Securing your nodejs deployments while you sleep

Securing your nodejs deployments while you sleep Ahamed Nafeez !

Continuous Delivery

A vulnerability gets out to the internet before the security
team looks at it or a scanner is run. Code deployment is now near instantaneous

Constant iteration in production via feature ﬂags, A/B testings etc

Attack vs Defence

A-B usability tests Error-Catchers Benchmarking These don’t write themselves

What about the security of your data and nodejs app?

People start with a simple access control policy- Everyone has
access to everything.

Or maybe you never gave a thought about your front-
end architecture to prevent against, Cross-Domain attacks

Security should be a ﬁrst class requirement.

Watch the code as soon as it gets deployed. !
Do Continuous Integration with security checks relevant to the Diffs / Delta

What if you could monitor code commits for insecure patterns
/ behaviours?

Lets try doing that to a repository on GitHub

1. Use GitHub’s WebHooks.  2. Get all commits to your
repository.  3. Get the DIFF and send it across various security tests. In 3 simple steps

What can you test?

! 1. Insecure usage of templates for Cross-Site Scripting (XSS)
2. Insecure libraries 3. . . . ! ! Simple static analysis !

! 1. New routes being added!! 2. State changing routes
being added ! Dynamic analysis !

git-watchdog   Collects post-receive from GitHub and alerts you on
security errors 

Cross-Site Scripting (XSS)

Imagine an injection context inside a JS variable <html> <script>
var a = “—-user-input-here—”; alert(‘Finished’); </script> </html>

Just strip out / escape the “ character (Double Quotes)

Guess what happens ? <html> <script> var a = “</script><svg/onload=alert(2)>”;
alert(‘Finished’); </script> </html>

HTML Parser have preference over JS Parser.

Principle of Un-obtrusive Javascript Client-Side Templating Content Security Policy Reduce
the entry point to one What defensive front-end architecture looks like

Templating & XSS <%= %>, {{ }} — HTML Encoded
- Usually XSS Safe <%- %>, {{{ }}} — No Encoding - Causes XSS in any context. Your design should naturally avoid this.

This works until someone who doesn’t understands your code starts
committing to production.

Things to look out Anything which has <%- or {{{
needs some attention. Write a simple module which checks the code commits for that.

Writing an XSS checker in git-watchdog

ExpressJS! Web Application framework for node

Scan on new routes being added? In Express, app._router.stack gives
you all the registered routes. Pretty useful if you want to trigger a scan for a newly added end-point.! Figure out what works for your framework!

Lets discuss more @skeptic_fx

Securing your nodejs deployments while you sleep

Securing your nodejs deployments while you sleep

Nafeez

More Decks by Nafeez

Other Decks in Technology

Featured

Transcript