Security Pitfalls In Distributed Erlang And Elixir Systems

The talk introduces the BEAM virtual machine that runs Erlang and Elixir, the runtime behind large messaging services that scale across many nodes. The speaker explains that the VM behaves much like an operating system, with a process list, a remote shell, and applications such as an SSH server that can run inside it. Nodes find each other through the Erlang Port Mapper Daemon and authenticate with a shared cookie.

The speaker points out that many internet-facing hosts expose this daemon, and some use weak or well-known cookies. With the cookie, an attacker can attach a shell to a running node and execute code on other nodes as if they were local. The demonstration covers compiling new modules from a string and pushing them across the cluster to replace live functions. Without source code, the abstract syntax can still be retrieved, edited and recompiled. A helper module is also shown that watches for new nodes joining the cluster and opens a reverse shell to each one.

The closing point is that joining a cluster makes a new node a full member, so an attacker can monitor activity, act on the cluster, start an SSH server, or brute-force other services on the network. The speaker shares references to the Erlang working group and urges care before exploring or deploying these systems.