Your OpSec Is Showing

The talk argues that defenders who chase static IP addresses and domains fall behind, because attacker infrastructure rotates quickly while the underlying cryptographic stack tends to persist. The speaker introduces JARM, an active TLS fingerprint that sends ten crafted handshakes with varied cipher orders, protocol versions and extensions, then condenses the server's responses into a 62-character hash. That hash reflects the TLS library in use rather than application content, which makes it useful for spotting shared software choices across hosts.

The middle of the talk works through examples. A widely used public DNS resolver produces a hash shared by a huge number of hosts, so blocking on that hash alone would hit everyone. A raw command-and-control server with a placeholder source address and a default admin port shows how an implementation mistake can make a fingerprint far more telling. The speaker also covers the traps: a legitimate Go-based bakery website matched a C2 signature, and actors using reverse proxies or randomized cipher output can mask the original hash, although the evasion itself can become a new anomaly.

The takeaway is that a JARM match is a strong lead rather than a verdict. Analysts should pair it with certificate names, extension ordering, open port layouts and HTTP response headers, then use those combined filters in internet scanners to find related infrastructure.