Re: HTTP is just fine -- v. HTTP is insecure --> need a better metaphor

On 2015-11-28 19:13, Kevin Chadwick wrote:
>> This is the second time I read ddos amplification in this thread.
>>
>> DDOS amplification is an issue where UDP services (mostly ntp and dns)
>> send a reply to potentially forged packets that is larger than the sent
>> package. This can be abused for ddos attacks.
>>
>> This has nothing to do with https. Not at all. HTTPS won't make ddos
>> amplification any different, it happens on completely different
>> protocols.
>
> Not true at all there are many forms, SSL as a form of amplification can
> wreak major havoc. A 100x amplification was demonstrated by tying
> together attacks involving DNSSEC and TLS.

The SSL/TLS attack is that you can make the server use more CPU time 
than the client.

The DNSSEC thing is probably just about a DNS reflection attack, but 
that a DNSSEC enabled domain usually returns more data.  There are also 
DNSSEC implementations that sign on the fly so you can get those to use 
more CPU too.

I'm not sure what you mean with 100x when combining DNSSEC and TLS, and 
what is exactly 100 times more.


Kurt