Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Adam Barth wrote:
> The claim was that the presence of H(c-nonce, "WebSocket") in the
> payload was sufficient to prove that the respondent understood what
> was going on.  Notice that in this example, you're also relying upon
> the rigidity of the bytes surrounding the HMAC for security, which
> proves my point: the HMAC alone is insufficient.
>
> In any case, I'd encourage you to thinking about this proposal instead:
>   
> Consider, for example, a virtual hosting environment in which the
> attacker can place PHP scripts on the server.  For example, such
> hosting environments are widely available commercially, such as from
> 1and1.com.  Now, the attacker can complete the WebSocket handshake
> because the PHP script can compute the HMAC and send the appropriate
> response header.

That's the same hand-waving in lieu of an actual attack. Let's review.

Proposed attack: Attack server S with the help of DNS (or hosted HTTP 
server.)

Since your attack in the previous mail did not include a connection to 
server S, your description did not demonstrate the validity of your 
attack against S. (If you want to attack DNS itself, we can discuss that 
as a new attack, but you would need to withdraw your broader claim first.)

You need to demonstrate a sequence of connections to make that attack 
work (without using a WebServer proxy or time travel). For discussion, 
I've granted you syntax, but you must still demonstrate your sequence of 
connections and propagation of the c-nonce and H to complete the attack.

At very least, you need to make clear whether you mean the PHP server to 
act as a proxy or if you mean to establish a second WebSocket from the 
browser. You may not, however, change the target IP address of the first 
WebSocket connection from the PHP server to the target server using the 
original socket.

-- Scott


> /www.ietf.org/mail-archive/web/hybi/current/msg04285.html
>
> Adam
>
>
>
>