In this paper we propose a fingerprint for identifying remote operating system as a proof-of concept. Passive operating system detection is the art of detecting the operating system of other PC remotely without its knowledge

Budiarto, Rahmat

Manasrah, Ahmad

Pasha, Muhammad Fermi

Ramadass, Sureswaran

English

Repository@USM

PosFinger: A NEw FINGERPRTNT FoR pAssIVE REMOTEOPERATING SYSTEM IDE,NTIFICATIONAhmed Mansour Manasrah, Muhammad Fermi Pasha, Rahmat Budiarto, Sureswaran RamadassNational Advanced IPv6 Qt{Av6) CenterLevel 6, School of Computer Sciences Building, (Iniversity of Sains Malaysia11800 Penang, Malaysia{ahmad, fermi, rahmat, sures} @nav6. orgIn this paper we::r:":rr**, a fingerprintfor identifuing remote operating system as a proof-of-concept. Passive operating system detection is the artof detecting the operating system of other pC remotelywithout its lenowledge. In order to achieve this goal thedetection process should be fast enaugh qnd reliablewhereby the prediction possibilities should narrowdown to match the mast proper operating system.POSFinger is the sofiware that utilizes the idea ofpassive operating system fingerprinting by mappingthe active methods to be mapped passively to achievibetter performance and reliable prediction.Maintaining a secure operating system presents agreat challenge for any security or networkadministrator.Key words: passive operating system Jingerprinting,Operating system Jingerprint, Operating systemfin g erp rin t i d e n ti/i c a ti o n,l.IntroductionWhen a user takes illegal control ovsr anyinformation system, this consider as intrusion.Whether or not the action is harmftl, it is of concernbecause it might cause instability to the system or theservices provided by the system, and since today'ssystems consist of multiple nodes executing multipleoperating systems in a form of single distributedsystem, this only changes the complexity, but not thefundamental problems.In fact, intnrsion is not a problem that caa be solvedonce; continual aware is required. Complete physicalisolation of a system *om all is possible, but it may beunacceptable. Other approaches cannot be usedbecause they are in conflict with other service. It istypically that the operating system does havevulnerabilities that can be exploited. Newwlnerabilities discovered daily in each operatingsystem upgrade. Patching the system could eliminateknown wlnerabilities. And some would preventdesired functionality. Even though black hat user'sattempts to exploit security wlnerabilities in both theoperating system (OS) and the applications running ontop of it.To date, system administrators have relied onvendor patches to ensure the safety of there systemsbut these fixes are seldom available in a timely fashionand fixing one problem often creates new ones. [3].Black hat users require operating Systems informationand the patch level as first step in gaining control ofthe remote host. And thus, Understanding how toobtain remote OS information is the key to protect it.Detecting remote operating system could be the firststep in building a stronger intruder detection system orhoneyNet, recalling the fact that most of the securityholes depends on the operating system version runningon the host, then its wise enough to know how to patchor how to protect the system from illegal users sincethey could reach that point of detecting the operatingsystem and thus detecting system vulnerabilities [l].2. Related WorkMany techniques available for fingerprint networkstack, Basically, each operating system has differentbehavior then others in terms of packet content andfields values; and thus by looking for these differentbehaviors among operating systems and building adatabase for these differences will absolutely narrowdown the operating system estimations very tightly.There are only two techniques in OS fingerprinting;Active and passive techniques.110157For Active techniques, all previous work consideractive tools such as Nmap in 12,3,4,51 results incategorizing Nmap into "random scan" and "exploitsplus". NMAP is a network exploration tool andsecurity scanner that can find all open ports and detectsthe OS on hosts within an IP address range. FranckVeysset in [6] identify RING tools to one of theunique tools because it uses only one open port and astandard TCP packets instead of malformed packets toavoid machine disturbance and make it impossible tobe detected by any IDS system, and give it the stealthnature. QUESO as described in [7] is a port scannerand operating system detection tool that usually sendsout seven packets at a time. QUESO sets the SYN IFIN flags to tell the receiving computer to OPEN andCLOSE a connection once.From the other side a passive OS fingerprintingtools such as pOf [8] consider as a tool to identiff theoperating system by examining packets being passedover the local network, without sending any packets. Itcan identify the operating systom on machines thatconnect to your box (SYN mode), machines youconnect to (SYN+ACK mode), machine you cannotconnect to (RST+ mode), and machines whosecommunications you can observe. Preston Wood in [9]describe a passive IP discovery and fingerprintingutility designed to sit on segments distributedthroughout a network to discover unique IP's on thenetwork. In addition to IP discovery disco has theability to passively fingerprint TCP SYN packets andTCP SYNACK packets.Ettercap is another tooldeveloped by Alberto Ornaghi, Marco Valleri. It is asuite for man-in-the-middle attacks on LAN. It featuressniffrng of live connections, content filtering on the flyand many other interesting tricks. It supports activeand passive dissection of many protocols (evenciphered ones) and includes many features for networkand host analysis.As a result of these various tools, it is concludedthat Ring takes long time for identification comparedto NMAP. Moreover Ring tool need certain initializedparameter in order to operate; such as the target host IPaddress, an open por! the scanner machine IP addressand of course the network interface to be scanned .Nmap still in active nature which is detectable by anyfirewall that can banned it, moreover Nmap require agood conditions to perform the test such as one openedTCP port, one closed one and a closed UDP port.sprint contains advanced banner grapping functionalitywhich could be disabled by the administrator inaddition to the active nature of the tool itself. And as aresult, a POSFinger is a combination between bothactive and passive techniques to work in passive naturefor more accurate and less false positive detectionresults, in the coming section the POSFinger systemcomponent description will be endorsed.3. Passive OS FingerprintingInstead ofcrafting packets, listening and capturingpackets during normal communication is the core ofpassive OS identification. Analyzing the capturedpackets will help in determining the operating systemthat creates those packets. In contrast with active OSfingerprinting that is based on sending crafted packetsto motivate the host to reply. Two states considered forbetter results in identiffing the OS; the normalconnection request and the connection establishrequest.Figure 1: main component3.1 Normal Connection RequestDetailed information must be collected fromcaptured packets such as Window size, TTL, ToS, andDF values to minimize the possibilities of thefingerprint. To assist in constructing a proper formatto be maintained into a tree data structure format forfast matching. And since the TTL is not constantbecause it depends on the hops number it passes atemporary matching could be accepted but not toignore the accuracy of matching; this is where the HostPath Projection take place by projecting the path afterapplying the common rules whenever it comes to TTLlll158values; The rule of thumb when dealing with TTLvalues is :(mtnTTL > currentTTL < maxTTL +l\.Packet information received from www.lib.usm.mvWindow: 9ll2 I TTL:232 I ToS:0 / DF: ONTCP SYN+ACK packets, as these have the greatestnumber of unique identifiers. The fields used to makethis determination are (Initial TTL, Don't Fragmentflag, Initial SYN Packet Size, and TCP Options, suchas Window Size, MSS Size, Nop Option, WindowScaling Option and SackOK Option).4.1. Analysis of TCP Options values.This example from a SYN packet generated fromWindows 98 box ltolTable 2 TCP FiledConsidering another example of a SYN packet contentfrom OpenBSD 2.7 boxTable 3: Samole TCP Ontion Fields<mss l460,nop,nop,sackOK,nop,wscale0,nop,nop,timestamp 50473 0>The following describes the additional 16 bytes offields used in this sample. Otrers I byte of padding.The operating system supports the Window Scaleoption but it is not used. This takes up 3 bytes.