Re: [hybi] Experiment comparing Upgrade and CONNECT handshakes

[Greg Wilkins <[e-mail]>]

On 28 November 2010 19:04, John Tamplin <[e-mail]> wrote:

>
> Note that adding Hello frames or arbitrary other verification that a
> real WebSocket client is connecting doesn't help -- in this attack
> scenario, the attacker is running their JS code in the browser and
> their code on the server, and it sets up a real WebSocket connection.
>


John,

I think this is an assumption that needs to be tested.

The vulnerability results because the intermediary is interpreting every
HTTP request on the stream.  If Hello frames are sent, or the fake HTTP
requests are encapsulated in WS frames, then that may be sufficient to
disrupt the parsing that the intermediaries are doing.

Note that I agree with Eric when he says that this defence is reliant on the
intermediary not being able to re-establish HTTP framing after non HTTP
bytes are sent and that this might be rather a rather thin defence.   But
there still may be things that can be done to create better defences.

cheers




> Unless the payload is masked, you have to rely on the handshake and
> framing ensuring that a transparent proxy doesn't accept WebSocket
> payload content as if it were an HTTP request.  Also note that since
> the attacker controls the server, they can add extra headers to the
> Upgrade response which will be ignored by the WebSocket client but may
> confuse the transparent proxy.
>
> --
> John A. Tamplin
> Software Engineer (GWT), Google
>