IpMorph : Unification of OS fingerprinting defeating or, how to defeat common OSFP tools.
|
|
|
- Cecil Ellis
- 6 years ago
- Views:
Transcription
1 IpMorph : Unification of OS fingerprinting defeating or, how to defeat common OSFP tools. Guillaume PRIGENT Florian VICHOT DIATEAM - Brest 1
2 Context Reason for creating IpMorph : Hynesim Project: We needed a way to disguise low-interaction guests (OpenVZ) as different, non-unix OSes. We already had some software components from previous projects It seemed fun (at the time) Guiding principles : Complete software, not just proof-of-concept Unification of spoofing mechanisms No network disruptions 2
3 OS fingerprinting typology Detection techniques Gathering Active Stack fingerprinting Passive Network sniffing thc-rut Xprobe2 Nmap SinFP Ring2 p0f SinFP Ettercap Banners Binaries ICMP Replies ISN Profile Headers Timeouts 3
4 OSFP Timeline 4
5 OSFP Timeline 4
6 Fingerprinting principles Active stack fingerprinting Nmap, SinFP, NETWORK A Advantages Quick, precise Drawbacks «Noisy», recognisable 5
7 Fingerprinting principles Active stack fingerprinting Nmap, SinFP, NETWORK A = A Advantages Quick, precise Drawbacks «Noisy», recognisable 5
8 Fingerprinting principles Passive stack fingerprinting NETWORK p0f, SinFP, B A Advantages stealthy Drawbacks slow, vague 6
9 Fingerprinting principles Passive stack fingerprinting NETWORK p0f, SinFP, B B = A = A Advantages stealthy Drawbacks slow, vague 6
10 IpMorph use-cases SYN SYN+ACK A B Passive OSFP + Virtual Machines SYN SYN+ACK Active OSFP + Virtual Machines A B 7
11 IpMorph use-cases SYN SYN+ACK A = B = A B Passive OSFP + Virtual Machines SYN SYN+ACK Active OSFP + Virtual Machines A B 7
12 IpMorph use-cases SYN SYN+ACK A = B = A B Passive OSFP + Virtual Machines SYN SYN+ACK Active OSFP + Virtual Machines A = B = A B 7
13 Spoofing state of the art Filtering Stealth patch : Unmaintained as of 2002, GNU/Linux kernel Blackhole : FreeBSD, kernel options IPlog : Unmaintained as of 2001, *BSD Packet filter : OpenBSD Host /IP stack tweaking Ip Personality Fingerprint Fucker Fingerprint scrubber OSfuscate Host /IP stack replacement (proxy behaviour) Honeyd Packet purgatory / Morph 8
14 Software bricks Coded in C++ Userland application Tools: IpMorph (Core) IpMorph Controller IpMorph Personality Manager IpView (IpMorph GUI) Portability : GNU/Linux *BSD, Mac OS GPLv3 License 9
15 General architecture Exposed IP stack Context queue Protected IP stack Filter & Processor context tracker & data Scheduler Filter & Processor Filter context tracker & data Filter ICMP ICMP Filter ICMP context tracker & data ICMP Filter ICMP IP Frag. & Reass. IP Filter IP context tracker & data Frag. & Reass. IP Filter IP ETH (R)ARP Eth. Read Eth. Write (R)ARP translation processor Eth. Write (R)ARP Eth. Read ETH Interface layer Interface layer eth tap fd eth tap fd 10
16 General architecture Exposed IP stack Context queue Protected IP stack Filter & Processor context tracker & data Scheduler Filter & Processor Filter context tracker & data Filter ICMP ICMP Filter ICMP context tracker & data ICMP Filter ICMP IP Frag. & Reass. IP Filter IP context tracker & data Frag. & Reass. IP Filter IP ETH (R)ARP Eth. Read Eth. Write (R)ARP translation processor Eth. Write (R)ARP Eth. Read ETH Interface layer Interface layer eth tap fd eth tap fd 10
17 General architecture Exposed IP stack Context queue Protected IP stack Filter & Processor context tracker & data Scheduler Filter & Processor Filter context tracker & data Filter ICMP ICMP Filter ICMP context tracker & data ICMP Filter ICMP IP Frag. & Reass. IP Filter IP context tracker & data Frag. & Reass. IP Filter IP ETH (R)ARP Eth. Read Eth. Write (R)ARP translation processor Eth. Write (R)ARP Eth. Read ETH Interface layer Interface layer eth tap fd eth tap fd 10
18 General architecture Exposed IP stack Context queue Protected IP stack Filter & Processor context tracker & data Scheduler Filter & Processor Filter context tracker & data Filter ICMP ICMP Filter ICMP context tracker & data ICMP Filter ICMP IP Frag. & Reass. IP Filter IP context tracker & data Frag. & Reass. IP Filter IP ETH (R)ARP Eth. Read Eth. Write (R)ARP translation processor Eth. Write (R)ARP Eth. Read ETH Interface layer Interface layer eth tap fd eth tap fd 10
