8 ms·

Huh, I happen to be knee-deep in this stuff right now. This article noted that Slack seemed to be running an old TURN server (pre-coturn): https://webrtchacks.

by gfodor 7y ago

Huh, I happen to be knee-deep in this stuff right now. This article noted that Slack seemed to be running an old TURN server (pre-coturn): https://webrtchacks.com/slack-webrtc-slacking/ https://webrtchacks.com/slack-webrtc-slacking/ Given that the latest coturn has this vulnerability mitigated by default, perhaps all this boils down to is "Slack runs outdated software, we exploited it."?

jackewiehose 7y ago
It's not really a bug in old coturn, just a feature in the protocol. According to the article newer versions just disable routing to 127.0.0.1 by default but there are still other network addresses you might have to consider (see article for a recommended list of "denied-peer-ips").
- gfodor 7y ago
  Yup, sorry if my phrasing implied it's a bug. It's just better defaults, and there's evidence to support the idea slack was just running the software with the old defaults.
  - StillBored 7y ago
    But its not necessarily the defaults. The article isn't clear if the private services are on 127/8 or the TURN server has access to other things in the DMZ/VPC/whatever. I'm guessing its actually the latter as everyone is so fond of the 1:1 VM/container->service model. Meaning its likely a config problem with the denied-peer-ips the parent here links.
- jerf 7y ago
  You may already know this, but it's worth getting the word out. Do not just deny routing to 127.0.0.1. 127.0.0.1 is merely the conventional "localhost" address; however, ALL 127.x.x.x is "localhost". You can check this now on your local command line with "ping 127.1.2.3". (This just seems to be one of those bugs that every proxy goes through at some point, just like pretty much any attempt to write a web server that serves files off disk will have at least one directory traversal bug.)
  - zrm 7y ago
    Also don't forget that IPv6 ::1 is localhost too.
    - deleted 7y ago
      [deleted]
  - z3t4 7y ago
    The IP protocol is full of security gotchas so you better use a higher level protocol. Spoofing, arp attacks, TCP session hijacking, etc.
  - MrStonedOne 7y ago
    Fun fact, windows blocks remote desktoping to localhost (because doing so would lock the console session unless you break license and modify termserv). Fun fact 2, this only blocks 127.0.0.1. (side note: if you don't mind breaking license compliance on your personal pc, you can use this to remote desktop into other user accounts on the same pc for a nice separation of work spaces (or just move to linux))
    - o-__-o 7y ago
      You are not breaking the license if you pay per-seat rather than per-device. Ask me about CALs, I can tell you all about them.
      - monsieurbanana 7y ago
        Let's start with an easy question, what is CAL?
        o-__-o 7y ago
        Client access license. For Microsoft Windows they come in per-seat and per-machine. To OPs point, they were talking about RDP. When you are licensing per-machine then (windows server) you are limited to one desktop user and two remote users (for windows desktop it’s one user at a time). When it is per-seat then you can have as many concurrent connections as you have licensed for. Per-seat is enforced by Microsoft Licensing Server

by gfodor 7y ago

jackewiehose 7y ago

It's not really a bug in old coturn, just a feature in the protocol. According to the article newer versions just disable routing to 127.0.0.1 by default but there are still other network addresses you might have to consider (see article for a recommended list of "denied-peer-ips").

gfodor 7y ago
Yup, sorry if my phrasing implied it's a bug. It's just better defaults, and there's evidence to support the idea slack was just running the software with the old defaults.
- StillBored 7y ago
  But its not necessarily the defaults. The article isn't clear if the private services are on 127/8 or the TURN server has access to other things in the DMZ/VPC/whatever. I'm guessing its actually the latter as everyone is so fond of the 1:1 VM/container->service model. Meaning its likely a config problem with the denied-peer-ips the parent here links.
jerf 7y ago
You may already know this, but it's worth getting the word out. Do not just deny routing to 127.0.0.1. 127.0.0.1 is merely the conventional "localhost" address; however, ALL 127.x.x.x is "localhost". You can check this now on your local command line with "ping 127.1.2.3". (This just seems to be one of those bugs that every proxy goes through at some point, just like pretty much any attempt to write a web server that serves files off disk will have at least one directory traversal bug.)
- zrm 7y ago
  Also don't forget that IPv6 ::1 is localhost too.
  - deleted 7y ago
    [deleted]
- z3t4 7y ago
  The IP protocol is full of security gotchas so you better use a higher level protocol. Spoofing, arp attacks, TCP session hijacking, etc.
- MrStonedOne 7y ago
  Fun fact, windows blocks remote desktoping to localhost (because doing so would lock the console session unless you break license and modify termserv). Fun fact 2, this only blocks 127.0.0.1. (side note: if you don't mind breaking license compliance on your personal pc, you can use this to remote desktop into other user accounts on the same pc for a nice separation of work spaces (or just move to linux))
  - o-__-o 7y ago
    You are not breaking the license if you pay per-seat rather than per-device. Ask me about CALs, I can tell you all about them.
    - monsieurbanana 7y ago
      Let's start with an easy question, what is CAL?
      - o-__-o 7y ago
        Client access license. For Microsoft Windows they come in per-seat and per-machine. To OPs point, they were talking about RDP. When you are licensing per-machine then (windows server) you are limited to one desktop user and two remote users (for windows desktop it’s one user at a time). When it is per-seat then you can have as many concurrent connections as you have licensed for. Per-seat is enforced by Microsoft Licensing Server