Re: Real Audio Security

[Darren Reed <darrenr () reed wattle id au>]

> Could someone point me to any research data on the security pitfalls of Real
> Audio through a firewall?

> Particularly interested in bandwidth issues, use of PN prxy or other.

Well, factor in that apparently the TCP connection that gets made, either
to or from the proxy, can come from any box on the 'net (so I'm told).
My experience with this comes from writing IP Filter to only allow
connections to be made to/from the IP#'s involved in the initial session
setup, following the PNA protocol which you get port numbers from and
then having it users tell me it doesn't work because the actual audio
content comes from a different IP# out on the Internet.

All in all, it amounts to a pretty insecure protocol if implemented to
support that.  I'm sure there is some interesting potential for exploiting
this with a `fake' music server and getting people to open up ports!

Darren