Tales from the crypt: Fingerprinting attacks on encrypted channels by way of retainting

Michael Valkering; Asia Slowinska; Herbert Bos

doi:10.1007/978-0-387-85555-4_1

Tales from the crypt: Fingerprinting attacks on encrypted channels by way of retainting

Michael Valkering
, Asia Slowinska
, Herbert Bos

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

Abstract

Paradoxically, encryption makes it hard to detect, fingerprint and stop exploits. We describe Hassle, a honeypot capable of detecting and fingerprinting monomorphic and polymorphic attacks on encrypted channels. It uses dynamic taint analysis in an emulator to detect attacks, and it tags each tainted byte in memory with a pointer to its origin in the corresponding network trace. Upon detecting an attack, we correlate tainted memory blocks with the network trace to generate various types of signature. As correlation with encrypted data is difficult, we retaint data on encrypted connections, making tags point to decrypted data instead.

Original language	English
Title of host publication	Proceedings of the 3rd European Conference on Computer Network Defense
Pages	1-20
Number of pages	20
Volume	30 LNEE
DOIs	https://doi.org/10.1007/978-0-387-85555-4_1
Publication status	Published - 1 Dec 2009
Event	3rd European Conference on Computer Network Defense, EC2ND 2007 - Heraklion, Crete, Greece Duration: 4 Oct 2007 → 5 Oct 2007

Publication series

Name	Lecture Notes in Electrical Engineering
Volume	30 LNEE
ISSN (Print)	1876-1100
ISSN (Electronic)	1876-1119

Conference

Conference	3rd European Conference on Computer Network Defense, EC2ND 2007
Country/Territory	Greece
City	Heraklion, Crete
Period	4/10/07 → 5/10/07

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 7 Affordable and Clean Energy

Access to Document

10.1007/978-0-387-85555-4_1

Persistent URL (handle)

Persistent link

Cite this

@inproceedings{85b6c2b8c9b14f2fa16a95c6a47353e3,

title = "Tales from the crypt: Fingerprinting attacks on encrypted channels by way of retainting",

abstract = "Paradoxically, encryption makes it hard to detect, fingerprint and stop exploits. We describe Hassle, a honeypot capable of detecting and fingerprinting monomorphic and polymorphic attacks on encrypted channels. It uses dynamic taint analysis in an emulator to detect attacks, and it tags each tainted byte in memory with a pointer to its origin in the corresponding network trace. Upon detecting an attack, we correlate tainted memory blocks with the network trace to generate various types of signature. As correlation with encrypted data is difficult, we retaint data on encrypted connections, making tags point to decrypted data instead.",

author = "Michael Valkering and Asia Slowinska and Herbert Bos",

year = "2009",

month = dec,

day = "1",

doi = "10.1007/978-0-387-85555-4\_1",

language = "English",

isbn = "9780387855547",

volume = "30 LNEE",

series = "Lecture Notes in Electrical Engineering",

pages = "1--20",

booktitle = "Proceedings of the 3rd European Conference on Computer Network Defense",

note = "3rd European Conference on Computer Network Defense, EC2ND 2007 ; Conference date: 04-10-2007 Through 05-10-2007",

}

Valkering, M, Slowinska, A & Bos, H 2009, Tales from the crypt: Fingerprinting attacks on encrypted channels by way of retainting. in Proceedings of the 3rd European Conference on Computer Network Defense. vol. 30 LNEE, Lecture Notes in Electrical Engineering, vol. 30 LNEE, pp. 1-20, 3rd European Conference on Computer Network Defense, EC2ND 2007, Heraklion, Crete, Greece, 4/10/07. https://doi.org/10.1007/978-0-387-85555-4_1

Tales from the crypt: Fingerprinting attacks on encrypted channels by way of retainting. / Valkering, Michael; Slowinska, Asia; Bos, Herbert.
Proceedings of the 3rd European Conference on Computer Network Defense. Vol. 30 LNEE 2009. p. 1-20 (Lecture Notes in Electrical Engineering; Vol. 30 LNEE).

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Tales from the crypt

T2 - 3rd European Conference on Computer Network Defense, EC2ND 2007

AU - Valkering, Michael

AU - Slowinska, Asia

AU - Bos, Herbert

PY - 2009/12/1

Y1 - 2009/12/1

N2 - Paradoxically, encryption makes it hard to detect, fingerprint and stop exploits. We describe Hassle, a honeypot capable of detecting and fingerprinting monomorphic and polymorphic attacks on encrypted channels. It uses dynamic taint analysis in an emulator to detect attacks, and it tags each tainted byte in memory with a pointer to its origin in the corresponding network trace. Upon detecting an attack, we correlate tainted memory blocks with the network trace to generate various types of signature. As correlation with encrypted data is difficult, we retaint data on encrypted connections, making tags point to decrypted data instead.

AB - Paradoxically, encryption makes it hard to detect, fingerprint and stop exploits. We describe Hassle, a honeypot capable of detecting and fingerprinting monomorphic and polymorphic attacks on encrypted channels. It uses dynamic taint analysis in an emulator to detect attacks, and it tags each tainted byte in memory with a pointer to its origin in the corresponding network trace. Upon detecting an attack, we correlate tainted memory blocks with the network trace to generate various types of signature. As correlation with encrypted data is difficult, we retaint data on encrypted connections, making tags point to decrypted data instead.

UR - https://www.scopus.com/pages/publications/84884996884

UR - https://www.scopus.com/pages/publications/84884996884#tab=citedBy

U2 - 10.1007/978-0-387-85555-4_1

DO - 10.1007/978-0-387-85555-4_1

M3 - Conference contribution

AN - SCOPUS:84884996884

SN - 9780387855547

VL - 30 LNEE

T3 - Lecture Notes in Electrical Engineering

SP - 1

EP - 20

BT - Proceedings of the 3rd European Conference on Computer Network Defense

Y2 - 4 October 2007 through 5 October 2007

ER -

Tales from the crypt: Fingerprinting attacks on encrypted channels by way of retainting

Abstract

Publication series

Conference

UN SDGs

Access to Document

Persistent URL (handle)

Other files and links

Fingerprint

Cite this