Apple macOS 10.12.1 / iOS 10 SecureTransport SSL Handshake MitM / DoS

`Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS  
Credit: Maksymilian Arciemowicz (https://cxsecurity.com/)  
URL: https://cxsecurity.com/issue/WLB-2016100213  
  
  
--- 0. Description ----  
  
The latest macOS and iOS have weak OCSP validation process which allow  
attacker to send OCSP requests (up to 200k) in name of victim during  
MiTM attack.  
  
--- 1. MiTM and handshake OCSP verification ---  
Apple's SecureTransport trusts and checks OCSP URLs without  
verification of certificate authority, common name etc. Attacker is  
able to create self-sign certificate with huge list of OCSP URLs in  
order to trigger network traffic before inform user about untrusted  
certificate.  
  
Observed behaviors:  
CORRECT [ wget with openssl ]  
-------------------------------------  
$ wget https://abuse.cert.cx/pack.jpg  
--2016-09-24 20:04:21-- https://abuse.cert.cx/pack.jpg  
Resolving cert.cx... 198.27.126.246  
Connecting to abuse.cert.cx|198.27.126.246|:443... connected.  
ERROR: cannot verify abuse.cert.cx's certificate, issued by  
aCN=CXSECBBBB16248617,OU=CXSECRUITY.COM,O=CXSECRUITY.COM,ST=Poland,C=PLa:  
Self-signed certificate encountered.  
ERROR: no certificate subject alternative name matches  
requested host name aabuse.cert.cxa.  
To connect to abuse.cert.cx insecurely, use `--no-check-certificate'.  
-------------------------------------  
  
MiTM and OCSP with SecureTransport  
-------------------------------------  
$ curl https://abuse.cert.cx/pack.jpg -v  
* Trying 198.27.126.246...  
* Connected to abuse.cert.cx (198.27.126.246) port 44443 (#0)  
  
[ no timeout ]  
  
$ curl -V  
curl 7.49.1 (x86_64-apple-darwin16.0) libcurl/7.49.1 SecureTransport zlib/1.2.8  
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps  
pop3 pop3s rtsp smb smbs smtp smtps telnet tftp  
Features: AsynchDNS IPv6 Largefile GSS-API Kerberos SPNEGO NTLM  
NTLM_WB SSL libz UnixSockets  
-------------------------------------  
  
--- 2. DDoS and Resource Exhaustion ---  
Each handshake may trigger many OCSP requests (verified up to 200k)  
with GET method like this.  
  
macOS 10.12.1 User-Agent  
"GET /fake-ocsp.php HTTP/1.1" 200 1 "-" "trustd (unknown version)  
CFNetwork/807.0.4 Darwin/16.0.0 (x86_64)"  
  
MacOSX 10.11.6 User-Agent  
"GET /fake-ocsp.php HTTP/1.1" 200 1 "-" "ocspd/1.0.3"  
  
scenario of attack is trivial, the attacker send victim a link to some  
resource eg image through SSL like  
  
<img src="https://abuse.cert.cx/noexists.jpg">  
  
and OS's victim will perform a few thousands requests to OCSP URLs.  
  
Attack may be directed to third part resource so that many users  
unknowingly become part of a DDoS attack. One HTTPS request can  
trigger several thousand other HTTP  
  
Another scenario assumes extension of handshake time. Observed timeout  
of OCSP requests to 7 seconds. However, you can try to increase the  
size of the OCSP response. In order to consume network bandwidth.  
  
In the case of the iPhone, restart Safari will not stop defective  
handshake. Similarly, in macOS. It's recommend to restart device or  
disconnect from network until all OCSP requests will expire.  
  
--- 3. PoC ---  
live poc for macOS 10.12 Safari/curlhttps://abuse.cert.cx  
  
Download cerificates with 15k OCSP  
requestshttps://cert.cx/ssldos/crt.crthttps://cert.cx/ssldos/key.key  
  
--- 4. Credit ---  
Maksymilian Arciemowicz (https://cxsecurity.com/)  
  
Best Regards/D! D1/2DdegD,D>>NNND,D1/4D, D?D3/4DPDuD>>DdegD1/2D,ND1/4/Najlepsze pozdrowienia  
Maksymilian Arciemowicz  
  
  
`