Re: [hybi] Handshake was: The WebSocket protocol issues.

[Bjoern Hoehrmann <[e-mail]>]

* Scott Ferguson wrote:
>To consider the original scenario, do you think the case where the 
>attacker's PHP script is on the same physical and virtual machine as the 
>target is something WebSockets needs to address? Or that the shared 
>machine configuration is already so compromised that complicating 
>WebSockets to address that scenario adds no real value.
>
>Your proxy case needs to be considered separately, because a proxied 
>attacker has less power over the web server than a PHP script on the 
>same server does.

I believe that if the latter case is addressed, then the former case is
no longer possible (if you consider the web server the browser attempts
to connect with a black box then they are really identical). I do think
in the former case an attacker will try many other things first. Note
that the attacker would only attempt this if the user knows something,
or can represent something, the attacker does not or cannot, like ensure
the request is coming from a particular IP address. Otherwise he could
just send whatever bytes to the server he feels like sending.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/