Can I read HODOR: Shrinking Attack Surface on Node.js via System Call Limitation on EtoBox?

HODOR: Shrinking Attack Surface on Node.js via System Call Limitation by Wang, Wenya; Lin, Xingwei; Wang, Jingyi; Gao, Wang; Gu, Dawu; Lv, Wei; Wang, Jiashui is a scholarly article available to read on EtoBox.

What is HODOR: Shrinking Attack Surface on Node.js via System Call Limitation about?

Node.js provides Node.js applications with system interaction capabilities using system calls. However, such convenience comes with a price, i.e., the attack surface of JavaScript arbitrary code execution (ACE) vulnerabilities is expanded to the system call level. There lies a noticeable gap between existing protection techniques in the JavaScript code level (either by code debloating or read-write-execute permission restriction) and a targeted defense for emerging critical system call level exploitation. To fill the gap, we design and implement HODOR, a lightweight runtime protection system based on enforcing precise system call restrictions when running a Node.js application. HODOR achieved this by addressing several nontrivialial technical challenges. First, HODOR requires to construct high-quality call graphs for both the Node.js application (in JavaScript) and its underlying Node.js framework (in JavaScript and C/C++). Specifically, HODOR incorporates several important optimizations in both the JavaScript and C/C++ level to improve the state-of-the-art tools for building more precise call graphs. Then, HODOR creates the main-thread whitelist and the thread-pool whitelist respe

Author

Wang, Wenya; Lin, Xingwei; Wang, Jingyi; Gao, Wang; Gu, Dawu; Lv, Wei; Wang, Jiashui

Published

2023

Language

EN