19 General architecture Exposed IP stack Context queue Protected IP stack Filter & Processor context tracker & data Scheduler Filter & Processor Filter context tracker & data Filter ICMP ICMP Filter ICMP context tracker & data ICMP Filter ICMP IP Frag. & Reass. IP Filter IP context tracker & data Frag. & Reass. IP Filter IP ETH (R)ARP Eth. Read Eth. Write (R)ARP translation processor Eth. Write (R)ARP Eth. Read ETH Interface layer Interface layer eth tap fd eth tap fd 10
20 General architecture Exposed IP stack Context queue Protected IP stack Filter & Processor context tracker & data Scheduler Filter & Processor Filter context tracker & data Filter ICMP ICMP Filter ICMP context tracker & data ICMP Filter ICMP IP Frag. & Reass. IP Filter IP context tracker & data Frag. & Reass. IP Filter IP ETH (R)ARP Eth. Read Eth. Write (R)ARP translation processor Eth. Write (R)ARP Eth. Read ETH Interface layer Interface layer eth tap fd eth tap fd 10
21 Nmap : Signature Format SP : ISN Predictability GCD : ISN Greatest Common Divisor ISR : ISN counter Rate TI : IP ID sequence generation algorithm II : ICMP IP ID sequence generation algorithm SS : Shared IP ID sequence Boolean TS : timestamp option algorithm O1-06: Options (ordering & values) DF: IP donʼt fragment bit T: IP initial timeto-live TG: IP initial time-to-live guess Fingerprint FreeBSD 7.0-CURRENT Class FreeBSD FreeBSD 7.X general purpose SEQ(SP=101-10D%GCD=<7%ISR= %TI=RD%II=RI%TS= ) OPS(O1=M5B4NW8NNT11%O2=M578NW8NNT11%O3=M280NW8NNT11%O4=M5B4NW8NNT11%O5=M218NW8NNT11%O6=M109NNT11) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF) ECN(R=Y%DF=Y%T=40%TG=40%W=FFFF%O=M5B4NW8%CC=N%Q=) T1(R=Y%DF=Y%T=40%TG=40%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=Y%DF=Y%T=40%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW8NNT11%RD=0%Q=) T4(R=Y%DF=Y%T=40%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=) T5(R=Y%DF=Y%T=40%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) T6(R=Y%DF=Y%T=40%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=) T7(R=Y%DF=Y%T=40%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=) U1(DF=N%T=40%TG=40%TOS=0%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G) IE(DFI=S%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S) W1-W6 : initial win size W: initial win size S: seq. number A: ack. number F: Flags RD: RST data checksum Q: misc. quirks RIPCK: Returned probe IP checksum value RUCK: Returned probe checksum TOS: IP type of service IPL: IP total length UN: Unused port unreach. field nonzero RIPL: Returned probe IP total length value RID: Returned probe IP ID value RUL: Returned probe length 11
22 Nmap : Spoofing test RD SP : ISN Predictability GCD : ISN Greatest Common Divisor ISR : ISN counter Rate TI : IP ID sequence generation algorithm II : ICMP IP ID sequence generation algorithm RD: RST data checksum NETWORK SYN+RST packet on closed port Headers... Flags: RST... Data: «Port closed etc...» CRC32(«Port closed etc...») = 0x0af1a1cb Reverse_CRC32(0x0af1a1cb) = 0x201111b8 12
23 Nmap : Spoofing test RD SP : ISN Predictability GCD : ISN Greatest Common Divisor ISR : ISN counter Rate TI : IP ID sequence generation algorithm II : ICMP IP ID sequence generation algorithm RD: RST data checksum NETWORK SYN+RST packet on closed port Port closed Headers... Flags: RST... Data: «Port closed etc...» CRC32(«Port closed etc...») = 0x0af1a1cb Reverse_CRC32(0x0af1a1cb) = 0x201111b8 12
24 Nmap : Spoofing tests TI / II SP : ISN Predictability GCD : ISN Greatest Common Divisor ISR : ISN counter Rate RD: RST data checksum TI : IP ID sequence generation algorithm II : ICMP IP ID sequence generation algorithm Typical IP packet IP Headers:... IP ID... Data Possible algorithms: Always zero Constant Constant increment... We keep 2 counters: _lastipidtcp _lastipidother 13
25 Nmap : Spoofing tests SP / GCD / ISR RD: RST data checksum TI : IP ID sequence generation algorithm II : ICMP IP ID sequence generation algorithm SP : ISN Predictability GCD : ISN Greatest Common Divisor ISR : ISN counter Rate Typical Header IP Headers Sequence number Nmaps send 6 probes, at a 550ms interval. Get all 6 ISNs : Compute differences : Compute mean, stddev and GCD : Seq 1 Seq 2 Seq 3 Seq 4 Seq 5 Seq 6 1 }} ISR SP GCD 14
