Re: [hybi] Handshake was: The WebSocket protocol issues.

[Adam Barth <[e-mail]>]

On Mon, Oct 11, 2010 at 5:05 PM, Scott Ferguson <[e-mail]> wrote:
> Adam Barth wrote:
>> On Mon, Oct 11, 2010 at 9:56 AM, Scott Ferguson <[e-mail]> wrote:
>>> You didn't address point #6, the open DELETE.
>>>
>>> The target is pre-compromised because it has an open DELETE (point #6)
>>> and
>>> the target is pre-compromised because it's on the same machine as the
>>> attacker (point #1).
>>>
>>> You're requiring a pre-compromised target to make this attack work.
>>
>> I'm not sure what pre-compromised means.  I'm not sure that I'd run my
>> servers in this configuration, but that doesn't mean lots of other
>> people don't.
>
> 1. Your target has an open vulnerability ("DELETE") to non-browser clients
> 2. Your attacker is running an arbitrary program on the same machine as the
> target.
> 3. Your attacker has control over the target's web server.
>
> That target server is already under the control of the attacker. Adding a
> browser attack to that scenario is superfluous.

We'll just have to agree to disagree on that point.  This scenario is
one that browser vendors are interested in defending against.

Adam