LNCS 2820 - Ambiguity Resolution via Passive OS Fingerprinting

204 G. Taleck
The “freshness” of the fingerprint database existing on the IDS is also another
potential source of failure. While we do actively maintain our internal
fingerprint database as described in Section 4, our current solution does not automatically
fetch the latest copy on its own. We rely on the IDS administrators
to occasionally refresh the packages .
7.2 Implications
Because there does not exist a one-to-one mapping of operating system ambiguity
resolution to TCP SYN/SYNACK negotiation behavior, this solution is prone
to resolving ambiguities incorrectly. For example, a false negative would result if
an administrator changes the default TCP behavior of his or her Windows 2000
server to match that of FreeBSD 5.0, which is then hit with an ambiguity attack
for Windows 2000. Since the IDS identified the server as FreeBSD, which has
a different ambiguity resolution policy than Windows 2000, the attack would
be missed by the IDS. Similarly, false positives can also be generated in this
scenario if the attacking IP fragments or TCP segments formatted for FreeBSD.
However, note that an attacker is not able to change the IDS’s view of a
server the IDS is trying to protect. They will only be able to change the identity
of the system from they are connecting.
7.3 Comparison to Related Work
8 Future Work
The approach described in this paper can be extended in many other directions,
both to increase the accuracy of identifying end host network stacks and in
resolving protocol ambiguities.
Current passive OS fingerprinting works only with the IP and TCP headers,
and even then not to their full extent. Research [21] has shown how web
servers operate differently under congestion. The tcpanoly[20] tool uses many
passive methods that could be integrated into the detection engine by noting
gratuitous ACKing, Reno implementations, and other variations throughout a
TCP conversation.
The sensor has the ability to use temporal knowledge of a particular IPs
passively detected OS fingerprint to statistically guess the OS type in a NATed
environment.
Passive fingerprinting can also be used to detect NATed hosts. Since NAT
typically only rewrites IP addresses, and possibly TCP or UDP ports, and leaves
other fields and options unscathed, the IDS can identify a NAT by counting the
number of unique fingerprints for the same IP. If a fingerprint radically changes
repeatedly in a given amount of time, a NAT can be detected and used more
intelligently by the engine.
We can increase the confidence level of SYNACK fingerprint lookups by
paying closer attention when we cache values. When a SYNACK is cached, its