26 Nmap : Spoofing tests SP / GCD / ISR RD: RST data checksum TI : IP ID sequence generation algorithm II : ICMP IP ID sequence generation algorithm SP : ISN Predictability GCD : ISN Greatest Common Divisor ISR : ISN counter Rate SP What we have What we want Box-Muller points ISN candidates GCD compatible values Mean from ISR 15
27 Nmap : Spoofing tests SP / GCD / ISR RD: RST data checksum TI : IP ID sequence generation algorithm II : ICMP IP ID sequence generation algorithm SP : ISN Predictability GCD : ISN Greatest Common Divisor ISR : ISN counter Rate SP What we have What we want Box-Muller points ISN candidates GCD compatible values Mean from ISR 15
28 SinFP : How is the spoofing done? Binary : heuristic0, heuristic1, heuristic2 { Constants: TTL, ID, DF seq and ack TcpFlags : heuristic0, heuristic1, heuristic2 Offset Source port Destination Port 32 Sequence number TcpWindow : heuristic0, heuristic1, heuristic2 64 Acknowledgment number 96 Data Offset Reserved Flags Window Size 128 Checksum Urgent Pointer TcpMss : heuristic0, heuristic1, heuristic Options... TcpOptions : heuristic0, heuristic1, heuristic2 16
29 p0f : Signature format Window Size Initial TTL IP Donʼt Fragment Bit SYN Packet Size 8192:128:1:52:M*,W8,N,N,N,S:.:Windows:Vista (beta) Options Quirks OS System Class OS Name Version (2006) 6 parameters analyzed Only on SYN packets (default DB = p0f.fp) Actually can analyze other type of packets, but very few signatures available (experimental) 17
30 Ring2 - congestion timeouts spoofing 18
31 Future June 2009 SSTIC 2009 First demo «Beta release» 0.1 (available on website) End 2009 Beginning 2010 Refactoring (leaner, faster, easier to use) PersonalityManager, various tools... Version 0.2 will be available on website too Documentation... Possibly, integrate application-level scrubbers (DNS, SMB, DHCP, )? 19
32 Personality Manager 20
33 Personality Manager 20
34 Demo tap Nmap, Xprobe2, SinFP, P0f LAN eth Linux Ubuntu 8.04 Demoʼs scenario Configuration Active Fingerprinting Passive Fingerprinting 1 - Interface tap0 2 - VirtualBox 3- IpMorph 4 - Xprobe2 5 - Nmap 6 - SinFp as active 7 - SinFp as passive 8 - p0f 21
35 Demo XProbe2 22
36 Demo XProbe2 22
37 Demo Nmap 23
38 Demo Nmap 23
39 Demo SinFP active 24
40 Demo SinFP active 24
41 Demo SinFP passive 25
42 Demo SinFP passive 25
43 Demo p0f 26
44 Thank you for listening! Questions? 27
IpMorph : «vers la mystification de la prise d'empreinte de pile»
IpMorph is an Open Source project owned, developed and supported by DIATEAM This document is licensed under a Creative Commons Attribution 3.0 License IpMorph : «vers la mystification de la prise d'empreinte
SinFP3. More Than a Complete Framework for Operating System Fingerprinting v1.0. Patrice
SinFP3 More Than a Complete Framework for Operating System Fingerprinting v1.0 Patrice Auffret @PatriceAuffret @networecon `whoami` Patrice Auffret 10+ years of InfoSec experience www.gomor.org
CIT 480: Securing Computer Systems
CIT 480: Securing Computer Systems Scanning CIT 480: Securing Computer Systems Slide #1 Topics 1. Port Scanning 2. Stealth Scanning 3. Version Identification 4. OS Fingerprinting CIT 480: Securing Computer
Building an IPS solution for inline usage during Red Teaming
Building an IPS solution for inline usage during Red Teaming Repurposing defensive technologies for offensive Red Team operations K. Mladenov A. Zismer {kmladenov,azismer}@os3.nl Master Students in System
inside: THE MAGAZINE OF USENIX & SAGE April 2002 Volume 27 Number 2 SECURITY A Remote Active OS Fingerprinting Tool Using ICMP BY OFIR ARKIN
THE MAGAZINE OF USENIX & SAGE April 2002 Volume 27 Number 2 inside: SECURITY A Remote Active OS Fingerprinting Tool Using ICMP BY OFIR ARKIN & The Advanced Computing Systems Association & The System Administrators
Module 19 : Threats in Network What makes a Network Vulnerable?
Module 19 : Threats in Network What makes a Network Vulnerable? Sharing Unknown path Many points of attack What makes a network vulnerable? Unknown perimeter Anonymity Complexity of system Categories of
Internet Layers. Physical Layer. Application. Application. Transport. Transport. Network. Network. Network. Network. Link. Link. Link.
