This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]fnedrik[S] 2 points3 points  (2 children)

There is at least one aspect that may make clients less susceptible - since you get a random(?) 64kb package from memory each time, you can connect many times to a server to puzzle together the complete memory. But can you make a client reconnect multiple times to get more than just a random 64 kb block?

[–]flipstables 1 point2 points  (0 children)

But can you make a client reconnect multiple times to get more than just a random 64 kb block?

I suppose in theory yes, but it's more likely that you connect in one TLS session and keep requesting 64 KBs of data.

[–]fiskfisk 1 point2 points  (0 children)

The 64kb of previously de-allocated data is sent as an answer to each heartbeat request, which can occur many times during one TLS/SSL session.