Re: [hybi] Different server semantics of CONNECT

[Greg Wilkins <[e-mail]>]

On 3 December 2010 20:45, Zhong Yu <[e-mail]> wrote:
> On Fri, Dec 3, 2010 at 5:39 AM, Greg Wilkins <[e-mail]> wrote:
>> Eric,
>>
>> to put this another way, the paper produced the following results:
>>
>>  POST  handshake  + non-framed-date   15 vulnerable
>>  GET-Upgrade + Non-framed-data             8 vulnerable
>
> I know Adam said that data isn't framed in the Upgrade experiment. I
> don't buy it. If this is what they sent in the Upgrade experiment:
>
> GET /resource HTTP/1.1
> Upgrade: WebSocket
> ...
> <CRLF>
> GET /script.php/<random> HTTP/1.1
> Host: target.com
>
> i.e. there is no non-http bytes between handshake and spoof requests,
> then this is very similar to the POST experiment. The only major
> difference is the Upgrade header.
>
> Yet in POST experiment, 1376 firewall circumvention attacks succeeded,
> and in Upgrade experiment, only 1 succeeded. The two experiments are
> done at the same time, over the same intermediaries, same parsers. How
> can this be?

Zong,

well it's hard to know for sure unless Adam & Eric disclose.

I did ask if they framed the second request and Adam said no.
It's true that it is not clear if the 8 random bytes are sent between
the requests.

It is certainly true that they did not send a hello frame with known
unacceptable bytes.

Is it true that the experiment was conducted over the same intermediaries etc?
If the experiments were conducted by ad placements, then it would be
quasi random where the adverts were placed.  Actually it may be worse
than that, as the advert system may track data about the advertisement
and alter it's algorithm for where to display the advert over time,
target pages and client source.   There could be large systematic
variables in the experiment.

I really don't want to rain on Adam & Erics parade, as I think their
work is really interesting and well worth doing.  It is just that
without full disclosure of methods and data, I think it is impossible
to understand their findings or fully support their conclusions.

cheers