B4J Question Websocket & hackers

[LucaMs]

Could a hacker break into a secure websocket connection? Send data on that "channel" as if he were the "owner" of the connection?

 

[Sandman]

That's such a vague premise that I don't have a problem answering that they absolutely could do it.

Assuming they already have full access to the machine. (But in that case you have a lot bigger problem than the websocket connection, of course.)

 

[LucaMs]

Just found...

 

[TILogistic]

??

Eclipse Jetty : CVE security vulnerabilities, versions and detailed reports

Eclipse Jetty security vulnerabilities, exploits, metasploit modules, vulnerability statistics and list of versions

www.cvedetails.com

 

[Star-Dust]

As you know, I recently wrote a WebServer from scratch including the webSocket protocol.

The answer is yes. The protocol is not secure, the encoding is known and easily decoded. The masking method is also simple. It is possible to insert and send sial packets to the client and to the server easily pretending to be the correspondent with the Man In Middle attack

Permissions follow a simple process with MD5 encoding, but by reading the public encryption keys (which are in the clear) you can easily override

 

[LucaMs]

So the only way to be sure that the data was sent by the "owner" of the websocket channel is... to pray?

 

[TILogistic]

So the only way to be sure that the data was sent by the "owner" of the websocket channel is... to pray?

Use a token to send and receive data.

 

[EnriqueGonzalez]

So the only way to be sure that the data was sent by the "owner" of the websocket channel is... to pray?

Websocket is backed by HTTP, you can get the httprequest from the websocket protocol and look for the session variables, unless the user has its session compromised i dont think you will have any issue.

 

[Star-Dust]

So the only way to be sure that the data was sent by the "owner" of the websocket channel is... to pray?

use TSL 1.2

 

[LucaMs]

Thanks for your answers.

At this moment I heard:
"This is a protocol violation!"
But that's only because I'm "listening" to "Law & Order", so I don't think they're talking about http

1. Token: how do i know if i passed it to the legitimate client user? Every time I forget how to exploit the public-private key technique; I suppose it would be the best way.
2. (damn mosquito )
3. Session variables: theoretically a hacker could get these too, right? (and actually the token too)
4. TSL 1.2: I guess the older version was also considered safe, then...! Also I suppose the ability to use version 1.2 depends on the client and server libraries (I have to check this).

While waiting for you (and others) to choose which strategy is the best , I search the web.


Thank you.


[Meanwhile "Law & Order" is over and I haven't heard how they framed the killer ]
[... and I failed to kill the mosquito ]

 

[Erel]

No need to do anything other than use SSL (TLS).

 

[Star-Dust]

Thanks for your answers.

At this moment I heard:
"This is a protocol violation!"
But that's only because I'm "listening" to "Law & Order", so I don't think they're talking about http

1. Token: how do i know if i passed it to the legitimate client user? Every time I forget how to exploit the public-private key technique; I suppose it would be the best way.
2. (damn mosquito )
3. Session variables: theoretically a hacker could get these too, right? (and actually the token too)
4. TSL 1.2: I guess the older version was also considered safe, then...! Also I suppose the ability to use version 1.2 depends on the client and server libraries (I have to check this).

While waiting for you (and others) to choose which strategy is the best , I search the web.


Thank you.


[Meanwhile "Law & Order" is over and I haven't heard how they framed the killer ]
[... and I failed to kill the mosquito ]

With plaintext communication you cannot be sure that you have connected with the legitimate client.

As already mentioned with the security protocols of verifying the certificates it is really complex to pretend to be the legitimate computer. Attacks on security protocols are not as easy as with WebSocket alone. They require a lot of expertise.

Usually those who have these skills do not attack LucaMS 'computers but those of the banks

I cannot add anything else because everything I write tomorrow could be used against me (cit. Law and order)

 

[LucaMs]

Usually those who have these skills do not attack LucaMS 'computers but those of the banks

I need it exactly for my two banks.