Game of Hacks: The Mother of All Honeypots
summary
A viral Node.js honeypot runs for six months and records every live exploit against a quiz game that draws 200K users in 2 weeks and 35K in 24 hours; documented attacks include score inflation by submitting repeated requests, timer manipulation, scraping-based DDoS and comment spam, and Node.js specifics: CPU-bound event-loop DoS, JSON query operator injection, and a V8 predictable math.random exploited to reverse MD5 reset passwords via rainbow tables; fixes include moved score calculation to server plus server-side validation and request flags.
AI-written summary · about
chapters (6)
- 0:00Start
- 17:04Who should be validating answer correctness?
- 17:41Whats the problem with this node.js code?
- 18:16Scoreboard
- 20:35Timer
- 24:26Denial of Service
related talks
42mThe Node.js Highway: Attacks Are At Full Throttle
40mHow to hack a node app?
46mHow to hack a node app?
47mLive Hacking: Breaking into Your Web App
51mHow hacking works - Web edition
59mMaking Hacking Childs Play
26mLooking at 4 years of web honeypot attacks: tactics, ...
55mNode.js Security: Breaking The Loop