Re: [hybi] Handshake was: The WebSocket protocol issues.

[Adam Barth <[e-mail]>]

On Fri, Oct 8, 2010 at 4:41 PM, Scott Ferguson <[e-mail]> wrote:
> Adam Barth wrote:
>> Concretely, consider http://www.adambarth.com/.  My web site is a
>> virtual host on a physical server in a 1and1 datacenter.  I'm
>> perfectly capable of placing a PHP script on my virtual host.  If the
>> PHP script is able to complete the web socket handshake, then I can
>> open a WebSocket connection to www.adambarth.com on port 80 from the
>> user's browser.  Once the WebSocket handshake completes, I can now
>> talk directly to the 1and1 server over more-or-less a raw socket,
>> which means I can spoof further HTTP requests and potentially attack
>> other virtual hosts that happen to be on the same physical machine,
>> which is bad news bears.
>
> So the attacker has a PHP script running on the same physical machine as the
> target site, on the same VM guest as the target, and using the same shared
> web server as the target, and has decided that a cross protocol attack is
> the appropriate vector against a target on the same machine as his PHP
> script.
>
> I'll let others decide if that scenario is something the WebSocket protocol
> needs to address.

These scenarios are very real.  My web site is certainly not the only
virtual PHP hosting on the Internet.  :)

> However, I will point out that using "WEBSOCKET" as the HTTP method would
> let the ISP reject the initial request, protecting other virtual hosts from
> this attack.

That assumes the ISP is aware of WebSockets.  We're considering
vulnerabilities in servers that are not upgraded to understand
WebSockets.

Adam