Issue metadata
Sign in to add a comment
|
Security: using WebRTC to misappropriate bandwidth
Reported by
tldmar...@gmail.com,
Apr 7 2016
|
||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS As you know, WebRTC can be used to create "P2P CDNs" where users watching the same video will upload and download from each other. Eg: www.peer5.com, www.webtorrent.io Danger: There's nothing stopping webmasters from surreptitiously using traffic on one site to provide bandwith for another. Scenario: Bob only reads the news on the train but receives a surprise phone bill for $1000. He is told "Chrome does that sometimes". Meanwhile Alice watches porn on the train and never has to wait for buffering. POSSIBLE SOLUTIONS: - When on 4G, request permission before a site can use WebRTC. - Add offending sites to Chrome's blacklist. VERSION Chrome Version: 47+ Operating System: any REPRODUCTION Not needed - it's a feature not a bug... but a feature with an evil unforeseen use that can be prevented.
,
Apr 8 2016
"The general problem of sites abusing the bandwidth of their visitors isn't solvable, but I suppose the idea here is that P2P CDNs might create an incentive for them to do so?" That's right. "Are there any examples of this actually happening?" Not that I'm aware of.
,
Apr 8 2016
It isn't clear to me that there is anything reasonable that we can do about this but I am assigning it to get feedback from someone on WebRTC.
,
Apr 8 2016
It's not clear what the incentive is for the news site to start chewing up bandwidth. They would be taking a significant reputation risk by doing so. However, we have undertaken the work to better understand what type of network we are on, so if we want to start looking at how common P2P CDN usage is on cell networks, that's something we could investigate.
,
Apr 16 2016
Hi. There's nothing secret about this report, right? I'm assuming that's the case, but decided it would be polite to get confirmation :-)
,
May 4 2016
,
Jun 10 2016
This is not a security vulnerability.
,
Jun 10 2016
,
Oct 1 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
|
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by kenrb@chromium.org
, Apr 8 2016Components: Blink>WebRTC
Labels: OS-All
Status: Untriaged (was: Unconfirmed)