Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 11 down vote favorite
6

I'm interested in learning more about web sockets security. Read that web sockets were originally in Firefox, removed for security reasons and now added back in with the problem resolved: http://news.ycombinator.com/item?id=2600022

Intial read of them seems like plenty of oppotunity for vulnerabilities just like traditional sockets in OS.

  • What are the security risks with web sockets?
  • How are they currently mitigated by modern browsers?
  • What else should be done to mitigate the risks?
share|improve this question

3 Answers

up vote 9 down vote accepted

WebSockets protocol is a tricky beast to evaluate right now, as it's changing frequently. After the flaws in draft-hixie-thewebsocketprotocol-76 of the WebSockets protocol discovered by Adam Barth et al. a few months ago, Firefox disabled WebSockets implementation in about:config preferences. Since then, a new protocol version is in the works, currently up to draft-ietf-hybi-thewebsocketprotocol-07, that tries to fix the flaws discovered. The browsers quickly adapt to the new version - see e.g. Mozilla bug #640003. But - on the other end, WebSocket servers still try to maintain backward compatibility, e.g. Socket.IO server still supports version pre-76.

So you might still succeed in trying to connect to WS server outside the browser, forcing older version of the protocol (see my tool already mentioned in the comments above).

But still - you are unable to send completely arbitrary traffic through WS connection. The frames begin with NUL byte, end with \xFF, with UTF-8 string inbetween (+ a handshake), so cross-protocol-attacks are not so easy to perform. Still, I'd rather use WSS:// encrypted version than the plaintext one.

share|improve this answer
2  
If you wish to compare the IETF spec versions, here's a diff: – Krzysztof Kotowicz Jun 2 '11 at 13:15
@Krzysztof-Kotowicz thanks that is useful information. So at the moment sounds like TLS/SSL, if you can force a older version (i.e. implementation flaw) then you can exploit known vulnerabilities. Is something like buffer overflow and other traditional attacks possible for websockets currently? – Rakkhi Jun 2 '11 at 15:10
2  
I haven't heard of any low-lewel bugs like buffer owerflow in WS implementations, but it's certainly possible. You could also attack the application protocol used inside WS connection, for example socket.io once had a denial-of-service bug. When passed an invalid JSON message, the server crashed. This and other vulnerabilities within application are likely to occur in future, but that's not really the weakness of the protocol. – Krzysztof Kotowicz Jun 3 '11 at 8:26
Thanks. That seems consistent with what the links @atdre posted say. Seem more things a designer / threat modeller should be aware of when evaluating a web app that uses websockets: - the client can be spoofed (it doesn't have to be the browser) - ws:// server can't be trusted (MiTM attacks) - you need to handle the authentication - the communication over ws:// protocol is plaintext. – Rakkhi Jun 3 '11 at 8:29
up vote 3 down vote

Here are a couple of useful resources discussing WebSocket security - all of them pretty detailed:

[Disclosure: I work for Kaazing.]

share|improve this answer
up vote 2 down vote

It's not just Mozilla that put a ban on the WebSocket protocol. Many organizations are blocking WebSocket interaction using deep packet inspection, UTM/advanced-firewall technologies, and/or secure web gateways. It may be a hurdle to ever get it working properly.

If you want a lot of information regarding the security issues with the WebSocket protocol, be sure to check out this paper from CMU entitled [ PDF Talking to Yourself for Fun and Profit PDF ].

share|improve this answer
1  
thanks for link, added to reading list. Abstract says their recommendations have been adopted by the websockets working group. Any information on current vulnerabilities or attack trees? Regarding corporate blocking - is it possible to tunnel websockets over http or socks? – Rakkhi Jun 1 '11 at 16:10
@Rakkhi: I don't know how to answer your question best yet, but check out some more resources -- sla.ckers.org/forum/read.php?6,35771,35771 -- blog.kotowicz.net/2011/03/… -- blog.kotowicz.net/2011/01/… – atdre Jun 1 '11 at 16:32
2  
If you figure out more, please post an answer here. It's ok to answer your own question! – atdre Jun 1 '11 at 16:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.