1

I tested my server against cryptographic attacks and I have a few major and minor issues. However I would like to know how can I mitigate and protect against such vulnerability warning:

Secure Client-Initiated Renegotiation - DoS DANGER

5

how can I mitigate and protect against such vulnerability warning

Well, generally speaking, everybody knows that defending against DoS attacks -whatever their nature is- is a difficult and expensive thing to achieve. Coming back to your essential problem, it happens when an attacker overwhelms your server with secure connection requests leading it to consume more CPU resources. This problem is called TLS renegotiation MITM and was first discovered on 2009 exploiting a flaw in the TLS v.1/SSL v.3 stack layers before RFC 5746 and its implementations appeared. Before that, several patches were applied more or less genuinely.

So right now, I suppose your OpenSSL version is outdate. You can update it to at least to OpenSSL version 0.9.8m release or newer (but OpenSSL versions 1.0.1 through 1.0.1f and OpenSSL 1.0.2-beta are affected by the HeartBleed problem).

Whether you are using Apache (recent versions), IIS or any other product that supports the client-initiated renegotiation feature, please disable it (it is often their by default).

If you know to know more about how this vulnerability, please refer to this: SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?. Also, may be you are interested in reading about the first tool developed for this type of DoS attack.

3
  • Heartbeat extension wasn't backported to the previous OpenSSL branches, it only exists in several OpenSSL 1.0.1 releases and 1.0.2 beta. – Adm Selec Aug 7 '15 at 6:46
  • @AdmSelec I checked that, you are right. Thank you very much for the rectification. I edited the answer. – user45139 Aug 7 '15 at 6:49
  • I have a Windows Server with Apache 2.4 and OpenSSL 1.1.1a How do I disable Secure Client-Initiated renegotiation on that server? – Shivam K. Thakkar Jun 20 '19 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.