Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security

Fooling NMAP for Whatever Reason 192

Posted by CmdrTaco from the well-now-isn't-that-fun dept.
taviso writes "Are you bored with your OS fingerprint? Do you dream of being able to impress your friends by convincing them your webserver is running on a sega dreamcast, or Apple LaserWriter? Well Dream no more! David Berrueta has written a paper oulining the techniques and tools available to defeat nmap's OS fingerprinting, available here [pdf]. Besides the hours of entertainment this could provide, he also lists some of the more serious reasons why you might want to consider this."
This discussion has been archived. No new comments can be posted.

Fooling NMAP for Whatever Reason More

Fooling NMAP for Whatever Reason

Comments Filter:

  • Oh what fun (Score:4, Funny)

    by snitty ( 308387 ) on Sunday March 16, 2003 @01:54PM (#5524148) Homepage
    I could just see slashdot running on a Trash - 80. .

  • First post (Score:1, Funny)

    by Anonymous Coward
    On my atari!

  • That would be very amusing... (Score:4, Interesting)

    by analog_line ( 465182 ) on Sunday March 16, 2003 @01:59PM (#5524173)
    ...to see the first time some hacker scans my network to see that every server is running off a Dreamcast. Wouldn't that be funny if that became the secure standard? Every TCP/IP fingerprint returns "Sega Dreamcast". Wouldn't be a huge security boost, but it would help slow down the process of choosing a system to try and break. And the stupid kids who think they're hackers would probably just move on.

    • Re:That would be very amusing... (Score:1, Insightful)

      by Anonymous Coward
      Not necessarily. The "stupid kids who think they're hackers" (also called script-kiddies), tend to scan large network blocks looking for hosts that are vulnerable to specific exploits. They don't care, nor do they even likely use OS fingerprinting techniques.
    • Nah, Sega Dreamcast is *way* too suspicious. Hackers would be like "WTF? How is that possible?" and then they'd explore further.

      What you'd really want to do is set the fingerprint to something like the old, unpatched Windows 95. Then the attackers will think "ROFL, dumbass admin running windoze! ATTACK!" and then your logs show some lame attack that might have worked on windows, but doesn't work on linux, and you get an early warning of any attacks that come your way :)
      • So far as I can tell, the k1dd13s don't care what you're running -- I get loads of Windows-specific attacks on my P100 Linux box. It's not even worth cracking. Heck, they probably don't even know how to get your fingerprint. Personally, I think they're spam cracking -- running the script on every IP they can find, knowing that if they ownzzor 0.01% of the machines they've gotten a return on their time investment.

  • Already common practice (Score:5, Insightful)

    by presroi ( 657709 ) <neubau@presroi.de> on Sunday March 16, 2003 @02:01PM (#5524183) Homepage
    Many servers hosting the web site of the US armed forces don't seem to be running the OS they are claiming to run. However, this *could* also be the result of some sort of load balancing.
    • Yeagh, right!

      walmart.com [netcraft.com]

    • Sometimes deliberate, sometimes not. (Score:5, Informative)

      by radon28 ( 593565 ) on Sunday March 16, 2003 @02:31PM (#5524324)
      From the Netcraft FAQ:

      Why do you report impossible operating system/server combinations ?

      Webservers that operate behind a caching system, load balancer, reverse proxy server or a firewall may sometimes report the operating system of the intermediate machine. Hence reports of 'Microsoft/IIS on Linux' may indicate that either the web server is behind a Linux server that is acting as a reverse proxy, or has configured the Akamai caching system such that the first request to the site goes to one of Akamai's servers [which run Linux], or as in the case of www.walmart.com has been configured to send a misleading signature.

