‹ BackHN Continuity

Thread

Xray-core concealed a certificate verification bypass vulnerability

73 points · 9 comments · timbill

Loading the complete thread in the background. This saved snapshot is available now. Refresh

  1. cryptolobster · · focus · HN ↗
    The reaction to Xray-core is disappointing
  2. eriwang915 · · focus · HN ↗
    Xray-core's pinnedPeerCertSha256 treated an inserted leaf as the pinned cert, and the fix commit never called it a vulnerability.
    1. LoganDark · · focus · HN ↗
      Your LLM left out the clear hypocrisy and the part where the fixed version still had a vulnerability
  3. usernomdeguerre · · focus · HN ↗
    I get the impression that much of Xray's usage is in mainland China, do many other ecosystems use it? If not, why not?

    Naively I would expect solutions out of Mainland China to be more sophisticated due to the internet restrictions within the country and the number of people who are digitally-connected.

    But perhaps they cover for usecases one doesn't see outside the gfw.

    1. sekisusam · · focus · HN ↗

      [dead]

    2. ranger_danger · · focus · HN ↗
      There are other countries that routinely block traffic like Iran or Russia, but there are also some simple methods that go right past the GFW many times, like anything that's tunneled over TLS, or even just plain SSH.

      The "new hotness" are tunnel/proxy/VPN setups that utilize multiple endpoints at once to spread out the "suspicion" of all your traffic going through a single host all the time.

      1. [deleted] · · focus · HN ↗

        [deleted]

    3. amritananda · · focus · HN ↗
      You can also use it to get around captive portals where some traffic is still allowed. Some Airline flights where messaging services are free only check the SNI, so setting the Xray domain to whatsapp.com or something similar usually works.
      1. ranger_danger · · focus · HN ↗
        What if ESNI/ECH is being used?
        1. amritananda · · focus · HN ↗
          I'm assuming you'll have to configure your DNS to use the captive portal DNS which would defeat ECH. The only time I was able to get this working as a captive portal bypass I was using a hardcoded remote IP as my Xray host so DNS wasn't an issue.
  4. soltanov · · focus · HN ↗
    Fixing the code is only half of incident response. Without an advisory, affected-version range, and downstream notification, users cannot know whether they remain exposed.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.