4 ms·
WebSocket disabled in Firefox 4
- ladon86 16y agoPosted yesterday: http://news.ycombinator.com/item?id=1980963 http://news.ycombinator.com/item?id=1980963
- jacobolus 16y agoThe paper (http://www.adambarth.com/experimental/websocket.pdf http://www.adambarth.com/experimental/websocket.pdf) describing these attacks also describes attacks on Java applets and Flash. That any application that can make outgoing TCP connections can poison these caching proxies/firewalls, and break security for all users sitting behind that firewall, suggests that the problem is with the firewalls, not with Flash or WebSocket per se. Anyone running these firewalls is exposing their users to a severe security problem whether WebSocket is included in browsers or not. I’m not sure if there’s any kind of “TCP appliance test suite” that could be used to catch horribly broken and insecure proxies and firewalls, but in addition to changing the WebSocket spec, someone should really set up some Flash-based tests that exploit this and tell those users/network admins whose firewalls who are vulnerable that they should do something about it.
- tptacek 16y agoThat statement seems simultaneously accurate and unfair. It's true that the "fault" lies with the crappy proxies, and it's true that the fault is exposed by things other than WebSockets. But it's also true that for more companies, the Java applet plugin and the Flash plugin are the only two components that give attackers enough control over a victim's computer to coerce it into confusing the proxy. Think of them as having been grandfathered in; security teams already watch them closely (they also happen to be security nightmares).