Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Adam Barth wrote:
> On Fri, Oct 8, 2010 at 3:50 PM, Scott Ferguson <[e-mail]> wrote:
>   
>> Adam Barth wrote:
>>     
>>> The DNS server is the target server.
>>>       
>> Then please retract your more general claimed attack against server S using
>> DNS/HTTP.
>>
>> Let me repeat the important claim from your proposal (also quoted above):
>>     
>
> Oh, I thought we were still talking about the earlier example that
> involved a DNS server.
>   

As long as we're clear that DNS itself and DNS only is the target and 
not some second server using information from DNS, this is fine. 
"involved" is more general than "is the target".

> This is a virtual hosting environment.  That's what I meant when I
> said "consider, for example, a virtual hosting environment in which
> the attacker can place PHP scripts on the server."  The attacker has
> access to one virtual host on the server but does not own the entire
> server.
>
> Concretely, consider http://www.adambarth.com/.  My web site is a
> virtual host on a physical server in a 1and1 datacenter.  I'm
> perfectly capable of placing a PHP script on my virtual host.  If the
> PHP script is able to complete the web socket handshake, then I can
> open a WebSocket connection to www.adambarth.com on port 80 from the
> user's browser.  Once the WebSocket handshake completes, I can now
> talk directly to the 1and1 server over more-or-less a raw socket,
> which means I can spoof further HTTP requests and potentially attack
> other virtual hosts that happen to be on the same physical machine,
> which is bad news bears.
>   

So the attacker has a PHP script running on the same physical machine as 
the target site, on the same VM guest as the target, and using the same 
shared web server as the target, and has decided that a cross protocol 
attack is the appropriate vector against a target on the same machine as 
his PHP script.

I'll let others decide if that scenario is something the WebSocket 
protocol needs to address.

However, I will point out that using "WEBSOCKET" as the HTTP method 
would let the ISP reject the initial request, protecting other virtual 
hosts from this attack.

-- Scott

> Adam
>
>
>
>