Re: Are SOs automatically reconnected?

> Using a sniffer, they are reading the name of the service calls, then
> connecting from some IDE like flexbuilder where they can quickly build
> an array of calls.

I need to check out flexbuilder - so far I thought it was an IDE similar
to regular Flash?

Thing is, they are connecting the actual client. The client is
encryptend (= obscured to the point no decompiler can handle it :) and
without a decompiled client it's pretty much impossible to spoof the
challenge/response handshake for the autorization. Then while they are
connecting, they are adding RTMP packets. I don't know if it's injected
in the same connection or if they are actually opening a new one. But
why connect with the regular client first then?

Also the server does check the referer the client is including. I know
that this is no security at all on a professional level, but we are
talking about hurt egos with some google talents here. I doubt they can
snoop and resend packets or even build their own RTMP connect with
arbitrary parameters. They must be using some sort of tool for it, and
if it runs in the flash client, at least the referer cannot be spoofed,
can it?



> The other problem is the 'someone'. It is time to connect real accounts
> with users on red5 to eliminate the 'someone' and turn it into an id/ip.

Can't do that. Some versions of the chat are completely open without a
login. There is just a ban mechanism, which checks IP, a fingerprint,
and stuff like that. But that's a manual process not tied to an account
or such.


> Assuming you have some SQL, add a collumn for a session variable. Create
> a hash out of some random information, and store it in a db associated
> with the user who logs in.
>
> Give this hash to the user as a flash var. Your flash code must give
> this variable to red5. Red5 will reject any client without a valid hash
> in the db. Hash is not shared between users.

That's something to consider. Though the database is on a different
machine, but since they are on the same network, the delay should be
neglectable.


> If you lose connection of the netconnection to the point that you get a
> netConnection.Closed status message, you must manually reconnect any
> shared object.

Hm, then this can't be an accident. Thanks! :)




_______________________________________________
Red5 mailing list
Red5@...
http://osflash.org/mailman/listinfo/red5_osflash.org