    • Wal-Mart does it (Score:3, Insightful)

      by tulare ( 244053 )
      For a while now, Netcraft has reported Wal-Mart as running IIS 5.0 on Linux or Solaris :) See for yourself [netcraft.com]

  • Cool :) (Score:5, Informative)

    by rf0 ( 159958 ) <rghf@fsck.me.uk> on Sunday March 16, 2003 @02:01PM (#5524184) Homepage
    I've seriouly been looking for this for my home box. Of course its only part of the way of hiding the real OS your running. One part of eunermation is to look at the banners that network servers show. For example telneting to my home box

    [rghf@localhost rghf]$ telnet foo.wibble 22
    Trying foo.wibble...
    Connected to foo.wibble
    Escape character is '^]'.
    SSH-2.0-OpenSSH_3.4p1 Debian 1:3.4p1-1

    Shows I'm running debian (or am I? :). So changing these as well could give those l33t script kiddies some fun :)

    Rus

    • Re:Cool :) (Score:1, Redundant)

      by chrisseaton ( 573490 )
      Thanks for that mate. Didn't bother to read the article, did ya?

    • Re:Cool :) (Score:2, Funny)

      by Anonymous Coward
      I predict 2 minutes from now that someone tells you to not use insecure crappy telnet but ssh instead.
    • That could actually be cool...nmap says your server is a solaris-sparc machine, sshd is running on freeBSD, the web server is on OS X...
      • No, then they'll know something's amiss. You want to make it utterly convincing that it's a different OS so they won't bother trying to figure out what OS it really is.

        If you miss something small that can ID your OS, some who's determined might find it, but why would they bother if they think they already know?

  • Slashdotted (Score:3, Funny)

    by joyoflinux ( 522023 ) <thejoyoflinux AT yahoo DOT com> on Sunday March 16, 2003 @02:02PM (#5524185)
    Well, this proves that it doesn't matter what OS fingerprint you have, you can still get slashdotted...

    • Yes, you sure can! (Score:5, Insightful)

      by fv ( 95460 ) <fyodor@insecure.org> on Sunday March 16, 2003 @03:36PM (#5524572) Homepage
      Indeed, my site is just listed in passing, yet my web traffic suddenly tripled [insecure.org].

      As for the paper, I found it interesting and amusing enough to announce [insecure.org] to the nmap-hackers [insecure.org]. I'm all for doing this to your personal machines for entertainment and experimental value, but would almost never recommend it as a serious security hardening technique. Your time is almost always better spent working on fundamental security improvements such as applying patches, tightening firewalls, installing IDS systems, removing unnecessary services and setuid binaries, auditing system logs, etc. And sometimes this type of spoofing can actually increase security risk. Nmap expects many modern UNIX operating systems to offer nearly-unpredictable generation of TCP initial sequence numbers and the IP ID field. Crippling the generators to appear as a printer can make you vulnerable to TCP connection spoofing and a plethora of vulnerabilities related to the new Nmap Idle Scan [insecure.org] technique.

      And remember that many or most worms and script kiddies simply spew their exploit code to every listening server rather than bothering with fingerprints. All the attempted IIS exploits in my Apache log are testament to that! And if you attract a more competent attacker, you probably won't fool them for long anyway.

      -Fyodor
      Concerned about your network security? Try the free Nmap Security Scanner [insecure.org]

  • PDF MIRROR HERE (Score:5, Informative)

    by scubacuda ( 411898 ) <scubacuda@gmai[ ]om ['l.c' in gap]> on Sunday March 16, 2003 @02:02PM (#5524186)
    I googled and found a mirror PDF [infosecwriters.com] site.

    (But not before I d/led it to my local machine first!)

  • This is good (Score:5, Insightful)

    by garett_spencley ( 193892 ) on Sunday March 16, 2003 @02:03PM (#5524191) Journal
    Well I'm strongly against security through obscurity as a security infrastructure. However, as long as you have a solid, proven security infrastructure protecting your enviornment then adding a bit of obscurity over the top as an added layer can only be benefitial.

    If I know that I've done everything to protect my x86 Linux box from an attack if the attacker already knows it's an x86 Linux box, what distro it's running, has access to my network (assuming the attacker is an employee) etc. then why not make it so that script kiddies will think it's a commodore 64 and will try and exploit it as so?

    Though security through obscurity is not a good idea as the only form of protection, it can add another blanket of support and I'm all for that as long as you understand what you're doing and why.

