Have you ever wondered how attackers gain high-level access to a computer system and how they manage to steal personal and financial data, install additional malware, and hijack devices?

Well, often this happens with the help of a backdoor.

In simple terms, to carry out such an attack, the attacker must inject the malware on your system and then open a communication channel that allows him to send commands and control the host remotely.

A hacker performing this attack manages to gain access similar to that of the application he attacked. If your application runs in sudo mode, then the attacker will gain superuser access (root-access).

Therefore, it is usually safe to run the application in a closed environment and give them as little access as possible.

Let’s see how this problem relates to NodeJS.

I’ve chosen this language because it is one of the most widely used in web development and software development in general.

Even though it is still debatable, it is almost safe to say that JavaScript, due to its vast ecosystem, has become the language we refer to as One language to rule them all.

Nowadays, npm which is, as I suppose everyone knows, the package manager for the JavaScript programming language, has reached over 1M public packages. According to this trivia, it has approximately 8TB in size.

These conditions, plus some key problems related to the implicit issues that NodeJS has, make this ecosystem the perfect choice for attackers.

#node #security #developer