Tales from the Crypt: fingerprinting attacks on encrypted channels by way of retainting

摘要: Paradoxically, encryption makes it hard to detect, fingerprint and stop exploits. We describe Hassle, a honeypot capable of detecting fingerprinting monomorphic polymorphic attacks on encrypted channels. It uses dynamic taint analysis in an emulator detect attacks, tags each tainted byte memory with pointer its origin the corresponding network trace. Upon attack, we correlate blocks trace generate various types signature. As correlation data is difficult, retaint connections, making point decrypted instead.