    • Re:This is good (Score:3, Insightful)

      by Mononoke ( 88668 )
      then why not make it so that script kiddies will think it's a commodore 64 and will try and exploit it as so?
      What happens when we inadvertantly give M$ 98.2% of the 'known' server market? ^_^

      • Re:This is good (Score:2, Interesting)

        by OneEyedApe ( 610059 )
        They might compare sales to server stats, and decide that piracy is running rampant. With their kind of money, this could be a bad thing.
        • I wonder if they can consider the MS server software nmap response to be copyrighted. I mean, it COULD be construed to be a derivitive work.

          If they can, then any attempt to change it to a IIS server could be piracy (!) and you'd get slapped with a hefty fine. Which would suck.
      • "What happens when we inadvertantly give M$ 98.2% of the 'known' server market?"

        We get even more crap directed against our webservers until we get tired, and declare it to be a BSD box.

        Dammit, just give up asking my linux/apache server for "../../../../windows/" you morons!

    • Re:This is good (Score:5, Insightful)

      by mosch ( 204 ) on Sunday March 16, 2003 @02:38PM (#5524349) Homepage
      why not make it so that script kiddies will think it's a commodore 64 and will try and exploit it as so?
      because script kiddies don't bother with fingerprinting, most of the time. they just run an attack and see if it happens to work. for proof of this, look at your apache logs.
      • This is true. I run Apache, but constantly get all kinds of requests for MS Office stuff.
      • most of the time. they just run an attack and see if it happens to work.

        True. Taking a look at this months logs, the number one requested document not found was /winnt/system32/cmd.exe.
        • This is probably mostly Nimda and CodeRed worms (CodeRed has recently sprung back into life, Nimda has been steadily going for the last year or so at a rate of about one hit every 2 days in my logs).
      • What you see in your logs are people scanning blocks looking for holes on random machines, but if someone wants YOU specifically, they will check banners and run code accordingly.
        It's obviously not full proof but anything you can do as an admin to make a crackers job harder the better off you'll be.


    • The authors also agree with you. This isn't meant to be a cure-all, but rather just another layer added to the security process.

      From the PDF:

      The purpose of this paper is to try to enumerate and briefly describe all applications and technics deployed for defeating Nmap OS Fingerprint, but in any case, security by obscurity is not good approach; it can be a good security measure but please take into account that is more important to have a tight security environment (patches, firewalls, ids, ...) than hid

    • Re:This is good (maybe not) (Score:5, Insightful)

      by dan g ( 30777 ) on Sunday March 16, 2003 @02:46PM (#5524379) Homepage
      Well I'm strongly against security through obscurity as a security infrastructure. However, as long as you have a solid, proven security infrastructure protecting your enviornment then adding a bit of obscurity over the top as an added layer can only be benefitial.

      Yes, except you are implementing this security by fucking with your tcp/ip stack. In other words, you are taking the 'solid, proven security infrastructure' and stirring it up a bit. It is no longer proven to be solid so this bit of obscurity could have cost you some real security. Personally this is not a patch I'd go applying to production machines.

      dan.

    • Re:This is good (Score:3, Insightful)

      by jrumney ( 197329 )
      Given the scarcity of kiddie scripts exploiting the Commodore 64, if you really want to waste some script kiddies' time you might want to go for a Windows box with IIS as your fake fingerprint.

      While you're at it, using the same technique to bait CodeRed and Slapper worms and hold them on your server for as long as possible might slow them down a bit too (if enough people were doing it). Unfortunately the Slapper variant that is still around has a 15 second timeout, but I've heard of tarpits keeping CodeRe

  • Why emulate the IP stack when with the pattented /. effect you can make any webserver look like it actualy is an apple printer.

    11 posts and already my browser is in for the long night.

    Personaly I would have thought setting a couple of reserved bits in the header at random and change the telnet banner to "my other system is a skoda" and I suspect your will be just as well of :)
    • Because someone using TCP/IP fingerprinting is looking for interesting hosts to attack, for whatever reason.

