Re: [hybi] Handshake was: The WebSocket protocol issues.

[Greg Wilkins <[e-mail]>]

On 1 October 2010 12:36, Adam Barth <[e-mail]> wrote:
> On Thu, Sep 30, 2010 at 6:50 PM, Scott Ferguson <[e-mail]> wrote:
>> To repeat the key pieces:
>>  a) c-nonce must not be available to or predictable by the hijacker
>>  b) "WebSocket" is not possessed by a non-websocket server
>
> You're making a bunch of assumptions about how non-websocket servers
> behave.  In particular, consider a protocol like DNS.  It's entirely
> possible that a DNS-like protocol could relay the c-nonce to the
> attacker and give the attacker an opportunity to response with the
> appropriate hash, which the server would then relay to the client.
> Attacks of this general class (even against DNS) are known for HTTP.

Adam,

At this stage in our deliberations we need a little more useful than a
statement that it is possible that protocol X might be vulnerable.
That is a truism - who would have thought TLS was vulnerable to a man
in the middle attack, but it was - so it is true that any protocol
might be vulnerable.    The question is - how likely is it to be
vulnerable and are we doing anything to increase the chances of that?

Can you explain how a DNS like protocol might be vulnerable to a HTTP
handshake?   Specially as it runs on port 53 which should not be
allowed to be the target of any HTTP or WS connections.

Can you cite any references that indicate that if  HTTP requests was
sent to a DNS server that it could be mistaken for DNS requests?  How
would a WS HTTP upgrade request be any more likely to be so mistaken?
How would having spaces in the nonce make this mistake any less likely
to occur? How would framing the random bytes change this?

Are there any recorded vulnerabilities of DNS servers echoing back any
content from a HTTP request?  If so, then I would expect these might
be already have been used as part of some XSS attack.  Reflecting user
data provided data is generally considered a bad thing to do and most
modern protocols only allow it in very limited situations (hence the
disabling of TRACE in HTTP).

Even if this was possible - what is the risk?  That a WS client will
look up DNS names?   Or do you have any indication that a WS handshake
will make a DNS server more vulnerable to cache poisoning or any other
spoofing attack?   Is there something about a WS handshake that would
better enable a cache poisoning attack more than XHR?  If through some
miracle the handshake was passed, is there something about the WS
frames that would allow attacks on DNS servers more than XHR?


There are a few moderate proposals being made to incrementally improve
the handshake problems that we currently have.  How does you statement
help us evaluate those proposals?