Re: [hybi] Handshake was: The WebSocket protocol issues.

[Adam Barth <[e-mail]>]

On Fri, Oct 8, 2010 at 3:50 PM, Scott Ferguson <[e-mail]> wrote:
> Adam Barth wrote:
>> On Fri, Oct 8, 2010 at 3:04 PM, Scott Ferguson <[e-mail]> wrote:
>>> Scott Ferguson wrote:
>>>> Adam Barth wrote:
>>>>> Consider, for example, a virtual hosting environment in which the
>>>>> attacker can place PHP scripts on the server....  Now, the attacker can
>>>>> complete the WebSocket handshake
>>>>> because the PHP script can compute the HMAC and send the appropriate
>>>>> response header.
>>>>
>>>> Proposed attack: Attack server S with the help of DNS (or hosted HTTP
>>>> server.)
>>>>
>>>> You need to demonstrate a sequence of connections to make that attack
>>>> work
>>>> (without using a WebServer proxy or time travel). For discussion, I've
>>>> granted you syntax, but you must still demonstrate your sequence of
>>>> connections and propagation of the c-nonce and H to complete the attack.
>>>
>>> You still need to demonstrate a sequence of connections to make this
>>> attack
>>> work because your attack appears impossible to complete using TCP as
>>> currently described.
>>>
>>> At very minimum, you need to describe how the WebSocket connection from
>>> the
>>> hijacked browser connects to both the HTTP (or DNS) server that computes
>>> the
>>> hash, and to the target server S to complete the attack.
>>
>> The DNS server is the target server.
>
> Then please retract your more general claimed attack against server S using
> DNS/HTTP.
>
> Let me repeat the important claim from your proposal (also quoted above):

Oh, I thought we were still talking about the earlier example that
involved a DNS server.

>> "Consider, for example, a virtual hosting environment in which the
>> attacker can place PHP scripts on the server....  Now, the attacker can
>> complete the WebSocket handshake because the PHP script can compute the HMAC
>> and send the appropriate response header."
>
> Is the PHP server owned by the attacker also the target server S? If so, you
> need to make that restricted claim clear, because you've given the
> impression that the target server S is not owned by the attacker.

This is a virtual hosting environment.  That's what I meant when I
said "consider, for example, a virtual hosting environment in which
the attacker can place PHP scripts on the server."  The attacker has
access to one virtual host on the server but does not own the entire
server.

Concretely, consider http://www.adambarth.com/.  My web site is a
virtual host on a physical server in a 1and1 datacenter.  I'm
perfectly capable of placing a PHP script on my virtual host.  If the
PHP script is able to complete the web socket handshake, then I can
open a WebSocket connection to www.adambarth.com on port 80 from the
user's browser.  Once the WebSocket handshake completes, I can now
talk directly to the 1and1 server over more-or-less a raw socket,
which means I can spoof further HTTP requests and potentially attack
other virtual hosts that happen to be on the same physical machine,
which is bad news bears.

Adam