0

I think we all heard the news that China used unencrypted HTTP-connections to drive DDoS attacks on targeted websites.

Now within the last few months we've learned about three new attacks (FREAK/Logjam/POODLE) that allow us to recover the master-secret of SSL/TLS connections.

So the following question came to my mind:

Assuming you've (successfully) attacked a SSL/TLS connection using either POODLE, FREAK or Logjam, can you use the gathered information to redirect the request to another site, causing a DDoS attack?

Improve this question
7
  • 1
    Most of these attacks are MiTM attacks, so unless you get a admin account, you can not actually do anything to the 'site' itself. just to the person connecting to it.
    – LvB
    Commented May 27, 2015 at 18:55
  • @LvB, well that's the point: Can you forward the connection of an unsuspecting user to abuse it for DDoS, like China did with their "great cannon" for plain connections?
    – SEJPM
    Commented May 27, 2015 at 18:57
  • 1
    If you can decrypt the live stream while in the middle, then you could easily inject javascript just like the Great Cannon. Are you asking about the likelihood of being able to decrypt "at speed" in order to do this?
    – schroeder ♦
    Commented May 27, 2015 at 18:59
  • if you want to do the attack on each and every one of the users you want to use for the DDos than yes you could.... but that is really computational intensive and requires many vulnerable users.
    – LvB
    Commented May 27, 2015 at 19:00
  • @schroeder, I think a "good" answer to this question would state the same as your comment with including if the mentioned and maybe other attacks (CRIME, BEAST, exploited Heartbleed,...) can be abused for "decryption at speed" and for the mentioned injection.
    – SEJPM
    Commented May 27, 2015 at 19:03

2 Answers 2

Reset to default
2

Yes, if you run a full Man-in-the-Middle attack and succeed at breaking through the SSL layer through some method (not POODLE, it does not do that, but FREAK and Logjam, when applicable, are a possibility), then, by definition, you control everything that the client sends and receives. So you could send redirect HTTP requests to make it connect to some other server.

However, still by definition, you can do the MitM because you arranged for all the incoming and outgoing traffic of that client to go through your systems. Therefore, any attempt at turning the client into a DoS agent will make it send these requests to you. So you are really DoS-ing yourself. Thus, this is pointless.

A better model would be to use this hijacked connection to try to induce the victim into downloading some malware that will give full control of his machine to you, and allow you to come back later (when you no longer intercept all I/O traffic) to pursue some nefarious deeds such as sending spam or, indeed, run DDoS attacks (assuming that you succeeded at infecting a lot of people's machines).

Improve this answer
1
  • For causing a HTTP redirect you only need to mitm the original request. The redirect then will be done by the browser directly and the attacker is no longer involved and can not be seen as the cause of the redirected request by the victim too. If the redirect request then retrieves some large resource (like an iso image) it may actually be an effective DOS of the victim without needing more resources from the attacker. But it would still require large costs for the attacker to MITM the initial requests, so it would probably be cheaper to do other kind of DOS.
    – Steffen Ullrich
    Commented May 27, 2015 at 20:11
0

Assuming you've (successfully) attacked a SSL/TLS connection using either POODLE, FREAK or Logjam, can you use the gathered information to redirect the request to another site, causing a DDoS attack?

In theory yes for Logjam and FREAK if the attacker can do an active man-in-the-middle (which should be possible with the Great Firewall). In practice the computational effort required on site of the attacker is really high, so this would more cause a denial of "service" on the attacker side. And since there are way cheaper methods to do a DOS attack why bother.

Improve this answer
2
  • is this (in theory) possible with all known attacks (if clients are vulnerable) -> Logjam, FREAK, POODLE, exploited heartbleed, CRIME, BEAST, ... ?
    – SEJPM
    Commented May 27, 2015 at 19:22
  • No. Attacks like CRIME and BEAST depend on a specific behavior on the client side and need lots of traffic, so they are not usable for just a short redirection of one connection. I think POODLE also needs lots of data. FREAK and logjam are kind of similar but need a server having EXPORT ciphers and are or get fixed on the client side currently too, so you will not be able to use them for long. But at least these two should be doable if both sides are vulnerable by hijacking a single handshake.
    – Steffen Ullrich
    Commented May 27, 2015 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .