If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL?

If so, how could SSL fail if a malicious app

  1. Had total control over the computer
  2. Was a non-root linux user
  3. Could only listen to communications

SSL will usually not help.

If the attacker has complete control over the computer, then he wins. He can inspect and modify the memory of all process in the computer.

If the attacker is only a non-administrative user, then he won't be able to spy on process from other users. However, if the attacker can run code as the same user as either the server or the client of your envisioned localhost-only connection (or both), then he can plunder the RAM of the involved process, and he wins. Also, assuming a non-administrative attacker means that you trust that the said attacker could enter the machine but did not find any privilege-escalation exploitable hole: that's a rather optimistic assumption.

If the attacker can only listen to communications, but not have a look at the memory of the process, then SSL may help, since it will prevent spying. However, this is not a very realistic scenario: spying on localhost connections requires local admin privileges.

Where SSL may help is about authentication: a local attacker, with non-admin rights, may try to connect to the server and impersonate the client, or vice-versa. SSL provides authentication: the client validates the server's certificate, and, if the server asked for a client certificate, the server validates the client's certificate. Note, though, that on localhost, there are more efficient ways for a server to know who is at the other end of the socket (e.g. getpeereid()).

  • Thank you very much Tom Leek! So a windows virus could have its way and not even need to look at the network traffic; it could simply look at the memory and see all information unencrypted? Thank you so very much in advance! – user36556 Jan 13 '14 at 14:27
  • 1
    @Gracchus: It could. In IT security you should always assume the worst case scenario, which is basically why we implement strong solutions using the Plan, Do, Check method. If malicious code runs on a virtual machine with the least privileges it could still break out of the VM and get control of your host for instance (seen it the wild). Against cryptography there are some attacks, it's important to know which algorithm is broken and which is not, in the case of SSL, check out SSL VS TLS and their different versions/vulnerabilities. And stay away from EC2. – Aki Jan 13 '14 at 15:04
  • Can't edit anymore, but I obviously meant EC not EC2. As in the dual elliptic curve algorithm that is compromised (or actually broken by design). Which is funny since the NSA recommends (nsa.gov/business/programs/elliptic_curve.shtml) using it. While there are no proof they got the magic numbers needed to break the algorithm, but they do encourage its use even though there's a "backdoor" built-in. – Aki Apr 28 '14 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy