Hackers use SSL security tool to attack servers

Researchers have released details of a tool that they claim enables denial-of-service (DoS) attacks by using SSL (Secure Sockets Layer), a cryptographic protocol designed to improve internet security.

The tool was released by a group called "The Hacker's Choice" (THC), and, according to its web site, it is unique among DoS tools.

"The tool departs from traditional DoS tools as it does not require any bandwidth and just a single attack computer," a THC representative wrote on the site.

Traditional DoS attacks bombard a server with requests until its processing capacity is full, preventing genuine users from accessing any content it hosts.

In order to generate sufficient requests, most DoS tools, including that used by hacktivist group Anonymous to attack Paypal and Mastercard's servers, among others, rely on simultaneous attacks from a large number of users.

This new tool differs in that it can operate from just one computer. Rather than bombarding a server with requests for information, it sends multiple session requests, requiring multiple SSL handshakes (or renegotiations) to authenticate the identities of both parties.

This requires a large amount of server resources, which eventually will cause the server to fail.