Live data from Hacker News

Transmission – BitTorrent users beware: Flaw lets hackers control your computer

11–12 of 12 posts

Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer

#11

Post by ekimekim » Wed, Jan 17, 2018, 1:50 AM UTC

tinus_hn wrote: post #10

ekimekim wrote: post #5

This is ridiculous. Not that I'm defending Transmission on their slowness here, but this is fundamentally a chrome issue. Websites being able to access services running on localhost is a security vulnerability , a sandbox escape. People assume restricting incoming connections to localhost means that only localhost can connect, because that is exactly what that is MEANT to do. I don't think it's reasonable for every s…

True, but the DNS rebinding attack is real and invalidates a lot of assumptions.

Then shouldn't it be fixed? Again, this is a chrome bug.

Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer

#12

Post by tinus_hn » Wed, Jan 17, 2018, 2:41 PM UTC

ekimekim wrote: post #11

tinus_hn wrote: post #10

Earlier quoted context omitted.

True, but the DNS rebinding attack is real and invalidates a lot of assumptions.

Then shouldn't it be fixed? Again, this is a chrome bug.

It would be shortsighted to simply call this a Chrome bug.

You can use this attack to make the browser communicate with somebody else’s computer. If that computer happens to give the user privileges because of his IP address, for instance because he is in the same home or because he is on localhost, the attacker can then use these privileges.

One could imagine Chrome blocking this attack with respect to localhost but blocking connections to machines on the home network is farfetched.

And note that it’s not just web services, the browser can start general tcp connections.

Post reply on HN