      Something they've never seen before is interesting, and the would be hacker would likely pry a bit deeper. Giving them false information either makes them disinterested ("some idiot put up a Dreamcast on the web, how stupid") or leads them to attack in a way you are expecting, and that you know will be ineffective. Watching for these known false attacks could act as some part of an early warning al

  • Netcraft (Score:3, Insightful)

    by arvindn ( 542080 ) on Sunday March 16, 2003 @02:08PM (#5524206) Homepage Journal
    The folks at netcraft [netcraft.com] use these kinds of techniques for getting their server stats. Modifying the TCP/IP stack will screw up their stats collection :(
    • Nope. Netcraft simply returns the information given by the web server's headers, it does not actually attempt to probe the system's OS with TCP fingerprinting.
    • And your point is? Who needs to know what the server software is when what they should really be concerned about is the actual content I'm serving?
    • Netcraft has never meant much beyond what statistics they can derive from public Internet presences. And that includes the thousands and thousands of casual 'hobby' websites that skew their statistics in favor of Apache. The servers that really matter in many instances aren't exposed to the net. Netscape knew this when they tried to penetrate the corporate Intranet market with their server product line and their browser.

      People need to recognize that 'the Web' is only a part, and actually a fairly irrele

  • Netcraft confirms (Score:5, Funny)

    by RLiegh ( 247921 ) on Sunday March 16, 2003 @02:10PM (#5524211) Homepage Journal
    OS fingerprinting is dying!

    (sorry. someone had to...)

  • Been there, done that... (Score:5, Funny)

    by NetDanzr ( 619387 ) on Sunday March 16, 2003 @02:11PM (#5524218)
    Well, not me personally. But what do you think Microsoft has been doing all the years? Considering how stable their site is (and taking into account the humongous crash when they tried to move Hotmail onto WinNT), I'm convinced that they've been running the whole MSN network on Unix-based servers, disguising them as Windows ;)
    • This is actually very true. I met a Unix admin for Microsoft at a bar in Mountain View, CA and he said the entire backend for hotmail.com is running Solaris on Sun servers. Then there are load balancers running FreeBSD. The only part of the picture that is running Windoze are the front end web servers.
      In fact, M$ has a whole lab full of x86/windoze machines setup (that were going to be the hotmail.com servers until the expirement went terribly wrong). They use this decoy when journalists and such come

  • My FTP banner (Score:5, Funny)

    by Phroggy ( 441 ) <slashdot3@@@phroggy...com> on Sunday March 16, 2003 @02:11PM (#5524220) Homepage
    phroggy@panther:~$ ftp ftp.webwizardry.net
    Connected to webwizardry.net.
    220 ftp.webwizardry.net Microsoft FTP Service (Version 5.0).
    Name (ftp.webwizardry.net:phroggy):
    Of course, it's actually ProFTPd on Slackware.

  • IIS ftp (Score:5, Funny)

    by larry bagina ( 561269 ) on Sunday March 16, 2003 @02:14PM (#5524234) Journal
    The Windows IIS FTP server has an option to spew MS-DOS style output or Unix style output.

    Quoting from "Microsoft IIS 5 Administration" ) pp 52) ...

    Although there are very sophisticated hackers who will attempt to break into your FTP sites through some very sophisticated means, you shouldn't make life any easier for them.
    Using the UNIX-style output can actually fend off some hackers because they cannot see the Microsoft FTP Service header at log on and see only the UNIX-style directory listing. This could make them believe they are using a UNIX/Linux server.

    Longwinded way of saying Unix/Linux is percieved as being harder to crack. :)

    • Re:IIS ftp (Score:3, Insightful)

      by Orestesx ( 629343 )
      Imagine the reverse: If you're running a unix/Linux server, and you disguised to look like a windows server, then it would be harder to crack because the cracker would use the wrong techniques. It doesn't really matter that unix/linux is perceived as more secure.

