SSL DoS, Snort, and You
Summary: Cisco Talos tested the THC SSL DoS tool, which opens a small number of SSL connections and then rapidly renegotiates the SSL handshake inside those same connections, letting a single connection generate thousands of handshake requests without large bandwidth or a distributed attack. Talos wrote Snort rules matching the Handshake content type (0x16) plus the SSL/TLS version bytes, paired with a detection_filter of 25 events in 2 seconds, and noted that detection requires removing the noinspect_encrypted option from Snort's SSL preprocessor, which carries a performance penalty.
Why it matters: The attack removes the bandwidth barrier that made flooding DDoS expensive: one connection and thousands of renegotiation requests can take a server down, and Snort's default configuration will not see it once the session is encrypted.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026