11

From time to time one of the websites I browse regularly becomes a victim of a DoS/DDoS attack and usually they solve the problem by switching to https. I cant see the connection between the attack and the defense? TLS encrypts the connection what does this have to do with the number of connections that consume the server's resources?

19

The only reason switching to HTTPS might help is if the attack is focused on only HTTP. There is no inherent DOS protection in HTTPS. In contrary, you could probably tie up the resources of the server with HTTPS with even less efforts if you start with a minimal SSL handshake so that the server has something to do but never continue with the SSL handshake after the server has sent its response.

  • 1
    How does it help if the attack was targeting HTTP? – Ulkoma Jan 18 '15 at 15:57
  • 2
    If this an application level DOS attack like slowloris it will not affect HTTPS connection because these are on another port (assuming you have HTTP disabled completely). Of course it does not matter if it is a lower level DOS attack which just eats all available bandwidth. – Steffen Ullrich Jan 18 '15 at 16:32
  • 1
    an other port! that's what I didn't think of.. so next time my website becomes under attack I can order the web server to use port 22222 and email all my customers to access the site using the url:22222 or simply switch to https. What stops the attacker from attacking the new port? – Ulkoma Jan 18 '15 at 17:14
  • If the attacker knows the new HTTP port it can attack it too, of course. If the attacker uses a HTTP only attack tool it will not succeed against HTTPS because this is not only a different port but also a different protocol, i.e you can't just use slowloris against port 443 (HTTPS) and hope it will work. – Steffen Ullrich Jan 18 '15 at 17:16
  • 4
    It's not really hard to write a DOS tool for TLS connections. It's probably enough to open a TCP connection, send a TLS ClientHello and then just keep the connection open. – Steffen Ullrich Jan 18 '15 at 17:27
10

Two things might make a difference here:

  • If you switch from HTTP to HTTPS, you're switchings ports and protocols. It's effectively a different site. So the attacker would have to modify his attack to target the HTTPS site instead. Many DDoS attacks aren't nearly that sophisticated, so switching protocols could be all it takes.

  • HTTPS requires more complexity on the client side than HTTP. Many bots used for this type of attack aren't particularly advanced, and HTTPS could be beyond the capability of the code in use.

4

HTTPS uses a different port than regular web sites, hence many DDOS attacks that are attacking a web site directly via port 80 will get no response from a site expecting (and only responding to) HTTPS ports (443 instead of port 80)

4

There are a few poorly thought out answers on here. A DDoS can be one of a few different attacks, all using numbers to overwhelm a site:

  • Page generation attacks. Make the server(s) generate CPU-expensive pages for lots of users in a way that can't be cached. This slows the whole thing down.
  • Flood attacks to fill SYN queues
  • Bandwidth exhaustion

They don't "fill up" port 80 and leave the rest of the server and network alone.

Given that HTTP and HTTPS are usually served from the same machine, in the same network, behind the same routers... There is zero protection afforded from just making HTTPS available. It is a different port but so what?

The only case in which that will make a difference is if you're getting page-generation attacks on HTTP and to work around it, you disable :80 HTTP and only use :443 HTTPS. But:

  • This breaks it for all your users (and Google) who use port 80. Wasn't that the goal the attacker wanted?
  • 301 redirecting them automagically will (likely) redirect the attack
  • Even if it doesn't DDoSes aren't hard to change. They're remote controlled computers. An attacker can easily change the order.

This won't help with network flood attacks. This might temporarily(for the same reasons as above) help with bandwidth exhaustion.

If you want to protect against a DDoS you hide the servers that are generating the pages (so attackers can't communicate with it directly) and you use a very large, very robust network of balanced proxy servers. This is essentially what CloudFlare is, on a global scale.

  • I think that in the comment that the server can switch ports, the assumption is that the server kills existing connections, stops the service on port 80, then restarts on the new port, thereby stopping the attack the way it was started. – schroeder Jan 19 '15 at 18:24
  • It's analogous to stopping burglars by moving your door to the right. That HTTPS is a fairly standard means it's not even security by obscurity. – Oli Jan 19 '15 at 18:28
  • I completely agree, but for an automated DDoS attack, that "move to the right" can be what is needed to get back up and running. I've seen it before (done it myself) and it is a quick and dirty way to get services running again. The OP asked why it is used, and this is why: it sometimes works. – schroeder Jan 19 '15 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.