Hack the Hackers: Leaking Data Over SSL/TLS
Ionut Cernica analyzes automated hacker tooling and exploit scripts, demonstrating how predictable exploit traffic leaks target data to network eavesdroppers over TLS.
Summary
Predictable Behaviors in Automated Exploit Frameworks
Offensive security scanners and automated cybercrime exploit scripts frequently follow rigid, deterministic logic when executing payloads over encrypted networks.
Reconstructing Attack Logic from Encrypted TLS Metadata
Ionut Cernica investigates traffic patterns across popular exploit frameworks, analyzing packet sizes, TLS handshake parameters, and timing intervals.
Leaking Exfiltrated Data to Passive Network Observers
By reverse engineering the deterministic encryption padding and response handling of poorly coded attack tools, a third-party passive observer can reconstruct the stolen data.
Hardening Offensive Scripts and Threat Intelligence Applications
Cernica provides operational security guidelines for red teams and illustrates how defenders can apply traffic heuristics to detect automated attack tools.
Related talks
Village Presentations·38 min
Robert Simmons
Robert Simmons explains how to construct high-volume spam honeypots to capture live malware binaries, track bulletproof hosts, and harvest threat intel.
Main Stage·44 min
Maxime Bergeron · Olivier Bilodeau
Gozint and ESET researchers use PyRDP to record and classify over 100 hours of attacker sessions on exposed RDP honeypots into behavioral archetypes.
Main Stage·45 min
Chad Seaman
Akamai researcher Chad Seaman presents UPnProxyPot, a Golang honeypot that impersonates vulnerable UPnP routers to intercept and MITM blackhat proxy networks.