[hybi] wrt security concerns with socket-capable browsers

[=JeffH <Jeff.Hodges at KingsMountain.com>]

Here's the pointer to the post/doc that I mentioned in the BoF today. Please 
note these caveats..

1. this work is based on examination of exploits possible with Flash's socket 
capabilities (tho it applies in general to socket-capabilities weldable by code 
downloadable into a browser, modulo any security knobs present on such socket 
capabilities)

2. the issues raised are very real, within the space circumscribed in (1).


Here's the pointers..

Socket Capable Browser Plugins Result In Transparent Proxy Abuse
http://www.thesecuritypractice.com/the_security_practice/2009/03/socket-capable-browser-plugins-result-in-transparent-proxy-abuse.html

Socket Capable Browser Plugins Result In Transparent Proxy Abuse V1.0
By Robert Auger (PayPal Information Risk Management Team)
http://www.thesecuritypractice.com/the_security_practice/TransparentProxyAbuse.pdf


HTH,

=JeffH