Haunted by Legacy: Discovering and Exploiting Vulnerable Tunnelling Hosts [pdf](papers.mathyvanhoef.com)