Monday, December 03, 2018
Wegmans Hall 1400
Professor Dongyoon Lee
Fuzzing and Securing the Server-Side Event-Driven Architecture
The software development community is adopting the Event-Driven Architecture (EDA) to provide scalable web services, most prominently through Node.js. Though the EDA scales well, it comes with two inherent risks: concurrency errors and Event Handler Poisoning (EHP) Denial of Service attacks. Just as thread-based programs can have concurrency errors between unordered threads, event-driven programs may have them between unordered events. When an EDA-based server multiplexes many clients onto few threads, a blocked thread (EHP) renders the whole server unresponsive.
In this talk, I present Node.fz and Node.cure to address these problems. First, Node.fz provides a schedule fuzzing test tool that randomly perturbs the execution of a Node.js program, allowing Node.js developers to explore a variety of possible schedules during testing. Second, Node.cure proposes First-Class Timeouts, which incorporates timeouts at the EDA framework level, defending Node.js applications against all known EHP attacks.