Slashdot Mirror
Fooling NMAP for Whatever Reason
taviso writes "Are you bored with your OS fingerprint? Do you dream of being able to impress your friends by convincing them your webserver is running on a sega dreamcast, or Apple LaserWriter? Well Dream no more! David Berrueta has written a paper oulining the techniques and tools available to defeat nmap's OS fingerprinting, available here [pdf]. Besides the hours of entertainment this could provide, he also lists some of the more serious reasons why you might want to consider this."
Many servers hosting the web site of the US armed forces don't seem to be running the OS they are claiming to run. However, this *could* also be the result of some sort of load balancing.
I've seriouly been looking for this for my home box. Of course its only part of the way of hiding the real OS your running. One part of eunermation is to look at the banners that network servers show. For example telneting to my home box
:). So changing these as well could give those l33t script kiddies some fun :)
[rghf@localhost rghf]$ telnet foo.wibble 22
Trying foo.wibble...
Connected to foo.wibble
Escape character is '^]'.
SSH-2.0-OpenSSH_3.4p1 Debian 1:3.4p1-1
Shows I'm running debian (or am I?
Rus
Cheap UK and US VPS
(But not before I d/led it to my local machine first!)
Well I'm strongly against security through obscurity as a security infrastructure. However, as long as you have a solid, proven security infrastructure protecting your enviornment then adding a bit of obscurity over the top as an added layer can only be benefitial.
If I know that I've done everything to protect my x86 Linux box from an attack if the attacker already knows it's an x86 Linux box, what distro it's running, has access to my network (assuming the attacker is an employee) etc. then why not make it so that script kiddies will think it's a commodore 64 and will try and exploit it as so?
Though security through obscurity is not a good idea as the only form of protection, it can add another blanket of support and I'm all for that as long as you understand what you're doing and why.
OS fingerprinting is dying!
(sorry. someone had to...)
Well, not me personally. But what do you think Microsoft has been doing all the years? Considering how stable their site is (and taking into account the humongous crash when they tried to move Hotmail onto WinNT), I'm convinced that they've been running the whole MSN network on Unix-based servers, disguising them as Windows ;)
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
As opposed to just the sites where the stories are hosted?
In Soviet Rush, today's Tom Sawyer gets high on you.
Quoting from "Microsoft IIS 5 Administration" ) pp 52) ...
Longwinded way of saying Unix/Linux is percieved as being harder to crack. :)
Do you even lift?
These aren't the 'roids you're looking for.
Someone thought about OS fingerprint obfuscating a while ago... http://ippersonality.sourceforge.net/
Yessiirreee,
I'm servin' mah HTTP files from this here ol' guitar and my FTP files from an empty bottle-a-booze.
And this post, yes HTTP_REFERER was from the ol' cadillac factory I once worked at; the one where I snagged my dancin' machine car one peice at a time over twenty or some number of years-*HICUP*
-SlashdotTroll (because slashdot don't like me, my karma is terrible, and at -1 they only let me post twice in 24hours from this ol' Folsom prison I'm stuck in.)
Any level of additional security, brought about by "lying" or "fooling" is a great thing. After all, nobody needs to know your OS except you. But my opinion is that people should keep their faked responses within the realm of reason. No Sega Dreamcasts, no TI calculators, no Epson Dot Matrix LQ-2170 printers... If you lie, it must be a believable lie or it will be transparently obvious and the h4x0r will figure it out instantly. And that's not a security boon at all.
From the Netcraft FAQ:
Why do you report impossible operating system/server combinations ?
Webservers that operate behind a caching system, load balancer, reverse proxy server or a firewall may sometimes report the operating system of the intermediate machine. Hence reports of 'Microsoft/IIS on Linux' may indicate that either the web server is behind a Linux server that is acting as a reverse proxy, or has configured the Akamai caching system such that the first request to the site goes to one of Akamai's servers [which run Linux], or as in the case of www.walmart.com has been configured to send a misleading signature.
Well I'm strongly against security through obscurity as a security infrastructure. However, as long as you have a solid, proven security infrastructure protecting your enviornment then adding a bit of obscurity over the top as an added layer can only be benefitial.