Internet Layers Application Application Transport Transport Network Network Network Network Link Link Link Link Ethernet Fiber Optics Physical Layer Wi-Fi ARP requests and responses IP: 192.168.1.1 MAC:
TCP TCP/IP: TCP. TCP segment. TCP segment. TCP encapsulation. TCP encapsulation 1/25/2012. Network Security Lecture 6
TCP TCP/IP: TCP Network Security Lecture 6 Based on IP Provides connection-oriented, reliable stream delivery service (handles loss, duplication, transmission errors, reordering) Provides port abstraction
ELEC5616 COMPUTER & NETWORK SECURITY
ELEC5616 COMPUTER & NETWORK SECURITY Lecture 17: Network Protocols I IP The Internet Protocol (IP) is a stateless protocol that is used to send packets from one machine to another using 32- bit addresses
Faulds: A Non-Parametric Iterative Classifier for Internet-Wide OS Fingerprinting
Faulds: A Non-Parametric Iterative Classifier for Internet-Wide OS Fingerprinting Zain Shamsi,, Daren B.H. Cline, and Dmitri Loguinov Internet Research Lab Department of Computer Science and Engineering
Packet Header Formats
A P P E N D I X C Packet Header Formats S nort rules use the protocol type field to distinguish among different protocols. Different header parts in packets are used to determine the type of protocol used
INF5290 Ethical Hacking. Lecture 3: Network reconnaissance, port scanning. Universitetet i Oslo Laszlo Erdödi
INF5290 Ethical Hacking Lecture 3: Network reconnaissance, port scanning Universitetet i Oslo Laszlo Erdödi Lecture Overview Identifying hosts in a network Identifying services on a host What are the typical
Michael Rash DEFCON 12 07/31/2004
Advanced Netfilter: Content Replacement (ala Snort_inline) and Combining Port Knocking with p0f Michael Rash DEFCON 12 07/31/2004 http://www.enterasys.com http://www.cipherdyne.org Introduction Port knocking
K2289: Using advanced tcpdump filters
K2289: Using advanced tcpdump filters Non-Diagnostic Original Publication Date: May 17, 2007 Update Date: Sep 21, 2017 Topic Introduction Filtering for packets using specific TCP flags headers Filtering
Covert channels in TCP/IP: attack and defence
Covert channels in TCP/IP: attack and defence The creation and detection of TCP/IP steganography for covert channels and device fingerprinting Steven J. Murdoch and Stephen Lewis http://www.cl.cam.ac.uk/users/{sjm217,
Network Security: Scan
Network Security: Scan Seungwon Shin, KAIST some slides from Dr. Brett Tjaden More about Scan Scan Techniques Network scanning where is a target? which service is available on a target? can I have more
CSCI-GA Operating Systems. Networking. Hubertus Franke
CSCI-GA.2250-001 Operating Systems Networking Hubertus Franke frankeh@cs.nyu.edu Source: Ganesh Sittampalam NYU TCP/IP protocol family IP : Internet Protocol UDP : User Datagram Protocol RTP, traceroute
EE 610 Part 2: Encapsulation and network utilities
EE 610 Part 2: Encapsulation and network utilities Objective: After this experiment, the students should be able to: i. Understand the format of standard frames and packet headers. Overview: The Open Systems
Layer 4: UDP, TCP, and others. based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers
Layer 4: UDP, TCP, and others based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers Concepts application set transport set High-level, "Application Set" protocols deal only with how handled
CSE/EE 461 Lecture 13 Connections and Fragmentation. TCP Connection Management
CSE/EE 461 Lecture 13 Connections and Fragmentation Tom Anderson tom@cs.washington.edu Peterson, Chapter 5.2 TCP Connection Management Setup assymetric 3-way handshake Transfer sliding window; data and
CS 356: Computer Network Architectures. Lecture 10: IP Fragmentation, ARP, and ICMP. Xiaowei Yang
CS 356: Computer Network Architectures Lecture 10: IP Fragmentation, ARP, and ICMP Xiaowei Yang xwy@cs.duke.edu Overview Homework 2-dimension parity IP fragmentation ARP ICMP Fragmentation and Reassembly
ECE4110 Internetwork Programming. Introduction and Overview
ECE4110 Internetwork Programming Introduction and Overview 1 EXAMPLE GENERAL NETWORK ALGORITHM Listen to wire Are signals detected Detect a preamble Yes Read Destination Address No data carrying or noise?
CSC 574 Computer and Network Security. TCP/IP Security
CSC 574 Computer and Network Security TCP/IP Security Alexandros Kapravelos kapravelos@ncsu.edu (Derived from slides by Will Enck and Micah Sherr) Network Stack, yet again Application Transport Network
Muhammad Farooq-i-Azam CHASE-2006 Lahore
Muhammad Farooq-i-Azam CHASE-2006 Lahore Overview Theory Existing Sniffers in action Switched Environment ARP Protocol and Exploitation Develop it yourself 2 Network Traffic Computers and network devices
A quick theorical introduction to network scanning. 23rd November 2005
A quick theorical introduction to network ASBL CSRRT-LU (Computer Security Research and Response Team Luxembourg) http://www.csrrt.org/ 23rd November 2005 IP protocol ACK Network is not exact science When
Scanning. Course Learning Outcomes for Unit III. Reading Assignment. Unit Lesson UNIT III STUDY GUIDE
UNIT III STUDY GUIDE Course Learning Outcomes for Unit III Upon completion of this unit, students should be able to: 1. Recall the terms port scanning, network scanning, and vulnerability scanning. 2.
