Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS
Credit: Maksymilian Arciemowicz (https://cxsecurity.com/)
URL: https://cxsecurity.com/issue/WLB-2016100213


--- 0. Description ----

The latest macOS and iOS have weak OCSP validation process which allow
attacker to send OCSP requests (up to 200k) in name of victim during
MiTM attack.

--- 1. MiTM and handshake OCSP verification ---
Apple's SecureTransport trusts and checks OCSP URLs without
verification of certificate authority, common name etc. Attacker is
able to create self-sign certificate with huge list of OCSP URLs in
order to trigger network traffic before inform user about untrusted
certificate.

Observed behaviors:
CORRECT [ wget with openssl ]
-------------------------------------
$ wget https://abuse.cert.cx/pack.jpg
--2016-09-24 20:04:21--  https://abuse.cert.cx/pack.jpg
Resolving cert.cx... 198.27.126.246
Connecting to abuse.cert.cx|198.27.126.246|:443... connected.
ERROR: cannot verify abuse.cert.cx's certificate, issued by
aCN=CXSECBBBB16248617,OU=CXSECRUITY.COM,O=CXSECRUITY.COM,ST=Poland,C=PLa:
  Self-signed certificate encountered.
ERROR: no certificate subject alternative name matches
  requested host name aabuse.cert.cxa.
To connect to abuse.cert.cx insecurely, use `--no-check-certificate'.
-------------------------------------

MiTM and OCSP with SecureTransport
-------------------------------------
$ curl https://abuse.cert.cx/pack.jpg -v
*   Trying 198.27.126.246...
* Connected to abuse.cert.cx (198.27.126.246) port 44443 (#0)

[ no timeout ]

$ curl -V
curl 7.49.1 (x86_64-apple-darwin16.0) libcurl/7.49.1 SecureTransport zlib/1.2.8
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps
pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IPv6 Largefile GSS-API Kerberos SPNEGO NTLM
NTLM_WB SSL libz UnixSockets
-------------------------------------

--- 2. DDoS and Resource Exhaustion ---
Each handshake may trigger many OCSP requests (verified up to 200k)
with GET method like this.

macOS 10.12.1 User-Agent
"GET /fake-ocsp.php HTTP/1.1" 200 1 "-" "trustd (unknown version)
CFNetwork/807.0.4 Darwin/16.0.0 (x86_64)"

MacOSX 10.11.6 User-Agent
"GET /fake-ocsp.php HTTP/1.1" 200 1 "-" "ocspd/1.0.3"

scenario of attack is trivial, the attacker send victim a link to some
resource eg image through SSL like

<img src="https://abuse.cert.cx/noexists.jpg">

and OS's victim will perform a few thousands requests to OCSP URLs.

Attack may be directed to third part resource so that many users
unknowingly become part of a DDoS attack. One HTTPS request can
trigger several thousand other HTTP

Another scenario assumes extension of handshake time. Observed timeout
of OCSP requests to 7 seconds. However, you can try to increase the
size of the OCSP response. In order to consume network bandwidth.

In the case of the iPhone, restart Safari will not stop defective
handshake. Similarly, in macOS. It's recommend to restart device or
disconnect from network until all OCSP requests will expire.

--- 3. PoC ---
live poc for macOS 10.12 Safari/curlhttps://abuse.cert.cx

Download cerificates with 15k OCSP
requestshttps://cert.cx/ssldos/crt.crthttps://cert.cx/ssldos/key.key

--- 4. Credit ---
Maksymilian Arciemowicz (https://cxsecurity.com/)

Best Regards/D! D1/2DdegD,D>>NNND,D1/4D, D?D3/4DPDuD>>DdegD1/2D,ND1/4/Najlepsze pozdrowienia
Maksymilian Arciemowicz