0

I have two applications running on the same computer. These applications need to communicate with each other. One application acts like a server and the other like a client.

Client <-> Server communication is handled with a HTTPS connection. The server uses a self signed certificate for this. The self signed certificate is generated at startup and is only kept in RAM.

These applications run on Linux, Windows and MacOS.

I am researching possible ways a non-root user could listen in on the communication between these two applications. However since I am not an expert in this field I am having trouble finding information.

What kind of risks/attacks can I expect? I am thinking man-in-the-middle attacks, packet sniffing, ssl stripping etc.

  • 1
    .... how does the "client" know what the server certificate/identity is? If you have a secure channel to distribute the id, is it secure enough to distribute a symmetric key? Otherwise, normally you set things up so that only specific processes have access to anything - which means you could set up an unencrypted pipe and it would be unreadable/inaccessible (in Windows, it appears only one client could use a pipe. For *nix variants pipes are nearly file references, so presumably normal ACL rules apply.). – Clockwork-Muse Jan 16 at 7:14
  • Right now the client has no way to verify the certificate/identity. The client however is started by the server so maybe I can pass info about the identity as a start up argument? I am not all that familiar with pipes. I'll need to read up on this. – Mathyn Jan 16 at 8:26
  • 2
    If the client has no way to validate the server identity, you have no way to secure the communication. If the client is started by the server, though, you can pass whatever you want, including a symmetric key. Or nothing - pipes don't have to go through TCP stack overhead, and there's ways to share system/process memory, too. – Clockwork-Muse Jan 16 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.