Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Eric Rescorla wrote:
>
>
> On Fri, Oct 8, 2010 at 5:39 PM, Scott Ferguson <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>
>
>     To consider the original scenario, do you think the case where the
>     attacker's PHP script is on the same physical and virtual machine
>     as the target is something WebSockets needs to address? Or that
>     the shared machine configuration is already so compromised that
>     complicating WebSockets to address that scenario adds no real value.
>
>
> This case definitely needs to be addressed. It's a completely standard 
> hosting
> configuration.

To clarify, this scenario has the attacker to run an arbitrary program 
on the same physical/virtual machine as the target. Standard 
configuration or not isn't the issue.

The issues are:

  1) When the attacker can already run a program on the same machine as 
the target, the existing vulnerabilities of that environment swamp any 
theoretical websocket cross-protocol vulnerability.

  2) The attacker has to somehow get assigned to the exact same instance 
as the target. Somehow. I'm not sure how that would be accomplished.

  3) The ISP has to be too lazy to add <Limit WEBSOCKET> to their shared 
http server.

  4) The scope of potential targets is limited to those sites unwilling 
to even pay for its own virtual instance ($11/month on rackspace). Not 
that hobby sites aren't important to their owners, but you'd need to 
argue that they're worth the effort of attacking using 1-3.

Just to clarify, that's the case we're considering.

-- Scott