Dan Boneh, John Mitchell, Dawn Song. Denial of Service
Dan Boneh, John Mitchell, Dawn Song Denial of Service What is network DoS? Goal: take out a large site with little computing work How: Amplification Small number of packets big effect Two types of amplification
D4.4 Device fingerprinting
SEVENTH FRAMEWORK PROGRAMME Theme SEC-2011.2.5-1 (Cyber attacks against critical infrastructures) D4.4 Device fingerprinting Contract No. FP7-SEC-285477-CRISALIS Workpackage WP 4 - System Discovery Author
8/19/2010. Computer Forensics Network forensics. Data sources. Monitoring
Computer Forensics Network forensics Thomas Mundt thm@informatik.uni-rostock.de Data sources Assessment Monitoring Monitoring Software Logs and Log Analysis Incident Analysis External Assessment Hackers
FOCUS on Intrusion Detection: Intrusion Detection Level Analysis of Nmap and Queso Page 1 of 6
FOCUS on Intrusion Detection: Intrusion Detection Level Analysis of Nmap and Queso Page 1 of 6 Intrusion Detection Level Analysis of Nmap and Queso by Toby Miller last updated Wednesday, August 30, 2000
History Page. Barracuda NextGen Firewall F
The Firewall > History page is very useful for troubleshooting. It provides information for all traffic that has passed through the Barracuda NG Firewall. It also provides messages that state why traffic
A practical approach for defeating Nmap OS-Fingerprinting
A practical approach for defeating Nmap OS-Fingerprinting David Barroso Berrueta http://voodoo.somoslopeor.com tomac@somoslopeor.com Remote OS Fingerprinting is becoming more and more important, not only
ARP, IP, TCP, UDP. CS 166: Introduction to Computer Systems Security 4/7/18 ARP, IP, TCP, UDP 1
ARP, IP, TCP, UDP CS 166: Introduction to Computer Systems Security 4/7/18 ARP, IP, TCP, UDP 1 IP and MAC Addresses Devices on a local area network have IP addresses (network layer) MAC addresses (data
Using Neural Networks for remote OS Identification
Using Neural Networks for remote OS Identification Javier Burroni - Carlos Sarraute Core Security Technologies PacSec/core05 conference OUTLINE 1. Introduction 2. DCE-RPC Endpoint mapper 3. OS Detection
UDP and TCP. Introduction. So far we have studied some data link layer protocols such as PPP which are responsible for getting data
ELEX 4550 : Wide Area Networks 2015 Winter Session UDP and TCP is lecture describes the two most common transport-layer protocols used by IP networks: the User Datagram Protocol (UDP) and the Transmission
Transport Over IP. CSCI 690 Michael Hutt New York Institute of Technology
Transport Over IP CSCI 690 Michael Hutt New York Institute of Technology Transport Over IP What is a transport protocol? Choosing to use a transport protocol Ports and Addresses Datagrams UDP What is a
Interconnecting Networks with TCP/IP
Chapter 8 Interconnecting s with TCP/IP 1999, Cisco Systems, Inc. 8-1 Introduction to TCP/IP Internet TCP/IP Early protocol suite Universal 1999, Cisco Systems, Inc. www.cisco.com ICND 8-2 TCP/IP Protocol
Improving TCP/IP Security Through Randomization Without Sacrificing Interoperability. Michael J. Silbersack. November 26th, 2005
Improving TCP/IP Security Through Randomization Without Sacrificing Interoperability Michael J. Silbersack November 26th, 2005 http://www.silby.com/eurobsdcon05/ What does that title mean? TCP was not
Transport: How Applications Communicate
Transport: How Applications Communicate Week 2 Philip Levis 1 7 Layers (or 4) 7. 6. 5. 4. 3. 2. 1. Application Presentation Session Transport Network Link Physical segments packets frames bits/bytes Application
I TCP 1/2. Internet TA: Connection-oriented (virtual circuit) Connectionless (datagram) (flow control) (congestion control) TCP Connection-oriented
I TCP 1/2 TA: Connection-oriented (virtual circuit) Connectionless (datagram) (flow control) (congestion control) Internet TCP Connection-oriented UDP Connectionless IP + TCP (connection-oriented) (byte
New Tool And Technique For Remote Operating System Fingerprinting Full Paper
New Tool And Technique For Remote Operating System Fingerprinting Full Paper Franck Veysset, Olivier Courtay, Olivier Heen, Intranode Research Team April 2002, v1.1 Abstract Information gathering is an
Lecture 6. Internet Security: How the Internet works and some basic vulnerabilities. Thursday 19/11/2015
Lecture 6 Internet Security: How the Internet works and some basic vulnerabilities Thursday 19/11/2015 Agenda Internet Infrastructure: Review Basic Security Problems Security Issues in Routing Internet
Layered Networking and Port Scanning
Layered Networking and Port Scanning David Malone 22nd June 2004 1 IP Header IP a way to phrase information so it gets from one computer to another. IPv4 Header: Version Head Len ToS Total Length 4 bit
Introduction to TCP/IP networking
Introduction to TCP/IP networking TCP/IP protocol family IP : Internet Protocol UDP : User Datagram Protocol RTP, traceroute TCP : Transmission Control Protocol HTTP, FTP, ssh What is an internet? A set
AN TOÀN LỚP 4: TCP/IP ATTACKS NGUYEN HONG SON PTITHCM
1 AN TOÀN LỚP 4: TCP/IP ATTACKS NGUYEN HONG SON PTITHCM 2 Introduction (1/2) TCP provides a full duplex reliable stream connection between two end points A connection is uniquely defined by the quadruple
6. The Transport Layer and protocols
6. The Transport Layer and protocols 1 Dr.Z.Sun Outline Transport layer services Transmission Control Protocol Connection set-up and tear-down Ports and Well-know-ports Flow control and Congestion control
A Robust Classifier for Passive TCP/IP Fingerprinting
A Robust Classifier for Passive TCP/IP Fingerprinting Rob Beverly MIT CSAIL rbeverly@csail.mit.edu April 20, 2004 PAM 2004 Typeset by FoilTEX Outline A Robust Classifier for Passive TCP/IP Fingerprinting
Introduction to Internet. Ass. Prof. J.Y. Tigli University of Nice Sophia Antipolis
Introduction to Internet Ass. Prof. J.Y. Tigli University of Nice Sophia Antipolis What about inter-networks communications? Between LANs? Ethernet?? Ethernet Example Similarities and Differences between
Robust Firewalls with OpenBSD and PF
Robust Firewalls with OpenBSD and PF Overview Design Philosophy (and what PF doesn t do) The Basics Normalisation Filtering Translation Advanced Toolkits Denial of Service Mitigation Firewall Redundancy
Table of Contents. 1 Intrusion Detection Statistics 1-1 Overview 1-1 Displaying Intrusion Detection Statistics 1-1
Table of Contents 1 Intrusion Detection Statistics 1-1 Overview 1-1 Displaying Intrusion Detection Statistics 1-1 i 1 Intrusion Detection Statistics Overview Intrusion detection is an important network
Dongsoo S. Kim Electrical and Computer Engineering Indiana U. Purdue U. Indianapolis
Session 8. TCP/IP Dongsoo S. Kim (dskim@iupui.edu) Electrical and Computer Engineering Indiana U. Purdue U. Indianapolis IP Packet 0 4 8 16 19 31 Version IHL Type of Service Total Length Identification
ICS 451: Today's plan
ICS 451: Today's plan ICMP ping traceroute ARP DHCP summary of IP processing ICMP Internet Control Message Protocol, 2 functions: error reporting (never sent in response to ICMP error packets) network
Introduction to Networking. Operating Systems In Depth XXVII 1 Copyright 2017 Thomas W. Doeppner. All rights reserved.
Introduction to Networking Operating Systems In Depth XXVII 1 Copyright 2017 Thomas W. Doeppner. All rights reserved. Distributed File Systems Operating Systems In Depth XXVII 2 Copyright 2017 Thomas W.
Interconnecting Networks with TCP/IP. 2000, Cisco Systems, Inc. 8-1
Interconnecting Networks with TCP/IP 2000, Cisco Systems, Inc. 8-1 Objectives Upon completion of this chapter you will be able to perform the following tasks: Identify the IP protocol stack, its protocol
ELEC / COMP 177 Fall Some slides from Kurose and Ross, Computer Networking, 5 th Edition
ELEC / COMP 177 Fall 2011 Some slides from Kurose and Ross, Computer Networking, 5 th Edition One of the core protocols in the Internet Primarily used to communicate errors among routers and hosts IP datagram
Hands-On Ethical Hacking and Network Defense Chapter 5 Port Scanning
Hands-On Ethical Hacking and Network Defense Chapter 5 Port Scanning Last revised 10-4-17 KonBoot Get into any account without the password Works on Windows and Linux No longer free Link Ch 5r From the
Hands-On Ethical Hacking and Network Defense Chapter 5 Port Scanning
Hands-On Ethical Hacking and Network Defense Chapter 5 Port Scanning Last revised 1-11-17 KonBoot Get into any account without the password Works on Windows and Linux No longer free Link Ch 5r From the
Dan Lo Department of Computer Science and Software Engineering Southern Polytechnic State University
Dan Lo Department of Computer Science and Software Engineering Southern Polytechnic State University Why ICMP? UDP and TDP are not designed to report errors Provide a simple way to report errors between
TCP/IP Protocol Suite
TCP/IP Protocol Suite Computer Networks Lecture 5 http://goo.gl/pze5o8 TCP/IP Network protocols used in the Internet also used in today's intranets TCP layer 4 protocol Together with UDP IP - layer 3 protocol
IP - The Internet Protocol. Based on the slides of Dr. Jorg Liebeherr, University of Virginia
IP - The Internet Protocol Based on the slides of Dr. Jorg Liebeherr, University of Virginia Orientation IP (Internet Protocol) is a Network Layer Protocol. IP: The waist of the hourglass IP is the waist
Communication Systems DHCP
Communication Systems DHCP Computer Science Copyright Warning This lecture is already stolen If you copy it please ask the author Prof. Dr. Gerhard Schneider like I did 2 Internet Protocol the Universal
Just enough TCP/IP. Protocol Overview. Connection Types in TCP/IP. Control Mechanisms. Borrowed from my ITS475/575 class the ITL