<nop,nop> supplies 2 bytes of padding. <timestamp504'73 0> is the first timestamp. The TimestampValue field is set to 5M73. The Timestamp EchoReply field is set to 0 since this is the initial packet.The ti takes l0In order to achieve a better comparison betweendifferent OpenBSD X boxes another example capturedfrom OpenBSD 2.9, which produce no TCp optionvalues as follow:Table 1: hostTTL values TTL Good Match32 a -3264 33-64128 65 - 128255 129 -255Suppose a packet with TTL value of 232, bycomparing this value against the table above, we willsee that 232 is between ,29 - 255 and then thecorresponding approximate TTL value is 255 whichwill give a match for ( x86 Solaris Operating System(Solaris,x86,9ll2,255,0,l) ). The solution is not torelay on a single field value, whereas relaying onmultiple fields value is more reliable and will tonaffow down the operating system guessingpossibilities. And thus a file with known OSfingerprint matches is maintained within the system. Insummary a combination of Window, TTL, TOS, andDF will be tracked to perform matching and to narrowdown the possibility of guessing the operating system,at least one TCP packet and one Ip packet needed inorder to gather the necessary information.3.2 Connection Establish request (3-wayhandshaking)It is not necessary that all packets contain the samefields of information. Once the fields are extracted{window size f time to live f maximum segment size fdon't fragment fiaS I window scaling I sackOK JIag Iry1n flas I packet size\ rhe proper OS fingerprintingfile is loaded to perform matching against it. Basicallyboth cases are the same but differ in the number offields used and the format.4. Passive Operating System ldentification(POSFinger)Recalling that Passive Operating Systemidentification relies on the fact that each operatingsystem TCPAP stacks implementation differs slightly.This is most accurately done by analyzing TCp SyN,n2<mss 1 460,nop,nop,sackOK>4500 0030 aelT 4000 8006 f398 xxxx xxxx )ryryyyyyy 0c37 0015 0526 a98f 0000 0000 7002 trff6f06 0000 0204 0sb4 0l0l 0402Maximum Segment Size (MSS): 4 bytesWindow Scale (WSCALE): 3 bytesTimestamp (TS): l0 bytesNo Operation (NOP): I byteSelective Acknowledgment Permitted (SackOK): 2bytesSelective Acknowledgment Data: l0 bytes (plus 8lyqgs for each additional pair of sequence numbers)159Table 4: Sample Packet Format<1145: P 3066603742:3066603806(il)ack 1646168027 win 17520 [tos 0x10]>t4510 0068 7eB7 4000 4006 3862 c0a8011e c0a8 0128 0016 0479 b6c8 aSde621e 87db 5018 4470 1813 0000 e492152t 23c3 8a2b 4ee7 dbf8 0d48 88e80110 2b01 4295 39f4 52c9 a05b 31d7e3ae 1c62 2dbd d955 d604 b5d2 63d1Bfbc 4ab7 1615 b382 571c 70e0 a368a03f 425b 6211o The P, ack, and 1646168027 ne TCP flags.o The 3066603742:3066603806(64) is the bytesequence/range.r The win 17520 indicates the window size inbytes that the sender is presently ready toreceive.o The [tos 0xl0] is the TCP type of service-Another example of a SYN packet content from aRedHat Linux 7.0 system is <mss 1460, sackOK,timestamp 123265 0, nop, wscale 0>. This examplealso employs the same 4 options at the beginningwhich is used by the previous examples. Thedifference in this example is the arrangements of thefields in a dissimilar way. And thus, the operatingsystem has the ability to specify the order of the TCPoptions fields.4.2. The Proposed Fingerprints and theirMeaningsAfter reviewing some famous passive operatingsystem detection tools, POSFinger comes up with newstrategy in matching against fingerprints andidentifying operating systems by considering threedifferent states:4.2.1 SYN Fingerprint.Defining the TCP SYN Packets as the default modeof the fingerprinting operation, because SYN Packetsare rich in information which are operating systemdependant such as. Window size (WSS) -The value defineddepends on the system itself where it could befixed value, multiple of MSS or MTU (MSS +40), or random numbers.. Initial