  • Dogfood (Score:4, Interesting)

    by arvindn ( 542080 ) on Sunday March 16, 2003 @02:14PM (#5524235) Homepage Journal
    A lot of sites have to eat their own dogfood, like hotmail [netcraft.com]. Now they needn't any longer. If they can change their fingerprint, they can run linux and make it look like they're running NT. (They used to run FreeBSD earlier.)

  • IP personality.. (Score:5, Informative)

    by RatOfTheLab ( 535003 ) on Sunday March 16, 2003 @02:20PM (#5524263) Journal
    Someone thought about OS fingerprint obfuscating a while ago... http://ippersonality.sourceforge.net/ [sourceforge.net]

  • I believe IP Personality [sourceforge.net] was there first.

    (Unfortunately I can't get to the linked story at the moment to confirm this.)
    • ObReadTheArticleFirst:

      "IP Personality
      The first and probably, best option is IP Personality. It'a netfilter module (then, only available for 2.4 linux kernels) that allows us to change the IP stack behaviour and 'personality', having multiple network personalities depending on parameters that you can specify as an iptables rule. "

      etc, etc, etc..

  • Johny Cash Server (Score:4, Funny)

    by Anonymous Coward on Sunday March 16, 2003 @02:22PM (#5524272)
    Yessiirreee,

    I'm servin' mah HTTP files from this here ol' guitar and my FTP files from an empty bottle-a-booze.

    And this post, yes HTTP_REFERER was from the ol' cadillac factory I once worked at; the one where I snagged my dancin' machine car one peice at a time over twenty or some number of years-*HICUP*

    -SlashdotTroll (because slashdot don't like me, my karma is terrible, and at -1 they only let me post twice in 24hours from this ol' Folsom prison I'm stuck in.)

  • reminds me of... (Score:2, Informative)

    by jeffy124 ( 453342 )
    ... a story i heard a while back regarding script kiddies.

    some researchers set up a unix server, went into a script kiddies irc channel and said they found this wide open windows box, saying it contained credit card numbers or something like that, giving the ip of their honeypot.

    not one kiddie tried a unix sploit on the box, 100% of the attempts were exploits designed for windows.

    so for fooling nmap, if you're a security admin, set up your windows boxen with unix fingerprints and vice/versa, and you'll a
    • If you're the type of NT admin who is going to take the trouble to trick the OS fingerprint of your NT box, you're SURE AS HELL going to be consciencous enough to take reasonable steps to avoid getting k1dd13 hacked in the first place.

      You've probably already read through the NSA security guide [conxion.com], hardened the OS [systemexperts.com], DELETED [ntsecurity.nu] (not just disabled) the guest account, etc.

      In which case, most of the k1dd13 hacks won't affect you...

  • Mirror (Score:3, Redundant)

    by Phroggy ( 441 ) <slashdot3@@@phroggy...com> on Sunday March 16, 2003 @02:25PM (#5524286) Homepage
    Here [phroggy.com].

    Please mod this down so I don't get slashdotted too badly. :-X

  • Very few actual portscans (Score:4, Informative)

    by Alioth ( 221270 ) <no@spam> on Sunday March 16, 2003 @02:25PM (#5524289) Journal
    I've seen very few portscans against any of my internet connected boxes. The usual unsolicited connection attempts tend to be for well-known exploits (18 months ago, port 111 was *really* popular with several attempts a day). I'm not really sure whether it's worth the effort going out of your way to do things to change the OS fingerprint that nmap comes up with (even under good conditions, I've never found nmap's fingerprint particularly reliable or accurate anyway)

    • Re:Very few actual portscans (Score:1, Informative)

      by Anonymous Coward
      Prediction: port 139 scanning is about to become a lot more popular.

      On a related note, if you're running Samba, go get 2.2.8. Don't wait until Slashdot posts it to the main page.

      Thank me later.
    • I've seen very few portscans against any of my internet connected boxes.

      What you should be looking for is the precursor to portscans: Broadcast storms.

