New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 601334 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Last visit 24 days ago
Closed: Jun 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Bug-Security



Sign in to add a comment

Security: using WebRTC to misappropriate bandwidth

Reported by tldmar...@gmail.com, Apr 7 2016

Issue description

VULNERABILITY DETAILS
As you know, WebRTC can be used to create "P2P CDNs" where users watching the same video will upload and download from each other. Eg: www.peer5.com, www.webtorrent.io

Danger: There's nothing stopping webmasters from surreptitiously using traffic on one site to provide bandwith for another. 

Scenario: Bob only reads the news on the train but receives a surprise phone bill for $1000. He is told "Chrome does that sometimes". Meanwhile Alice watches porn on the train and never has to wait for buffering.

POSSIBLE SOLUTIONS:
- When on 4G, request permission before a site can use WebRTC.
- Add offending sites to Chrome's blacklist.

VERSION
Chrome Version: 47+
Operating System: any

REPRODUCTION
Not needed - it's a feature not a bug... but a feature with an evil unforeseen use that can be prevented.
 

Comment 1 by kenrb@chromium.org, Apr 8 2016

Cc: juberti@chromium.org
Components: Blink>WebRTC
Labels: OS-All
Status: Untriaged (was: Unconfirmed)
The general problem of sites abusing the bandwidth of their visitors isn't solvable, but I suppose the idea here is that P2P CDNs might create an incentive for them to do so?

Are there any examples of this actually happening? There isn't much to do for blacklisting such sites if we don't know of any behaving in this way.

juberti@: Do you know if any thought has been given to bandwidth constraints for WebRTC over expensive network connections?
"The general problem of sites abusing the bandwidth of their visitors isn't solvable, but I suppose the idea here is that P2P CDNs might create an incentive for them to do so?"

That's right.

"Are there any examples of this actually happening?"

Not that I'm aware of.

Comment 3 by kenrb@chromium.org, Apr 8 2016

Cc: -juberti@chromium.org
Labels: Security_Severity-Low Security_Impact-Stable
Owner: juberti@chromium.org
Status: Assigned (was: Untriaged)
It isn't clear to me that there is anything reasonable that we can do about this but I am assigning it to get feedback from someone on WebRTC.
It's not clear what the incentive is for the news site to start chewing up bandwidth. They would be taking a significant reputation risk by doing so.

However, we have undertaken the work to better understand what type of network we are on, so if we want to start looking at how common P2P CDN usage is on cell networks, that's something we could investigate.

Comment 5 by tldmar...@gmail.com, Apr 16 2016

Hi. There's nothing secret about this report, right? I'm assuming that's the case, but decided it would be polite to get confirmation :-)
Project Member

Comment 6 by sheriffbot@chromium.org, May 4 2016

Labels: Pri-2
Status: WontFix (was: Assigned)
This is not a security vulnerability.

Comment 8 by mea...@chromium.org, Jun 10 2016

Labels: -Restrict-View-SecurityTeam
Project Member

Comment 9 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 10 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment