Re:Harvesting credit card numbers and passwords from websites
by bubble_boi on Saturday January 06, 2018 @07:08PM
(#16088249)
Author here. Someone in a comment pointed out that you if you could get your code in express middleware (or something depended on by express middleware or similar) you could potentially alter any CSP header in the responses (if it's set in middleware before your's in the chain).
Re:Harvesting credit card numbers and passwords from websites
by tlrobinson on Sunday January 07, 2018 @06:56AM
(#16090505)
Indeed. Then the middleware could also inject exfiltration JavaScript in `text/html` or `application/javascript` responses, which would work even if the app doesn’t use npm modules on the frontend.
This applies to almost any backend web framework and package manager, but the culture of micro packages in npm suits itself well to this attack.
Re:Harvesting credit card numbers and passwords from websites
by tlrobinson on Sunday January 07, 2018 @07:09AM
(#16090553)
Clearly what we need is cryptographically-signed JavaScript and CSP pinning.
(I’m only half joking)
EDIT: oh, CSP pinning is actually a thing that’s been proposed https://www.w3.org/TR/csp-pinning/
Re:Harvesting credit card numbers and passwords from websites
by danschumann on Saturday January 06, 2018 @02:02PM
(#16086866)
Actually, a main question is this: can npm modules read require.cache? If so, why? Can they require code outside of the npm modules folder. Again, why? Couldn't any npm module steal your credentials, and suffer from the same source minification/github custody stuff?
Take an npm module. It does setInterval and every minute, it checks require.cache for any file with 'config' in it, and sends it to the crook. Is this possible currently?
I would think npm modules should be require-sandboxed to their own directory. Even then, there is compiled code, etc. Oy vey.
Re:Harvesting credit card numbers and passwords from websites
by vjeux on Saturday January 06, 2018 @02:19PM
(#16086942)
You don’t need to do such complex things. You can just require(‘child_process’).execSync(‘any shell command’) with all the user credentials.
Re:Harvesting credit card numbers and passwords from websites
by saryant on Saturday January 06, 2018 @02:02PM
(#16086867)
He'd have to somehow make outbound requests from the server. IIRC, the default AWS VPC config would prevent this. Not sure about other cloud environments.
Where I work, outbound requests must be made through proxy servers which have a whitelisted set of allowed domains, which is only allowed after a security review.
Re:Harvesting credit card numbers and passwords from websites
by true_tuna on Saturday January 06, 2018 @07:25PM
(#16088302)
AWS default VPC config whe does not block outbound by default. Neither in the security group nor the ACL. And of the half dozen AWS hosted startups I’ve worked for nobody restricts outbound yet. “Security nice to have, not prioritized yet”
Re:Harvesting credit card numbers and passwords from websites
by tyingq on Saturday January 06, 2018 @04:11PM
(#16087477)
You can exfiltrate data a number of ways though. DNS requests might be one obvious method.
Re:Harvesting credit card numbers and passwords from websites
by mwarkentin on Saturday January 06, 2018 @04:16PM
(#16087502)
AWS has GuardDuty now which can monitor for this type of traffic for pretty cheap.
If CSP is enabled, the frontend checks to see if the backend code has opened up the particular port or route on the backend.
The back-end code could sniff through require.cache to see if he could hook into the existing server instance ( same port ), or open a new port ( depending on CSP ).
I suppose the CSP equivalent on the backend is some sort of firewall. I also suppose servers have better monitoring of requests. Still, this method would circumvent CSP!!!
Also, hooking into the existing server instance would throw red flags if the instance was ever console.logged. You might also do an audit of your ports and see a suspicious one opened in that method. And a firewall likely would block other ports. But, still, it's feasible even with a CSP, until discovered.