TTL - The real TTL value is determineonce a packet is received.. Maximum segment size (MSS) - This settingis used to identiff the link type of the remotehost.. Window Scaling (WSCALE) - Some systemuses this to scale WSS which is able tolengthen the TCP/P window size about 32bits.r Timestamp - In some cases the initial SYN issetto zero if the timestamp feature is used.. Selective ACK permitted - To implement thisfunction a flag is set.' NOP option - This is used as a separatorbetween different option values to indicate thesequence of these values.' EOL option * Normally the system uses NOPoption to pad at the end of the packet and theEOL option is rarely used.r13Figure 2: fingerprinting cases160able 5: SYN Fingerprint FormatWslttl I D lsslOPT,... IOS I DetaitsWS - window size.ttl - initiatrrl.D - doa't frangment bit (0 - not set, 1 -ser).SS - overall SyN packet size.OpT - option value and order specification.OS - os Name.Details - OS description.Where the OPT is a comma separ-GdlEiandToutd-take the following format,NOP - Nop optionEOL - EoL optionWX - window scaling option with value X.MX - maximum segment size option with value X.SACKOK - selective AcK oKT _ timestamp65535112811 l4SlM.,NOp,NoplwindowsPooo spa. xp spr4.2.2 SYN + ACK Fingerprint- The other way to idartify the TCp/Ip signaturefrom the packets sent out (SyN + ACK packeti). TheSYN + ACK fingerprint depends on the SyN value insome cases. If the SYN has enabled the extensionssuch as IRFCI323], IRFC2OI8] and [RFCI644], thenonly it could be revealed. In some cases the WSS valueis duplicated from the SYN packets so a different WSSvalue is used to test this kind of values. The proposedfingerprint for these packets as follow:4.2.3 General Fingerprint.Another way to identify TCPAP signature, byconsidering the normal communication and investigatethe content of interchanged packets. It is not accurateas much as the previous two techniques, the resultcould be near to prediction and more then one possibleguess could be displayed instead ofthe exact one. Eachfingerprint consists of one line, depending on thepacket type, the fingerprint format as follow.The default state is the SYN fingerprint which isthe accurate guess, then the SYN+ACK then thegeneral fingerprint which is the least accurate amongall these states.5. Result and discussionAn analysis of five different operating systems isconducted which are:5.1 Linux Box.Let's Consider the SYN packet contents of a Linux2.4 openting system to identify the OS. There are twocases for this identification:Case 1: Lilnlux 2.4 uses 5840 bytes as its initialWindow size which is different compared to LinuxTable 6: SYN+tt4TCP - TCp protocot.Len - Packet Length.ttl - initiatTTL.df - don't frangment bit (0 - not set, 1 +et).Type - Packet type (SYN,ACK,SYN+ACK)window - windowsize.TCPOP - TCp Options-if avaitabteOS - os Name.Where TCPOP is a comma separated list andcould take the following format,NOP - NoP optionEOL - EoL oprionWX - window scaling option with value X.MX - maximum segment size op$on with valueX.SACKOK - selectiveACK OKr prc o.:..s,ylJ+$CK Fingerprint FormatWslftt lDlsslOpT,...lOSlDetailsWs -windowsize.ttl - initialrrL.D - don't frangment bit (0 - not set, 1 +et).SS - overall SyN packet size.OPT - option value and order specification.OS -oS Name.Details - oS description.Where the OOO is a comma separateO tist anO coulO-take the following format,NOP - NOP optionEOL - EOL optionWX - window scaling option with value X.MX - maximum segment size option with value X.SACKOK - selective ACK OKT - timestamp655951 1?q1q4l M", N oP, w0, NoP@ows12000 SP4 32736164l0l44lM.lLinuxl2.4161kemel 2.2 that uses 32120 as its initial Window stze.Linux kernel 2.2 and2.4 uses default TTL value whichis 64.The following TCP Options are used by default byLiutx2.4 and2.2 as shown in the figure above.o Maximum Segment Size (MSS)r Selective Acknowledgment OK (sackOK)o Timestampo Window Scale, and NopAs discussed above, the TCP Option fields contributeto the total length of a packet that could assist indetermining an OS type. The total length of the packetshown in the figure above is 60 bytes' Thus, Linux iseasy to be identified as it is the only OS that containstotal header length of60 