An SSL trojan unmasked