Slitheen++: Stealth TLS-based Decoy Routing
summary
Slitheen++ claims to stop upstream traffic analysis by hiding covert uploads inside legitimate TLS flows and using HTTP/2 header compression to make space for covert data. It implements per-connection queues and FIFO or sliced round‑robin schedulers, and adds crawling and thinking time to emulate real users. Measurements show user-visible costs (median page load rises from 7s to 8s with crawling), reduced covert throughput in some cases, and a CPU prototype that proves the design but lacks ISP-scale forwarding capacity.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 0:23Decoy Routing
- 4:04Key Challenges
- 6:18User Experience
- 8:10Covered Good Put
- 10:20Additional Delay
- 11:13Conclusion
related talks
19mDefending against Traffic Analysis Attacks with Flexible In-Network Obfuscation
20mmmTLS: Scaling the Performance of Encrypted Network Traffic Inspection
29mYou Can’t Hide: How a Device Can Give Away a Fraudster’s Secrets.
28mSlirp is Dead, Long Live Slirp! A New Approach to User-mode Networking
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
40mWhirlwind tour through the HTTP2 spec
26mDisrupting Malicious Traffic with Egress Proxies
51mHTTP/2 & Quic - Teaching Good Protocols to Do Bad Things