Revolutionizing Operating System Fingerprinting

Architecture and Background

Ofir Arkin - Revolutionizing Operating System Fingerprinting Revolutionizing Operating System Fingerprinting Xprobe is an active operating system fingerprinting tool, which was officially released two years ago at the Blackhat briefings USA 2001. The first version of the tool was a proof of concept for the methods introduced in the "ICMP Usage in Scanning" project, which I have conducted. Two years after, and several versions later (mainly Xprobe2 v0.1 release), this talk would examine several issues with operating system fingerprinting we (Fyodor Yarochkin and myself) have encountered during the development of Xprobe and Xprobe2. Mainly the talk will explain why traditional operating system fingerprinting methods suffer from a number of caveats, and how these issues directly affects the results different operating system fingerprinting tools relying on these methods produce (these issues will be explained along with different examples).

Vulnerability Analysis

During the talk I will introduce several advancements in the field of operating system fingerprinting. The methods introduced greatly enhance the accuracy of operating system fingerprinting. Several new ways to gather information about a host OS will be uncovered along with ways to overcome many of the current issues of active operating system fingerprinting methods. During the talk examples will be given, and the audience will be encouraged to participate in a discussion.

Exploitation and Demonstrations

A paper release, and a new version of Xprobe2 will accommodate the talk. Ofir Arkin is the founder of the Sys-Security Group, a non-biased computer security research and consultancy body. Armed with extensive knowledge in the information security field, Ofir Arkin has worked as a consultant for several major European finance institutes were he played the role of Chief Security Architect and Senior Security Architect. In his role as Senior Security Architect, Ofir was responsible for assessing the future external and inter-bank IP communication security architecture for one of the world's top 10 banks, analyzing the needs and solutions for an internal Single Sign-On (SSO) project for a world leading pharmaceutical company, securing the E-banking project for a leading Swiss bank, etc..

Remediation and Defensive Strategies

Ofir also acted as Chief Security Architect for a 4th generation telecom company, where he designed the overall security architecture for the company. Ofir has published several papers as well as articles and advisories. The most known papers he has published are "Etherleak: Ethernet frame padding information leakage", "Security Risk Factors with IP Telephony based Networks", the "ICMP Usage in Scanning" research paper, xprobe2 (tool and paper), "The Cisco IP Phones Compromise", and "Trace-Back". He is currently conducting research on a number of TCP/IP protocols as well as Voice over IP. Ofir's research has been mentioned in a number of professional computer security magazines. Ofir is an active member with the Honeynet project and participated in writing the Honeynet's team book, "Know Your Enemy" published by Addison-Wesley.