Defensive Coding
It's rare to see applications that don't contain any external code coming from strangers. Someone else's code might affect yours via protoype poisoning even if you never interact with it. It's a threat as long as it's running in the same process. No matter if you're concerned with malicious dependencies or building software to run other people's code, techniques presented in this workshop can be used to isolate code at runtime and protect against prototype poisoning.
We'll explore the techniques allowing cooperation with neighbors that mess with built-in functionality of JavaScript not only for benign reasons, but also in dangerous ways. The second part of the workshop will focus on using tools to isolate code and scale the defensive coding practice up for larger codebases.
The entire workshop will be delivered as bite-sized hands-on exercises where increasingly advanced threats are presented and the participant has to defend their code.
Topics covered:
- Introduction to prototype poisoning
- Offensive techniques for pivoting with prototype poisoning by example
- Defensive techniques for isolating code
- Using tools to scale defensive coding practices
Outline:
- Introduction to modern software composition risks: the problem of fearless collaboration and supply chain security
- Prototype poisoning: what it is and how it works
- Increasingly difficult exercises exploring the methods of Defensive Coding
- includes increasingly advanced prototype pollution attacks
- majority of the workshop is spent here
- Introduction to Hardened JavaScript and LavaMoat - tools created to scale the runtime defense approach.
Duration: 8 hours total with breaks and Q&A
Can be expanded with full hands-on LavaMoat configuration and troubleshooting training.
This training was originally created for and delivered at DEFCON AppSec Village and later NodeConfEU, ConfidenceCon, x33fcon. It was refined in the process, so what you're getting is an improved version of what people enjoyed in Vegas.
Who should attend?
- Developers working on security-critical modules in JavaScript applications
- Developers working on applications that run untrusted code
- Security engineers looking for practical ways to protect against prototype poisoning or expanding their offensive skillset
Requirements
- Good command of JavaScript with a few years of experience
- General understainding of Web Security
- Chromium-based browser and Node.js LTS installed