SimplifyFramework - IDS/IPS (Network/Module) : NodeJS version >= 12.x

• Host Intrusion Detection and Prevention

  • Detect modules are loaded by require('module').
  • Detect modules are compiled by module._compile('code').
  • Block or allow some modules by names or by hashcodes.

• Network Intrusion Detection and Prevention

  • Detect HTTP/HTTPS/UDP/TCP outbound connection.
  • Block or allow by domain names or IP addresses.
  • Redirect the outbound connection to a honeypot.

WARNING: This library does not handle the require('net').Socket.connect() function.

Node Environment Variables Setup

• Set process.env.IDS_ENABLE_METRIC_LOGGING=true|false turns ON/OFF the AWS CloudWatch metric collector.
• Set process.env.IDS_ENABLE_MODULE_TRACKER=true|false turns ON/OFF the Host Tracker (HIDS/HIPS).
• Set process.env.IDS_PRINT_OUTPUT_LOG=true|false turns ON/OFF the console output logs (silent mode).

Setup your AWS environment or IAM Role in your Lambdas with this permission:

This library requires AWS IAM Role to allow publishing the CloudWatch Metrics to a custom namespace:

Policies:
- PolicyName: cloudwatch-metricsPolicyDocument:
Statement:
- Effect: AllowAction:
- cloudwatch:PutMetricDataResource: "*"

The metrics' namespace is set in the constructor at 2nd parameter:

• new IDS({}, 'TestApp/IDS' /* Custom Namespace /, '127.0.0.255'/ honeypot /, true / enable metric logging */)

AWS/Lambda - Make a build then attach to a Lambda function by using command line

• simplify-intrusion --bucket=YOUR_BUCKET_NAME --layer-name=YOUR_IDS_LAYER_NAME make
• simplify-intrusion --function-name=YOUR_TARGET_FUNCTION [--layer-version-arn=YOUR_LAYER_ARN] attach

SDK/Library - Use the { IDS } module to detect the intrustion outbound network from your code:

1. Load the library with IDS configuration:

var{IDS}=require('simplify-intrusion')varnodeFirewall=newIDS({network: {allowDomainsOrHostIPs: [/* a whitelist of domains or IPs that is allowed to access from your code, startsWith('string') rule */],blockDomainsOrHostIPs: [/* the blacklist of domains or IPs you want to BLOCK them from your code, startsWith('string') rule *//* example: ['*'] => block all outbound network connection from host, allowed all connections by default */]},host: {allowModuleOrSHA256OfCode: [/* a whitelist of module name or SHA-256('code') that will be embeded by using module._complie(), startsWith('string') rule */],blockModuleOrSHA256OfCode: [/* the blacklist of module name or SHA-256('code') that contains the untrusted HASH of modules, startsWith('string') rule *//* example: ['QsPV5N10sTZExAjkbZuQn5yEe0Jkpd4rHRnSxH9dF7Y=', 'buffer:4.9.2', 'request:2.88.'] */]}},'YourApp/IDS'/* log metrics to your custom CloudWatch NameSpace if the CloudWatch Metrics is enabled */,'dev.null.org'/* if BLOCKED, reflect the requests to a honeypot server: dev.null.org */,false/* true = set the CloudWatch Metrics is enabled */)

2. Write your code with all the require('...') after the line above.

varhttp=require('http')varhttps=require('https')var{ ClientRequest }=require('_http_client_')varmodule=require('module')/*an example of your lambda code*/module.exports.handler=function(event,context,callback){//DO SOMETHING LIKE CALL EXTERNAL APISvarr=https.request("https://google.com/api/...",(res)=>{console.log(res)})r&&r.end()}

3. Detaching the library when everything is done:

somePromiseOrCallbackFunction().then(response=>{nodeFirewall.detach()callback(null,response)})

EXAMPLE - Running an example of intrusion code.

1. Install Simplify Framework - Intrustion library

• npm install simplify-intrustion

2. Create example.js node application

var{IDS}=require('simplify-intrusion')varnodeFirewall=newIDS({network: {allowDomainsOrHostIPs: [],blockDomainsOrHostIPs: []},host: {allowModuleOrSHA256OfCode: ['OtbUd5po/kQtu2FweSNa42kOfFYZvlsFuen1xXeOPKs='],blockModuleOrSHA256OfCode: ['*']}},'TestApp/IDS','dev.null.org')varpath=require('path')varhttps=require('https')varhttpClient=require('_http_client')eval('console.log("eval() is not allowed.")')varrequireFromString=require('require-from-string')varrq=requireFromString('module.exports = function(){console.log("require-from-string: OK")}','Test')typeofrq=='function'&&rq()varres=newhttpClient.ClientRequest("http://google.com",{headers: {"Content-Type": "application/json"},method: 'GET'},(res)=>{varr=https.request("https://google.com",(res)=>{nodeFirewall.detach()})r&&r.end()})res&&res.end()

3. Run node example.js

Expected outcome:

$ node example.js
>>>> [Blocked] (function:eval) EXEC - console.log("eval() is not allowed.")require-from-string: OK >>>> [Warning] (_http_client) GET - http://google.com >>>> [Allowed] (module:compile) Test - OtbUd5po/kQtu2FweSNa42kOfFYZvlsFuen1xXeOPKs= >>>> [Warning] (https:request) GET - https://google.com/