Just enough TCP/IP Borrowed from my ITS475/575 class the ITL 1 Protocol Overview E-Mail HTTP (WWW) Remote Login File Transfer TCP UDP RTP RTCP SCTP IP ICMP ARP RARP (Auxiliary Services) Ethernet, X.25,
Connections. Topics. Focus. Presentation Session. Application. Data Link. Transport. Physical. Network
Connections Focus How do we connect processes? This is the transport layer Topics Naming processes Connection setup / teardown Flow control Application Presentation Session Transport Network Data Link
TCP/IP Networking. Part 4: Network and Transport Layer Protocols
TCP/IP Networking Part 4: Network and Transport Layer Protocols Orientation Application Application protocol Application TCP TCP protocol TCP IP IP protocol IP IP protocol IP IP protocol IP Network Access
! ' ,-. +) +))+, /+*, 2 01/)*,, 01/)*, + 01/+*, ) 054 +) +++++))+, ) 05,-. /,*+), 01/-*+) + 01/.*+)
! "#! # $ %& #! '!!!( &!)'*+' '(,-. +) /,*+), 01/-*+) + 01/.*+) ) 05,-. +))+, /+*, 2 01/)*,, 01/)*, + 01/+*, ) 054 +) +++++))+,3 4 +. 6*! ) ) ) ) 5 ) ) ) ) + 5 + + ) ) ) 5 9 + ) ) + 5 4 ) ) + ) 5, ) )
Transport Protocols. Raj Jain. Washington University in St. Louis
Transport Protocols Raj Jain Washington University Saint Louis, MO 63131 Jain@cse.wustl.edu These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 16-1 Overview q TCP q Key features
User Datagram Protocol
Topics Transport Layer TCP s three-way handshake TCP s connection termination sequence TCP s TIME_WAIT state TCP and UDP buffering by the socket layer 2 Introduction UDP is a simple, unreliable datagram
Network Security. Kitisak Jirawannakool Electronics Government Agency (public organisation)
1 Network Security Kitisak Jirawannakool Electronics Government Agency (public organisation) A Brief History of the World 2 OSI Model vs TCP/IP suite 3 TFTP & SMTP 4 ICMP 5 NAT/PAT 6 ARP/RARP 7 DHCP 8
The Transport Layer: TCP & Reliable Data Transfer
The Transport Layer: TCP & Reliable Data Transfer Smith College, CSC 249 February 15, 2018 1 Chapter 3: Transport Layer q TCP Transport layer services: v Multiplexing/demultiplexing v Connection management
What this talk is about?
On the Current State of Remote Active OS Fingerprinting Tools Ofir Arkin CTO ofir.arkin@insightix.com Defcon 13 1 What this talk is about? This talk examines different aspects of remote active operating
network security s642 computer security adam everspaugh
network security s642 adam everspaugh ace@cs.wisc.edu computer security today Announcement: HW3 to be released WiFi IP, TCP DoS, DDoS, prevention 802.11 (wifi) STA = station AP = access point BSS = basic
Information Network 1 TCP 1/2
Functions provided by the transport layer Information Network 1 TCP 1/2 Youki Kadobayashi NAIST! Communication between processes " designation of process " identification of inter-process channel! Interface
TSIN02 - Internetworking
Lecture 4: Outline Literature: Lecture 4: Transport Layer Forouzan: ch 11-12 RFC? Transport layer introduction UDP TCP 2004 Image Coding Group, Linköpings Universitet 2 The Transport Layer Transport layer
TSIN02 - Internetworking
Lecture 4: Transport Layer Literature: Forouzan: ch 11-12 2004 Image Coding Group, Linköpings Universitet Lecture 4: Outline Transport layer responsibilities UDP TCP 2 Transport layer in OSI model Figure
NAVAL POSTGRADUATE SCHOOL THESIS
NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS IPV6 HOST FINGERPRINT by Eleftherios Nerakis September 2006 Thesis Advisor: Co-Advisor Second Reader: Geoffrey Xie John Gibson Chris Eagle Approved
Configuring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
Network Layer (4): ICMP
1 Network Layer (4): ICMP Required reading: Kurose 4.4.3, 4.4.4 CSE 4213, Fall 2006 Instructor: N. Vlajic 2 1. Introduction 2. Network Service Models 3. Architecture 4. Network Layer Protocols in the Internet
Chapter 7. The Transport Layer
Chapter 7 The Transport Layer 1 2 3 4 5 6 7 8 9 10 11 Addressing TSAPs, NSAPs and transport connections. 12 For rarely used processes, the initial connection protocol is used. A special process server,
Network Layer: Internet Protocol
Network Layer: Internet Protocol Motivation Heterogeneity Scale Intering IP is the glue that connects heterogeneous s giving the illusion of a homogenous one. Salient Features Each host is identified by
TSIN02 - Internetworking
Lecture 4: Transport Layer Literature: Forouzan: ch 11-12 2004 Image Coding Group, Linköpings Universitet Lecture 4: Outline Transport layer responsibilities UDP TCP 2 Transport layer in OSI model Figure
Index. ACK flag, 31 action, 29 activating PF, 5
/etc/authpf/authpf.allow, 128 /etc/authpf/authpf.conf, 126 /etc/authpf/authpf.message, 129 /etc/authpf/authpf.rules, 127, 131 /etc/authpf/banned/, 128 /etc/inetd.conf, 62 /etc/login.conf, 129, 130 /etc/pf.boot.conf,
TCP/IP Attack Lab. 1 Lab Overview. 2 Lab Environment. 2.1 Environment Setup. SEED Labs TCP/IP Attack Lab 1
