Comments (4)
Hey @kixelated
I don't think this is possible anymore, BindRequests are filtered via MessageIntegrity (so if the attacker doesn't know the pwd we are safe)
from ice.
Nope, not safe. The attacker in this case will set up a PeerConnection using it's own credentials. It can set up ICE/DTLS/SRTP everything. Except it will suddenly claim to have a different IP address by forging the UDP return address header. This tricks the server to take the attacker's legitimate PeerConnection and redirect it elsewhere.
For example, if Pions gets a STUN binding request that claims to be sent from google.com:80
, it will mark it as a validPair
and potentially use it as the result from getBestPair
. Pions would then proceed to shove SRTP/DTLS traffic at Google which won't know what to do with it. The PeerConnection can be kept alive by the attacker because they can still send RTCP/STUN packets from their valid but lower priority real IP address.
The fix is to require a SuccessResponse
from the remote candidate with the same transaction ID as your previously sent BindRequest
before you can mark it as valid. That's why the transaction ID exists.
from ice.
if Pions gets a STUN binding request that claims to be sent from google.com:80
How? Binding requests are discarded unless you know the uPwd
from ice.
Talked to @kixelated on Slack I understand the issue now.
We have to check TransactionIDs and we MUST require success responses from peers. Otherwise a candidate could give us invalid prflx candidates (and we would start sending traffic to 3rd parties unexpectedly)
from ice.
Related Issues (20)
- Rename Agent.startOnConnectionStateChangeRoutine() to Agent.startRoutines() HOT 1
- Simplify Agent.updateConnectionState() HOT 1
- Reenable IPv6 UDPMux tests in i386
- Active TCP candidates? HOT 7
- Support server reflexive TCP candidate type HOT 13
- Fix type of CandidatePairState enum
- TestAgentActiveTCP test is failing due to data race
- Active TCP performs network operations in main thread HOT 7
- Connection failing to TCP candidate when listening on multiple interfaces using `MultiTCPMux` and `NAT1To1IPs` HOT 5
- Noisy warnings if TURN/STUN host is not reachable via IPv6
- Panic when adding candidate HOT 6
- bug(log): webrtc using ice will print wrong log HOT 1
- ice v2 depends on transport v2.2.2, which had a breaking change HOT 1
- Candidate type is not changed from peer-reflexive to host HOT 1
- Allow users to pass custom 'CandidateSelectorControlling` and `CandidateSelectorControlled` HOT 3
- ConnectionState changes may be reported incorrectly HOT 4
- Please add a new release tag HOT 2
- Android 11 ListenUDP permission denine
- Support ipv6 for mDNS Server HOT 3
- Start the listening port by default above 1024 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ice.