When TLS Hacks You (Q&A)

Joshua Maddux, security researcher at Quirky and Cora, joins DEF CON Safe Mode for a live Q&A session discussing his research into abusing Transport Layer Security (TLS) connections to facilitate Server-Side Request Forgery (SSRF) and trigger protocol-level deserialization attacks [00:38]. Maddux explores the novel exploitation vector demonstrated in his tool `tls-poison`, which leverages TLS Session Resumption and TLS session IDs/tickets to inject arbitrary text payloads into plaintext internal network services [23:27].

The discussion explains how traditional defenses against SSRF—such as protocol filtering and URL validation—often inspect the initial HTTP/HTTPS scheme but fail when an attacker induces an outbound TLS handshake to a malicious server [05:20]. Maddux describes how a rogue TLS server can return a crafted TLS session ID containing malicious protocol commands (for example, raw memcached commands or SMTP payloads). When the victim client resumes the session or re-connects via internal DNS rebinding, the unencrypted handshake tokens are transmitted to internal services, injecting commands into local daemons that expect plaintext lines [09:52, 14:27].

Maddux addresses the technical mechanics of combining DNS rebinding with TLS, noting how short TTL values and multi-record IP responses force client applications to bounce between external attack infrastructure and private RFC 1918 loopback addresses [18:50]. He reviews remediation strategies, emphasizing that developers must disable TLS session resumption where unnecessary, validate client certificates, and enforce strict network egress filtering on servers handling outbound webhooks.

(AI summary — Gemini Flash)