bYtes.Case 2: Putting Linux Fingerprinting Together:As a result. the characteristic listed below recognizesonly one Operating System which is Linux.o TTL:64o Windows:5840o TCP Options: Sets MSS, TimestamPs,sackO[ wscale and I noPo Packet Length: 605.2 OPENBSD BoxThe following describes on the OpenBSDcharacteristics.o TTL: 64. This value alone will not help todetect OpenBSD.o Window Size: 16384. This value is also usedby other oPerating systems.o TCP Options: Uses the same options as Linuxbut instead of setting one nop' OpenBSD uses5 nopso Total Packet Length: 64 Bytes. This is a keyindicator.As a result, a system which uses OpenBSD can beidentified by using the characteristics listed above.5.3 SOLARIS 7Solaris can be identified easily by using its initialTTL field. The figure below shows the packet contentsof a Solaris 7 operating system. The following list thecharacteristics of the Solaris 7 operating system.r TTL:255o Window Size: 8760r TCP Options: MSS. IP ID: Increments by one ALL of the time.r Total Packet Length:44 bYtesA Solaris packet can be identified by using both theTTL value which is 255 and the total packet lengthwhich is 44 bytes.5.4 ArX 4.3.The following list the characteristics of an AIX 4.3.r TTL: 64. Resembles Linux and OpenBSDo Window: 16384. Resembles Windows 2000r TCP Options: MSS. Like Solariso Packet Length: 44 bytes. Like Solaris.As a result, the AIX 4.3 operating system can beidentified by comparing with the characteristics listedabove.5.5 Window 2000The following list the characteristics of Window 2000operating system.o TTL: 128. Nearly all Windows Operatingsystems uses this TTL value.o Window: 16384 - Like AIX 4.3o TCP Options: MSS, sackOK, 2 noPsAs a result, Window 2000 packet can be identified byusing the packet length along with the TTL value toassist in giving an accurate result.The accuracy in detection summarized in the followingtabler15Time Number of Packets Accuracy0 6 50o/o20 12 51%30 18 52o/o40 24 7Oolo50 30 71o/o60 36 72o/o70 42 72%80 48 73o/o90 il 73o/o162OS dlbcto|r Accuecy+6*j. 121824+30+30Time Numboro{pack€{s AccrxacypNilDC!|r -4- 5,16. ConclusionPOSFinger is utilizing the idea of Active OperatingSystem fingerprinting by investigating the fingerprintsignature that active tools used such as NMAp, andenhancing this fingerprint signature by eliminating thenon-operating system dependant fields such as the Ipoptions field, the type of service field, and theidentification filed, by this POSFinger minimize thetime of comparison by reducing nurnber of parameterto compare against.References[] "Passive Aggressive", By Jon Lasser Jan 30 2002;http ://www. securityfocus. corr/[2] *PLUGGING LEAKY HOLES; port scanners provide aneificient means for finding soft spots on a netwoik's digitalperimeter"; June 2001;; BY GARY C. KESSLER[3] "Remote Host Detection and OS Fingerprinting,'; DebasisMohanty; Orissa, INDiA.[4lRFC 793 pp.64[5] 'New Tool And Technique For Remote OperatingSystem Fingerprinting"; Full Paper.[6] Franck Veysset, Olivier Courtay, Olivier Heen, IntranodeResearch Team; April 2002,v1.1[7] Intemet, 20M, http://www.safemode.org/sprint/[8] "The new pOf: 2.0.5", (C) Copyright 2000-2M4 byMichal Zalewski (lcamtuf@coredump.cx)[9] Intemet, 2004, http:/ lwww.altrnode.com/disco/[0] Understanding tcpdump, Operating Systenr, OpenBSD2.9, http : I /www.aei.cal-pmatulislpubitcpdump.htnll16163

Aggressive&quot;,

HOLES; port scanners provide an eificient means for finding soft spots on a netwoik's digital perimeter&quot;;

New Tool And Technique For Remote Operating System Fingerprinting&quot;;

Olivier Courtay, Olivier Heen, Intranode Research Team;

Operating Systenr, OpenBSD 2.9, http : I /www.aei.cal-pmatulislpubitcpdump.htnl l16

Remote Host Detection and OS Fingerprinting,'; Debasis Mohanty;

The new pOf: 2.0.5&quot;, (C) Copyright 2000-2M4 by Michal Zalewski (lcamtuf@coredump.cx)

POSFinger: A New Fingerprint For Passive Remote Operating System Identification.

http://eprints.usm.my/9502/1/POSFinger_A_NEW_FINGERPRINT_FOR_PASSIVE_REMOTE_OPERATING_SYSTEM_IDENTIFICATION.pdf

POSFinger: A New Fingerprint For Passive Remote Operating System Identification.

Abstract

Similar works

Full text

Available Versions

Repository@USM