WEAKEST LINK
- 48. security must be part of the agile workflow THE HUMAN FACTOR
- 49. stories should include acceptance criteria for security THE HUMAN FACTOR
- 50. Given an unauthenticated user, when tries to view her profile, then redirected to the login.
- 51. SECURITY IS PART OF YOUR JOB!
- 52. - Node.js Security Checklist - https://blog.risingstack.com/node-js-security-checklist/ - Advisories of NSP - on nodesecurity.io - OWASP TOP 10 - on owasp.org WHAT’S NEXT?
- 53. Thanks!