      We have some (12mhz) sparc IPC's, running about 16 rstatd graphs a piece, sitting on top of our book shelves at work, so that we can see the status of all our machines. A couple of times a day, we see the packet traffic spike on all machines simultaneously because of a packet storm, packets getting sent to the broadcast address, and all that.

      After those

  • Must not hide (Score:4, Informative)

    by Beliskner ( 566513 ) on Sunday March 16, 2003 @02:29PM (#5524312) Homepage
    Hiding your OS is something the corporations will not do. To maintain compliance with Micro$oft licence terms and the BSA they mnust periodically audit their systems to count the number of software installations using automated scanning software such as Centennial [centennial.co.uk]

    If their computers start lying about their OS and software installed then the BSA will invade them and stick 100 lawyers on their head before you can say "Nmap"

    • That's crap. Hopefully you know it. Nobody in their right mind would rely on OS fingerprinting software for licensing.

      If I put all my windows servers behind a firewall, suddenly I have no windows servers! So I don't need any licenses! Hooray!

      • That's crap. Hopefully you know it. Nobody in their right mind would rely on OS fingerprinting software for licensing.

        If I put all my windows servers behind a firewall, suddenly I have no windows servers! So I don't need any licenses! Hooray!

        If Hewlett Packard or something said "Uhhh we have a firewall and no Windows seats" then all it takes is ONE EMPLOYEE's sworn affidavit and he'll get a $250,000 BSA reward. Hewlett Packard's bosses will then even have their shit collected by lawyers to see if they'

  • I see no reason to NOT do this (Score:5, Insightful)

    by fudgefactor7 ( 581449 ) on Sunday March 16, 2003 @02:31PM (#5524321)
    Any level of additional security, brought about by "lying" or "fooling" is a great thing. After all, nobody needs to know your OS except you. But my opinion is that people should keep their faked responses within the realm of reason. No Sega Dreamcasts, no TI calculators, no Epson Dot Matrix LQ-2170 printers... If you lie, it must be a believable lie or it will be transparently obvious and the h4x0r will figure it out instantly. And that's not a security boon at all.

  • been done, in production (Score:4, Informative)

    by Permission Denied ( 551645 ) on Sunday March 16, 2003 @02:31PM (#5524323) Journal
    see here [sourceforge.net]. This project is a couple of years old. I was considering writing it myself when I ran across that someone else has already done it.

    Takes a completely different approach to what I was thinking - I was thinking of doing it all in userspace. Run some daemon that uses libpcap and "responds" to certain ports like a real machine. Basically means a TCP stack in userspace, so it's not a trivial undertaking but still lots of fun. I was also thinking of making it use nmap's own configuration files so you can simply specify what OS you want it to look like and it looks up the params in the config file. Only disadvantage is that you want it to pass "real" packets in to the kernel for normal processing so this is only useful in limited situations (when you can firewall a machine off completely from the Internet and only need it to serve up something within your organization). I was also considering writing something that uses FreeBSD's divert sockets since you could integrate that nicely with your firewall, but it wouldn't be as portable as the other approach (which would work wherever pcap works).

    Anyway, this has been done. The paper seems slashdotted so I can't read it.


  • People who scan my servers get their routes dropped. Why would I want to fool them for being fools and scanning my servers?

    • Keep going and soon you'll have an empty route table. Do you drop just the IP or the class C or the entire netblock?

      Unless it is an all out attack, I just report it to the netblock owner. Most of the time (almost always) the report goes ignored and unanswered.
      • Portsentry's main failing is that it waits until a packet has got into userspace before anything happens about it, and even then it only operates on an opt-in kind of way - like you've got to be looking out for scans on specific ports, or whatever.

        The alternative, and to me far more sensible, approach, is to drop all packets that aren't something you want, in a firewall, up ahead. If someone treats you to a multi-port scan, well, it appears in the logs. If someone scans you on a port on which you're listen
        • Hello Tim ;)

          I agree with what you say, but I do firewall everything, and only let in what I want. However, I do also open pinholes for portsentry to listen on.

          I either move SSH to another port, and put portsentry listening on tcp/22, or just open some commonly used service port that isn't running on my machine. (imap, pop3, ftp, telnet, snmp - you get the idea).

