Re: [hybi] Handshake was: The WebSocket protocol issues.

[Adam Barth <[e-mail]>]

On Tue, Oct 5, 2010 at 6:30 PM, Scott Ferguson <[e-mail]> wrote:
> Adam Barth wrote:
>> On Tue, Oct 5, 2010 at 6:08 PM, Scott Ferguson <[e-mail]> wrote:
>>> Adam Barth wrote:
>>> If you assume the hijacker has control of a DNS server to act as a proxy,
>>> you may as well assume he has control of an actual WebSocket server to
>>> act
>>> as a proxy.
>>>
>>
>> Huh?  That doesn't make any sense.  If you run a stock DNS server, it
>> will proxy lots of information from authoritative DNS servers around
>> the world.  That's the whole point of DNS.
>>
>
> C1: Browser at 192.168.1.10 makes TCP websocket connection with local port
> 8888 to DNS server 10.0.0.1.
>
> S2: DNS server returns DNS response to 192.168.1.10:8888 which contains
> H(c-nonce, "WebSocket") somewhere in the payload
>
> C3: Browser notices that DNS reponse does not have the same syntax as a
> WebSocket  response, and closes the connection.
>
> How is this an attack?

The claim was that the presence of H(c-nonce, "WebSocket") in the
payload was sufficient to prove that the respondent understood what
was going on.  Notice that in this example, you're also relying upon
the rigidity of the bytes surrounding the HMAC for security, which
proves my point: the HMAC alone is insufficient.

In any case, I'd encourage you to thinking about this proposal instead:

http://www.ietf.org/mail-archive/web/hybi/current/msg04285.html

Adam