Transmission – BitTorrent users beware: Flaw lets hackers control your computer
1–10 of 12 posts
Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer
#2Google Project Zero-discovered flaw allows remote execution by malicious site if remote access in enabled in the client with no password set. This is not uncommon since people assume restricting to localhost will prevent access outside the host machine.
Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer
#3> I regularly encounter users who don't accept that websites can access services on localhost or their intranet," Ormandy wrote. "These users understand that services bound to localhost are only accessible to software running on the local machine and that their browser is running on the local machine—but somehow believe that accessing a website 'transfers' execution somewhere else. It doesn't work like that, but this is a common source of confusion."
does this mean a malicious site can query data from a running service, such as local MySQL? If so, isn't that a big deal? I know lots of places that run things open locally because they're behind a firewall.
Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer
#4Isn't there just the one flaw here? That random websites can make connections to localhost through a browser? Are we now going to enumerate every possible thing that accepts connections on localhost without authentication?
>"I regularly encounter users who don't accept that websites can access services on localhost or their intranet,"
That seems to be a very reasonable thing to not accept...
Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer
#5This is ridiculous. Not that I'm defending Transmission on their slowness here, but this is fundamentally a chrome issue. Websites being able to access services running on localhost is a security vulnerability, a sandbox escape. People assume restricting incoming connections to localhost means that only localhost can connect, because that is exactly what that is MEANT to do. I don't think it's reasonable for every service in the world to now assume the loopback interface is hostile because browsers can't get their act together.
Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer
#6This is ridiculous. Not that I'm defending Transmission on their slowness here, but this is fundamentally a chrome issue. Websites being able to access services running on localhost is a security vulnerability , a sandbox escape. People assume restricting incoming connections to localhost means that only localhost can connect, because that is exactly what that is MEANT to do. I don't think it's reasonable for every s…
Agreed. Javascript's security model is broken if it allows this. It is just that simple. Blaming services that trust localhost is delusional.
Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer
#7> I regularly encounter users who don't accept that websites can access services on localhost or their intranet," Ormandy wrote. "These users understand that services bound to localhost are only accessible to software running on the local machine and that their browser is running on the local machine—but somehow believe that accessing a website 'transfers' execution somewhere else. It doesn't work like that, but this…
As MySQL uses a custom binary protocol, it should be fine. On the other hand, anything using a line-based protocol is in danger.
https://bouk.co/blog/hacking-developers/
So, if you have, say, telnet bound to localhost without a password, you are not safe (modern browser would drop the response as it's not valid HTTP, but with telnet you don't exactly care anyway).
Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer
#8Isn't there just the one flaw here? That random websites can make connections to localhost through a browser? Are we now going to enumerate every possible thing that accepts connections on localhost without authentication? >"I regularly encounter users who don't accept that websites can access services on localhost or their intranet," That seems to be a very reasonable thing to not accept...
Hard to call it a flaw... it's definitely problematic, but it's seen legitimate uses in many web apps (Spotify, Discord to think of two) as a way to communicate with their own desktop client from the web.
The other related issue is that communicating with localhost over https is very hard for an app. I wonder if there is a potential way to kill two birds with one stone here with some browser changes.
Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer
#9Pretty similar to what happened with the Jupyter Notebook last year.
Re: Transmission – BitTorrent users beware: Flaw lets hackers control your computer
#10This is ridiculous. Not that I'm defending Transmission on their slowness here, but this is fundamentally a chrome issue. Websites being able to access services running on localhost is a security vulnerability , a sandbox escape. People assume restricting incoming connections to localhost means that only localhost can connect, because that is exactly what that is MEANT to do. I don't think it's reasonable for every s…
True, but the DNS rebinding attack is real and invalidates a lot of assumptions.