LNCS 2820 - Ambiguity Resolution via Passive OS Fingerprinting

More documents

Recommendations

Info

Ambiguity Resolution via Passive OS Fingerprinting 205 corresponding SYN options encoded value is also cached. However, this value may change from client to client. If we can cache a SYNACK for each encoded SYN, then when a lookup happens, we could potentially have 16 entries to match against each sub-table. The best-match algorithm could then find the closest operating system type for the given host. 9 Summary In this paper, we describe a new method and implementation for emulating end host network stacks by using new passive OS fingerprinting techniques. Compared to previous approaches, this method requires no work on the part of administrators and still allows the stealth operation of the IDS sensor. Additionally, the mapping occurs in real-time. That is, traffic from a host that was just brought up via DHCP can be mapped as soon as the sensor sees traffic from or to it. Passive detection does not rely on cooperation of firewalls or some given network topology to operate effectively. While knowing the network topology is useful in detecting TTL evasions, it is not necessary for passive fingerprinting. This approach, while not perfect, attempts to remove some of the exploits available to attackers trying to evade detection. Finally, passive detection allows us to deploy IDS sensors on a read-only cable and in a passive tap configuration, and still reap the benefits of Active Mapping. Acknowledgments Thanks to Mike Frantzen, Kevin Smith, and Jim Bauer for assistance with this work and reviews of this paper. References 1. Shankar, Umesh.: Active Mapping: Resisting NIDS Evasion Without Altering Traffic http://www.cs.berkeley.edu/˜ushankar/research/active/activemap.pdf (2003) 2. Spitzner, L.: Know Your Enemy: Passive Fingerprinting, Identifying remote hosts, without them knowing. http://project.honeynet.org/papers/finger/ 3. Ptacek, T. H., Newsham, T.N.: Insertion, Evasion and Denial of Service: Eluding Network Intrusion Detection. Secure Networks, Inc. 1998. http://www.aciri.org/vern/Ptacek-Newsham-Evasion-98.ps 4. Handley, M. and Paxson, V.: Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics. Proc. 10th USENIX Security Symposium, 2001. http://www.icir.org/vern/papers/norm-usenix-sec-01-html/norm.html 5. Paxson, V.: Bro: A System for Detecting Network Intruders in Real-Time. Computer Networks, 1999. 6. Fyodor: The Art of Port Scanning.
206 G. Taleck 7. Fyodor: Remote OS detection via TCP/IP Stack FingerPrinting http://www.insecure.org/nmap/nmap-fingerprinting-article.html 8. Smart, M., Malan, G., Jahanian, F,: Defeating TCP/IP Stack Fingerprinting. Proc. 9th USENIX Security Symposium. 2000. 9. Berrueta, D.B.: A practical approach for defeating Nmap OS-Fingerprinting http://voodoo.somoslopeor.com/papers/nmap.html 10. Arkin O., Yarochkin, F.: Xprobe v2.0, A Fuzzy Approach to Remote Active Operating System Fingerprinting. http://www.sys-security.com/archive/papers/Xprobe2.pdf 11. Song, D.: fragroute. http://www.monkey.org/˜dugsong/fragroute/ 12. Savage. queso. http://www.apostols.org/projects.html 13. Michal Zalewski, M., Stearns, W.: p0f. http://www.stearns.org/p0f/ 14. Alberto Ornaghi, Marco Valleri.: ettercap. http://ettercap.sourceforge.net/ 15. Yoann Vandoorselaere, et. al.: prelude-ids. http://www.prelude-ids.org/ 16. Postel, J.: Internet Protocol, RFC 791. September 1981. 17. Postel, J.: Transmission Control Protocol, RFC 793. September 1981. 18. Jacobson, V., Braden, R., Borman, D.: TCP Extensions for High Performance, RFC 1323. May 1992 19. Griffin, J.L.: Testing Protocol Implementation Robustness. 29th Annual International Symposium on Fault-Tolerant Computing, 15-18 June 1999. 20. Paxson, V.: Automated Packet Trace Analysis of TCP Implementations SIG- COMM, 1997. 21. Padhye, J., Floyd, S: Identifying the TCP Behavior of Web Servers. ICSI Technical Report 01-002, 2000. 22. Comer, D.E.: Probing TCP Implementations. Usenix Summer, 1994. 23. McCanne, S., Leres, C., Jacobson, V.: libpcap http://www.tcpdump.org/, 1994. 24. Veysset, F., Courtay, O., Heen, O,: New Tool and Technique For Remote Operating System Fingerprinting Intranode Research Team. 2002.
Page 1 and 2: Ambiguity Resolution via Passive OS
Page 3 and 4: 194 G. Taleck 2.2 Traffic Normaliza
Page 5 and 6: 196 G. Taleck IDS Client Server SYN
Page 7 and 8: 198 G. Taleck Minimal FTP Client FT
Page 9 and 10: 200 G. Taleck Table 2. Encoding of
Page 11 and 12: 202 G. Taleck that failed (either t
Page 13: 204 G. Taleck The “freshness” o

LNCS 2820 - Ambiguity Resolution via Passive OS Fingerprinting

Create successful ePaper yourself

Delete template?

Save as template?