Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Adam Barth wrote:
> On Fri, Oct 8, 2010 at 3:04 PM, Scott Ferguson <[e-mail]> wrote:
>   
>> Scott Ferguson wrote:
>>     
>>> Adam Barth wrote:
>>>       
>>>> Consider, for example, a virtual hosting environment in which the
>>>> attacker can place PHP scripts on the server....  Now, the attacker can
>>>> complete the WebSocket handshake
>>>> because the PHP script can compute the HMAC and send the appropriate
>>>> response header.
>>>>         
>>> Proposed attack: Attack server S with the help of DNS (or hosted HTTP
>>> server.)
>>>
>>> You need to demonstrate a sequence of connections to make that attack work
>>> (without using a WebServer proxy or time travel). For discussion, I've
>>> granted you syntax, but you must still demonstrate your sequence of
>>> connections and propagation of the c-nonce and H to complete the attack.
>>>       
>> You still need to demonstrate a sequence of connections to make this attack
>> work because your attack appears impossible to complete using TCP as
>> currently described.
>>
>> At very minimum, you need to describe how the WebSocket connection from the
>> hijacked browser connects to both the HTTP (or DNS) server that computes the
>> hash, and to the target server S to complete the attack.
>>     
>
> The DNS server is the target server.
>   

Then please retract your more general claimed attack against server S 
using DNS/HTTP.

Let me repeat the important claim from your proposal (also quoted above):

> "Consider, for example, a virtual hosting environment in which the 
> attacker can place PHP scripts on the server....  Now, the attacker 
> can complete the WebSocket handshake because the PHP script can 
> compute the HMAC and send the appropriate response header."

Is the PHP server owned by the attacker also the target server S? If so, 
you need to make that restricted claim clear, because you've given the 
impression that the target server S is not owned by the attacker.

-- Scott

> Adam
>
>
>
>