Re: Preventing Denial of Service Attack In IPC Serialization
On Jul 8, 3:54 pm, Nominal Pro <majorsc...@gmail.com> wrote:
[snippage]
Without using something like SSL and PKI, it would be possible for an
attacker to cause unconstrained memory allocation on a server that
uses, say, Boost serialization. But how is that a "flaw" in the
serialization framework? That's like saying, "I left the door to my
house unlocked, and somebody came in and ran the water in the bathtub
and flooded my home. It must be a design flaw in my bathtub so let's
talk about securing the bathtub." The problem is not the bathtub. The
problem is that you didn't keep intruders out of your home.
It occurred me during my Sunday bike ride that SSL, used in the mode
accounts for perhaps 90%+ of Internet usage, will not help, because,
in that mode, only the server provides proof of authenticity. The
client does not provide proof of authenticity, which is why the server
requires client to provide username/password.
With a full-blown PKI and authenticity in both directions, that will
solve the problem, but again, the vast majority of distributed
applications running on the open Internet today have no authenticity
in place. I suspect this is why it is so easy to write programs to
crash Yahoo messenger, etc.
This is a serious problem.
-Le Chaud Lapin-
--
[ See http://www.gotw.ca/resources/clcm.htm for info about ]
[ comp.lang.c++.moderated. First time posters: Do this! ]