1

I've been reading about WebSockets, and learned that they apply masking of messages using a XOR cipher. This is done in order to prevent attackers from being able to make the data they send using WebSockets look like an HTTP request, because this could lead to cache poisoning, as described in the Talking to Yourself for Fun and Profit paper. However, this seems rather pointless to me, as an attacker could write their own WebSockets client, which does not apply masking, or in which they generate keys that are known to them, thereby being able to craft the sent data to look like an HTTP request anyway. The spec even admits this:

Despite the protection provided by masking, non-compliant HTTP proxies will still be vulnerable to poisoning attacks of this type by clients and servers that do not apply masking.

So is masking pointless then? Why is it even part of the protocol? Am I missing something?

1 Answer 1

1

An attacker can only run a modified WebSockets client on a machine they control.

The major concern with WebSockets is that you're allowing a third-party website to control the WebSockets client on your machine. So potentially a malicious website could perform unwanted actions to devices on your private network. But because the WebSockets client within browsers does apply masking, this prevents those kinds of attacks.

2
  • Thank you for your answer. Could you explain a bit more how a malicious website could perform unwanted actions to devices on my private network if it had control of the WebSockets client on my machine?
    – ckruf96
    Commented Oct 20, 2022 at 10:40
  • @ckruf96 - If an attacker controlled your WebSockets client and was able to turn off masking, they can essentially make arbitrary network connections on your private network, so they could tamper with internal services, e.g. accessing a web cam or private data on a NAS. Services that require authentication would have some protection, although there's still risks around weak passwords and pre-auth vulnerabilities.
    – paj28
    Commented Oct 20, 2022 at 13:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .