Re: [hybi] Upgrade Mechanism and HasMat (was Re: Extensibility mechanisms?)

[Adam Barth <[e-mail]>]

On Thu, Jul 22, 2010 at 2:33 AM, Roy T. Fielding <[e-mail]> wrote:
> On Jul 22, 2010, at 1:21 AM, Salvatore Loreto wrote:
>> I see more value to work on a general solution to secure the HTTP Upgrade mechanism
>> against cross-protocol vulnerability, instead of trying to draft something ad-hoc for WebSocket
>
> The HTTP Upgrade mechanism is not vulnerable to cross-protocol attacks.
> Other (non-HTTP) services are vulnerable to browser misdirection if
> the browser can be directed to send arbitrary bytes to an arbitrary
> TCP port.  That is a problem which HTTP is actually good at avoiding
> because the first line is unique to HTTP.

HTTP is the source of a large number of cross-protocol attacks.  The
uniqueness of the first line often does not help because other
protocols (such as SMTP, DNS, FTP, etc) happily ignore leading junk on
the socket that they don't understand.  Claiming HTTP is not
vulnerably to cross-protocol attacks is just silly.

If you'd like some background reading about cross-protocol attacks
involving HTTP, I'd invite you to read the classic paper on the
subject:

http://www.remote.org/jochen/sec/hfpa/hfpa.pdf

There's a later paper with more interesting examples called "Extended
HTML Form Attack Revisited", but I couldn't turn up the PDF with a
quick search.  Collin Jackson and I also have a number of unpublished
results in this area, all of which use HTTP to attack other protocols.

Adam