          I get the firewalling, plus it dumps an IPtables rule in for any idiot scripts, portscanners, kiddies. Not infalible, but it makes it a little mo

  • Religious war now! (Score:1, Flamebait)

    by 00_NOP ( 559413 )
    What is all this puffery for netBSD on the Dreamcast? Do you know they don't even use the GPL??!!!

    See the url above if you wish to purify yourself.
  • Changing the appearance of your machine might irritate people and *might* discourage them to try further closer looks at this machine.

    So: What would your facourite OS of choice to pretend be and why aren't you using it anyway?

  • How much does it gain? (Score:4, Interesting)

    by Anonymous Coward on Sunday March 16, 2003 @02:47PM (#5524381)
    I wonder how clever this deception is? It's easy enough to grab the version advertisement, but more difficult to make your system respond the same way as another OS, especially if that other OS is 'broken' in regard to TCP/IP. The question is whether you want to mimic the 'bug for bug' behaviour...

    There are some who disable ICMP response because it could help to show that a machine is active. Well, that's the canonical reason. But you can also use ICMP to (very slowly) move data, so at least in a far-fetched scenario it could be used a vector for attack.

    Say someone wants to attack your server. NMAP shows the OS as Windows NT. However, attaching to port 80 shows an Apache version string that has been released with RedHat. The casual cracker may have been deterred by the OS advertisement, but anyone else would not have. If your defense depends to a large part on version obfuscation then you don't have a defense, simply put.

    So you could grep through all the sources for version strings of all your internet exposed services, but that won't gain anything. Does version obfuscation hurt? Probably not. Neither does changing your user-agent string in the browser, except that fewer non-IE browsers will be tallied. For this reason alone I don't change my user-agent string, nor do I change my OS signatures (though I know how to).
  • i am going to make mine resemble that webserver in a house fly we saw last week

  • honeyd does this already (Score:5, Informative)

    by quigonn ( 80360 ) on Sunday March 16, 2003 @02:47PM (#5524387) Homepage
    honeyd [umich.edu] is able to do this already for quite a long time. With honeyd you can basically create "virtual hosts", running on another computer, with their own IP address, their own IP personality (it comes with a large database of them), and their own services (basically, every inetd-capable program can be used as server with it). You can even create a "virtual network" of them, with configurable routes, latency and packet loss. Indistinguishable from real computers and networks.

  • cool, but... random ips used by worms... (Score:3, Funny)

    by joejoejoejoe ( 231600 ) on Sunday March 16, 2003 @03:03PM (#5524450) Homepage Journal
    This is cool and all, but these days worms and virii select victims at random so your fingerprint won't make a damn bit of difference, except you might think you are a bit safer but you are not.

  • Hi (Score:3, Informative)

    by Pros_n_Cons ( 535669 ) on Sunday March 16, 2003 @03:05PM (#5524465)
    I read this article a few days ago and bookmarked most of the links I thought valueable. If anyone else is interested add some more to this thread so I can grab them :)

    Exported bookmarks Fingerprint
    blackhole(4) - a sysctl(8) MIB for manipulating TCP [gsp.com]
    Help Net Security OS-FngrPrint article in PDF [net-security.org]
    Honeyd - Network Rhapsody for You [umich.edu]
    http://ojnk.sourceforge.net/stuff/iplog.readme [sourceforge.net]
    http://www.insecure.org/nmap/nmap-fingerprinting-a rticle.txt [insecure.org]
    IP Personality - Home [sourceforge.net]
    Kernel Options [freebsd.org]
    p0f file listing [stearns.org]
    PhoneBoys FireWall-1 FAQs: Blocking queSO packets [phoneboy.com]
    s0ftpr0ject 2000 Fingerprint Fucker [s0ftpj.org]
    Security Technologies [innu.org]
    SourceForge.net: Project Info - SING [sourceforge.net]
    Sys-Security.com - Because Security is not Trivial [sys-security.com]
    USENIX Technical Program - Abstract - Security Symposium - 2000 [usenix.org]
  • Is a commodore64, and it feels good baby!