Yes, except you are implementing this security by fucking with your tcp/ip stack. In other words, you are taking the 'solid, proven security infrastructure' and stirring it up a bit. It is no longer proven to be solid so this bit of obscurity could have cost you some real security. Personally this is not a patch I'd go applying to production machines.
dan.
I wonder how clever this deception is? It's easy enough to grab the version advertisement, but more difficult to make your system respond the same way as another OS, especially if that other OS is 'broken' in regard to TCP/IP. The question is whether you want to mimic the 'bug for bug' behaviour...
There are some who disable ICMP response because it could help to show that a machine is active. Well, that's the canonical reason. But you can also use ICMP to (very slowly) move data, so at least in a far-fetched scenario it could be used a vector for attack.
Say someone wants to attack your server. NMAP shows the OS as Windows NT. However, attaching to port 80 shows an Apache version string that has been released with RedHat. The casual cracker may have been deterred by the OS advertisement, but anyone else would not have. If your defense depends to a large part on version obfuscation then you don't have a defense, simply put.
So you could grep through all the sources for version strings of all your internet exposed services, but that won't gain anything. Does version obfuscation hurt? Probably not. Neither does changing your user-agent string in the browser, except that fewer non-IE browsers will be tallied. For this reason alone I don't change my user-agent string, nor do I change my OS signatures (though I know how to).
honeyd is able to do this already for quite a long time. With honeyd you can basically create "virtual hosts", running on another computer, with their own IP address, their own IP personality (it comes with a large database of them), and their own services (basically, every inetd-capable program can be used as server with it). You can even create a "virtual network" of them, with configurable routes, latency and packet loss. Indistinguishable from real computers and networks.
A monkey is doing the real work for me.
I was one of the instructors in the war games lab. To make things interesting for the students, I distributed nmap with a modified nmap-os-fingerprints file. Windows 2000 machines were reported as Solaris 2.6 (X86) and so forth. Some of the student responses were interesting.
I want to drag this out as long as possible. Bring me my protractor.
As for the paper, I found it interesting and amusing enough to announce to the nmap-hackers. I'm all for doing this to your personal machines for entertainment and experimental value, but would almost never recommend it as a serious security hardening technique. Your time is almost always better spent working on fundamental security improvements such as applying patches, tightening firewalls, installing IDS systems, removing unnecessary services and setuid binaries, auditing system logs, etc. And sometimes this type of spoofing can actually increase security risk. Nmap expects many modern UNIX operating systems to offer nearly-unpredictable generation of TCP initial sequence numbers and the IP ID field. Crippling the generators to appear as a printer can make you vulnerable to TCP connection spoofing and a plethora of vulnerabilities related to the new Nmap Idle Scan technique.
And remember that many or most worms and script kiddies simply spew their exploit code to every listening server rather than bothering with fingerprints. All the attempted IIS exploits in my Apache log are testament to that! And if you attract a more competent attacker, you probably won't fool them for long anyway.
-Fyodor
Concerned about your network security? Try the free Nmap Security Scanner
The systems described in the paper such as IP Personality and Honeyd (my favorite), work by watching for the exact probes as described in my fingerprinting paper and then responding as detailed in the Nmap OS DB. But what about all the other TCP/IP techniques for fingerprinting a system? Later this year, I hope to add about half a dozen, including selective ACKs, TTL-normal-reply, and TTL-RST-Echo. Once these are implemented, spoofed systems will appear as a Dreamcast (or whatever) using the old techniques and will be exposed as their real OS via the new techniques. So Nmap could offer fingerprints like "Linux 2.4 pretending to be a Laserwriter". And attackers could even scan the 'Net looking for spoofed boxes -- lets hope the spoofing modules/programs don't open any security holes of their own!
Of course, the spoofers will then update their software to recognize the new fingerprinting technique and the cycle begins anew. Ah well. I enjoyed Berrueta's paper, by the way.
-Fyodor
Concerned about your network security? Try the free Nmap Security Scanner