Websites and servers frequently get hacked when a vulnerability is present in the server side code. Does UDP or TCP hole punching put that risk onto the users of the application when the connections become peer to peer?
Take for example the clearly vulnerable practice of execing an unsanitized input. Obviously this practice would not be done by design, but this kind of thing happens far too often by mistake. In a traditional setup, if
user_a interacts with
user_b we would first have
user_a send input to the server, the server would process the data, and then send something to
user_b. With hole punching, we get a peer to peer between the two users and so
user_a sends data to
user_b processes it for himself. If a vulnerability was present in how the input was processed by the server (in this case execing it without sanitizing), the vulnerability could just as easily be present on the client side, allowing
user_a to inject and directly run code on
If a severe vulnerability were to be found in a hole punching application (Skype and other VoIP services, some multiplayer realtime games, et al), is there anything stopping a malicious hacker from having a direct backdoor into the system of any user they interact with? If not, are peer to peer programs unnecessarily risky? Is there a catch-all way to mitigate this risk for people creating these application? And what about people who use these applications? Do programs like Skype leave users at an undue level of risk (more so than typical)?