SEED Labs TCP/IP Attack Lab 1 TCP/IP Attack Lab Copyright c 2006-2016 Wenliang Du, Syracuse University. The development of this document was partially funded by the National Science Foundation under Award
(ICMP), RFC
Internet et Control o Message Protocol (ICMP), RFC 792 http://icourse.cuc.edu.cn/networkprogramming/ linwei@cuc.edu.cn Nov. 2009 Overview The IP (Internet Protocol) relies on several other protocols to
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du. TCP Attacks. Chester Rebeiro IIT Madras
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du TCP Attacks Chester Rebeiro IIT Madras A Typical TCP Client 2 A Typical TCP Server create a IPV4 stream socket
Transparent TCP Timestamps draft-scheffenegger-tcpm-timestampnegotiation-03
Transparent TCP Timestamps draft-scheffenegger-tcpm-timestampnegotiation-03 Richard Scheffenegger [rs@netapp.com] Mirja Kühlewind [mirja.kuehlewind@ikr.uni-stuttgart.de] 16. November 2011 82nd IETF, Taipei,
Internet Control Message Protocol (ICMP), RFC 792. Prof. Lin Weiguo Copyleft 2009~2017, School of Computing, CUC
Internet Control Message Protocol (ICMP), RFC 79 Prof Lin Weiguo Copyleft 009~07, School of Computing, CUC Oct 07 Overview } The IP (Internet Protocol) relies on several other protocols to perform necessary
Introduction to routing in the Internet
Introduction to routing in the Internet Internet architecture IPv4, ICMP, ARP Addressing, routing principles (Chapters 2 3 in Huitema) Internet-1 Internet Architecture Principles End-to-end principle by
Internet Protocol. Outline Introduction to Internet Protocol Header and address formats ICMP Tools CS 640 1
Internet Protocol Outline Introduction to Internet Protocol Header and address formats ICMP Tools CS 640 1 Internet Protocol Runs on all hosts in the Internet and enables packets to be routed between systems
Sequence Number. Acknowledgment Number. Checksum. Urgent Pointer plus Sequence Number indicates end of some URGENT data in the packet
TCP Urgent Source Port Destination Port Sequence Number Acknowledgment Number HdrLen Reserved UA P RS F Checksum Window Size Urgent Pointer Urgent Pointer plus Sequence Number indicates end of some URGENT
TSIN02 - Internetworking
TSIN02 - Internetworking Literature: Lecture 4: Transport Layer Forouzan: ch 11-12 Transport layer responsibilities UDP TCP 2004 Image Coding Group, Linköpings Universitet 2 Transport layer in OSI model
Camouflaging Servers to Avoid Exploits Morgon Kanter and Stephen Taylor Thayer School of Engineering at Dartmouth College tr11-001
Camouflaging Servers to Avoid Exploits Morgon Kanter and Stephen Taylor Thayer School of Engineering at Dartmouth College tr11-001 Abstract: The goal of this research is to increase attacker workload by
On Assessing the Impact of Ports Scanning on the Target Infrastructure
2018 On Assessing the Impact of Ports Scanning on the Target Infrastructure Dr Mahdi Aiash 4/24/2018 1. Introduction A port scan is a method for determining which ports on a network are open. As ports
SinFP, Unication Of Active And Passive Operating System Fingerprinting
SinFP, Unication Of Active And Passive Operating System Fingerprinting Patrice Auret Thomson Corporate Research Security Labs 1, av. Belle-Fontaine - CS 17616 35576 Cesson-Sévigné - France patrice.auffret@thomson.net
Applied Networks & Security
Applied Networks & Security TCP/IP Networks with Critical Analysis http://condor.depaul.edu/~jkristof/it263/ John Kristoff jtk@depaul.edu IT 263 Spring 2006/2007 John Kristoff - DePaul University 1 Critical
Hands-On Ethical Hacking and Network Defense
Hands-On Ethical Hacking and Network Defense Chapter 2 TCP/IP Concepts Review Last modified 1-11-17 Objectives Describe the TCP/IP protocol stack Explain the basic concepts of IP addressing Explain the
Unicornscan Documentation Getting Started
Getting Started Presented to End Users Important Notice: This documentation is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
Design and Performance of the OpenBSD Stateful Packet Filter (pf)
Usenix 2002 p.1/22 Design and Performance of the OpenBSD Stateful Packet Filter (pf) Daniel Hartmeier dhartmei@openbsd.org Systor AG Usenix 2002 p.2/22 Introduction part of a firewall, working on IP packet
CSE/EE 461 The Network Layer. Application Presentation Session Transport Network Data Link Physical
CSE/EE 461 The Network Layer Application Presentation Session Transport Network Data Link Physical This Lecture Focus: What to do when one wire isn t big enough? Point to point link Broadcast link (Ethernet
Networking Technologies and Applications
Networking Technologies and Applications Rolland Vida BME TMIT Transport Protocols UDP User Datagram Protocol TCP Transport Control Protocol and many others UDP One of the core transport protocols Used
Active fingerprinting
Active 802.11 fingerprinting Sergey Bratus Cory Cornelius, Daniel Peebles, Axel Hansen INSTITUTE FOR SECURITY TECHNOLOGY STUDIES Cyber Security and Trust Research & Development http:// Motivation Can a