IETF Logo Mail Archive

Re: [hybi] Handshake was: The WebSocket protocol issues.

Scott Ferguson <ferg@caucho.com> Sat, 09 October 2010 00:27 UTC

Return-Path: <ferg@caucho.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1C5543A698A for <hybi@core3.amsl.com>; Fri, 8 Oct 2010 17:27:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.521
X-Spam-Level:
X-Spam-Status: No, score=-2.521 tagged_above=-999 required=5 tests=[AWL=0.078, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6+Np6WmB5dRi for <hybi@core3.amsl.com>; Fri, 8 Oct 2010 17:27:18 -0700 (PDT)
Received: from smtp115.biz.mail.re2.yahoo.com (smtp115.biz.mail.re2.yahoo.com [66.196.116.35]) by core3.amsl.com (Postfix) with SMTP id 3FDC83A697F for <hybi@ietf.org>; Fri, 8 Oct 2010 17:27:18 -0700 (PDT)
Received: (qmail 96293 invoked from network); 9 Oct 2010 00:28:21 -0000
Received: from [192.168.1.11] (ferg@66.92.8.203 with plain) by smtp115.biz.mail.re2.yahoo.com with SMTP; 08 Oct 2010 17:28:21 -0700 PDT
X-Yahoo-SMTP: L1_TBRiswBB5.MuzAo8Yf89wczFo0A2C
X-YMail-OSG: 3Yf_RTgVM1mV3aM3Qq9NwFx.hNeVZBOIu7TjbiaWIasy8XN vOvuHaIQroEPlsja_NKUVdB4mA4ZL1XHkcb_HbBJasxnRAVzh5eNcpS45Q6K EqAGLb69j_e6jqWTXKI6dzQsrFw.ZCUr_2_f1XZ0NaCYSWlisZ3Bbr.Cg3uP 8vAKn44vOGa1G1YmuEvRjBo7lrhhlwryIhUOpAYWpZFZmMagYon2OY2IUmhx 1U17SjSNrG0oBpvuSdqNwFGnbos.4z3IHBnPIDYf70g1gWjd1Gf.vSwwaS6q iUc1njmXAhN1XEAYQfIUTGPor5izlGfGhImgW3zOMcyHYZ9WMotvI.UUu_Uq Gge2VnItKsYiE70EqgWtC_jeNZLY3tkqjFGexQ7L.sy59nxqLd49irTHeEGn 7b7TFtHDMRVYoXEbjuX94J7PR4wOAnaCIBnCMximDR58sMQdq3Uw-
X-Yahoo-Newman-Property: ymail-3
Message-ID: <4CAFB724.9040108@caucho.com>
Date: Fri, 08 Oct 2010 17:28:20 -0700
From: Scott Ferguson <ferg@caucho.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: Adam Barth <ietf@adambarth.com>
References: <AANLkTikszM0pVE-0dpZ2kv=i=y5yzS2ekeyZxtz9N=fQ@mail.gmail.com> <4CA53E6B.1040808@caucho.com> <AANLkTikOyvF5AHTf4sDD=rWmK2FTD6R6LaHa4KTqkbcm@mail.gmail.com> <4CA68098.8010404@caucho.com> <AANLkTinYhW9MnnM3tkbCWziePyM7mFUEteKhw5OGp-eS@mail.gmail.com> <AANLkTi=_ejOCNiM49VW5q05=H7-M0jzAvXvGaKM1b7mX@mail.gmail.com> <AANLkTimyJj+Jxz1Q6fLrQ8iosGkD+0shUh3=td+jX_Do@mail.gmail.com> <4CA772A1.2090808@caucho.com> <AANLkTi=nLixtxMEd4B58Zp5FRbquNX2C_=7gCf9BGGQs@mail.gmail.com> <4CABCBFA.6020100@caucho.com> <AANLkTi=5wbCXWpOtUQT1MndgCxt9gj6uR_3U=nONpjKc@mail.gmail.com> <4CABD11F.3060500@caucho.com> <AANLkTiksehiSp7DB17MBVBb457p6pN5E8vma6FHz1c9j@mail.gmail.com> <4CACA667.3040309@caucho.com> <4CAF9589.1060007@caucho.com> <AANLkTinnnT5Oib7FvDdZF2q_WUT8=q8KNmfkfajE0Mor@mail.gmail.com> <4CAFA043.10101@caucho.com> <AANLkTi=eo-cjBz160FN0cn53v4-CpDSYaEneqkr_ZP7k@mail.gmail.com> <4CAFAC2B.5000800@caucho.com> <AANLkTi=0WOHJ-+JRKz3biDKaW1qRrM7pXCuqYhB4M3X3@mail.gmail.com>
In-Reply-To: <AANLkTi=0WOHJ-+JRKz3biDKaW1qRrM7pXCuqYhB4M3X3@mail.gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Cc: hybi <hybi@ietf.org>
Subject: Re: [hybi] Handshake was: The WebSocket protocol issues.
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 09 Oct 2010 00:27:19 -0000

Adam Barth wrote:
> On Fri, Oct 8, 2010 at 4:41 PM, Scott Ferguson <ferg@caucho.com> wrote:
>   
>
>> However, I will point out that using "WEBSOCKET" as the HTTP method would
>> let the ISP reject the initial request, protecting other virtual hosts from
>> this attack.
>>     
>
> That assumes the ISP is aware of WebSockets.  We're considering
> vulnerabilities in servers that are not upgraded to understand
> WebSockets.
>   

Existing servers can already reject HTTP methods. That's one of the 
reasons I've suggested it:

  <Limit WEBSOCKET>
    Deny from all
  </Limit>

Yes, your ISP would need to add those lines or something similar to the 
web server configuration. ISPs in shared hosting environments do need to 
be aware of security issues, even if they can't upgrade servers arbitrarily.

-- Scott

v2.23.0 | Report a Bug | By Email