1

I was reading up on how to make two programs talk to each other on my machine, and I saw the option to use sockets. One website suggested that sockets are entirely internal, so that seemed to suggest to me that no security is necessary because the sockets are not visible outside my machine.

But then I was reading about SSL. I am now confused, are they referring to the same type of sockets? Do I need security?

Thanks in advance.

1
4

The Secure Sockets Layer does indeed refer to the operating system concept of sockets.

Sockets are a generalized form of inter-process communication. At the most basic level a socket allows you to read and write data to and from the socket just as though you are reading or writing a file, the difference is only that the source and destination of socket communications is another computer process rather than a file.

Sockets can be used to connect different processes on the same machine, or different processes on different machines. The interface is abstract by design so that the end programmer (you) don't need to worry about whether or not your messages are being passed through memory to another process over a local Unix-domain socket or whether they're going over an IP network or whether they're using UDP or TCP, etc.

However, the traditional sockets model doesn't let you know who is reading and writing the other end of the communications channel. Even within a single machine you can't be confident that there isn't some malware connected to the other end of your communications channel. This is much more true for internet-enabled sockets, which might read/write data from anyone in the world. Moreover, whenever your data travels over a physical medium, whether that's the RAM inside a machine or a copper wire, there's the chance that an adversary may be trying to intercept or modify your communications.

Thus, sockets provide the communication mechanism, but don't guarantee the authenticity of different parties to a communication, or the confidentiality of data passed through the sockets mechanism.

Transport Layer Security (TLS) and it's predecessor the Secure Sockets Layer (SSL) are solutions to the above problems. The TLS protocol can use public-key cryptographic solutions (e.g. signed certificates and trusted third parties) to guarantee that the process on the other end of a socket does indeed belong to the people who claim to own the socket, and it can use regular encryption to perform end-to-end encryption between the socket endpoints.

The difference between a regular socket and a secure socket in practice is that a regular socket is wrapped inside a secure interface, so the socket technology does not change but the wrapper guarantees that all communications sent over the regular socket are properly encrypted and decrypted.

https://stackoverflow.com/questions/7698488/turn-a-simple-socket-into-an-ssl-socket

1

Sockets provide a way which two process could communicate with each other. Now this communication could either be a machine to machine communication, or within one system.

Usually, sockets are used for process-to-process communication over the network since there are other ways for processes to communicate on the same machine (.e.g. shared memory).

Note that "securing a socket" is a generic term and not just about using SSL. In general, confidentiality is an important part of your application's security which you can achieve using SSL. However, there is more to security than just confidentiality especially for unmanaged code like C++.

Part of "running security on your program" is to filter the data that is passing back and fourth over your sockets.

From a security point of view, when your program is made up of multiple components (e.g server and client) it is always recommended to secure/filter/sanitize any incoming input and outgoing output between those components even if that data isn't coming from the user directly (in latest Vault7 leak there was an exploit that exploited unsecured/filtered data exchange between Cisco switches allowing for DOS or unauthorized access)

In the case you're describing, there are many scenarios where things could wrong because of a local unsecured socket.

For example, if that socket was running with high privileges, it could be exploited by hackers to perform "Privileges escalations" after s\he gains access on the machine.

The fact that the socket isn't exposed to the network, means that the socket and the data aren't vulnerable to "remote" attacks (attacks that could be conducted over the network) but it is still possible for them to be abused through local attacks (local exploits and malicious payloads) and during post exploitation process.

0

One website suggested that sockets are entirely internal, so that seemed to suggest to me that no security is necessary because the sockets are not visible outside my machine

Unix domain socket is entirely internal to the machine, however implementing security is still necessary to reduce your attack surface. You can set permission on the socket file, to restrict which process(es) can use the socket to interact with your program.

Secure Socket Layer or Transport Layer Security is an authentication and encryption scheme, usually used for external sockets like TCP and sometimes UDP (with DTLS). Generally, it makes little sense to run SSL/TLS over Unix domain socket (SSL/TLS has overhead, and you can have better control using socket permissions).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.