    Well, what other purpose would this serve other than convincing people that your server is a Com64. I sure as hell don't know a better reason

  • All very well and good. (Score:3, Insightful)

    by fw3 ( 523647 ) on Sunday March 16, 2003 @03:43PM (#5524594) Homepage Journal
    I can't get all that excited about this. Looking at an open, internet connected site, no firewalls and about 4 hosts I've recorded roughly 1 million snort detects spanning 1.5 years of on&off operation I count about 35 total external nmap scans from only 9 unique IP #s. Only a couple of those then tried to follow up with some attack traffic and one was either a very confused kiddie trying to hit a unix box with netbios-ns.

    So ractically speaking, 99.999% mundane risks (kiddies, scripts, worms) out there do minimal OS detection, and pretty much shoot attacks at random IP's. Those that do some form of detection before trying to attack certainly aren't using NMAP to scan (server version detection is far more common, and is not limited to version strings.

    For my money the time spent on stack-signature obfuscation would be far better invested in actual security measures (e.g. staying up to date on patches, implementing defense-in-depth or deploying hardened OS's.

    Sure, if you're going to put your servers behind a load ballancer, packet filter or proxy, then you may well get a measure of obfuscation for free, but if the security implementation on the screened systems is no good you're going to get rooted anyway.

  • If you use NetCraft [netcraft.com] to see what Iowa State [iastate.edu] is running, it says they are using /bin/sh as their webserver. Here [netcraft.com] are the results.

    Is this related? How do they do that? It must be a joke.

  • Please don't comfuse NetCraft with Port Scanners (Score:1, Informative)

    by Anonymous Coward
    Please stop comfusing NetCraft with port scanners.

    Nmap is a port scanner, it scans ports. Every tcp packet contains a fingerprint. That fingerprint can be analysed to give the os.

    NetCraft uses a http server scanner. It only scans port 80 for a http server and analyses its results

    That means:

    a) These are Two Completely different things
    b) It's much easier to fool NetCraft than nmap

  • Nmap's revenge (Score:5, Interesting)

    by fv ( 95460 ) <fyodor@insecure.org> on Sunday March 16, 2003 @04:21PM (#5524746) Homepage

    The systems described in the paper such as IP Personality and Honeyd (my favorite), work by watching for the exact probes as described in my fingerprinting paper [insecure.org] and then responding as detailed in the Nmap OS DB. But what about all the other TCP/IP techniques for fingerprinting a system? Later this year, I hope to add about half a dozen, including selective ACKs, TTL-normal-reply, and TTL-RST-Echo. Once these are implemented, spoofed systems will appear as a Dreamcast (or whatever) using the old techniques and will be exposed as their real OS via the new techniques. So Nmap could offer fingerprints like "Linux 2.4 pretending to be a Laserwriter". And attackers could even scan the 'Net looking for spoofed boxes -- lets hope the spoofing modules/programs don't open any security holes of their own!

    Of course, the spoofers will then update their software to recognize the new fingerprinting technique and the cycle begins anew. Ah well. I enjoyed [insecure.org] Berrueta's paper, by the way.

    -Fyodor
    Concerned about your network security? Try the free Nmap Security Scanner [insecure.org]

    • respect - you are the man!

      Thanks for all you've done for network security over the last few years - us poor mortals have to rely on proper smart guys like you for the real work.

      This is no bull - you have done as much for network security as anyone that has ever written a firewall, and more than most.

      I say again - respect! and big ups to Fyodor!!!!!

  • Some people have said that OS detection is only used for exploiting things. I don't know about other people, but I at least use it as a simple measure of intelligence. XP being lowest, other Windows next lowest, Mac and OSX somewhere in the middle, and everything else a bit higher. Of course, with everyone switching to Linux, including the less intelligent people (this is what Lindows is for), I might have to stop making these assumptions...
  • You can find a mirror of the paper here.

    www.si20.com/nmap.php [si20.com]

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close