Re: how to change OS idenfication?

From: C. Ulrich (dincht_at_securenym.net)
Date: 02/18/04

  • Next message: Truxton Fulton: "Re: how to change OS idenfication?" 
    To: Monty Ree <chulmin2@hotmail.com>
Date: Wed, 18 Feb 2004 02:44:20 -0500

    On Tue, 2004-02-17 at 05:20, Monty Ree wrote:
    > Hello, all.
    >
    > I have operated linux sevrer and I would like to change the OS
    > identification.
    > So using nmap, I would like to be seen Windows instead of linux for
    > security reason.
    >
    > I heard that ippersonality(http://ippersonality.sourceforge.net) enable
    > this.
    > But the development of the ippersonality seems to be stopped.
    >
    > Is there any other method to change the OS identification?
    >
    > Thanks in advance.

    Unless memory fails me, nmap detects the remote operating system by
    looking for slight variations in the responses that it gets from certain
    probes and other information coming back from the host. There is no
    string lying about somewhere in the packets that says, "Hi, I'm a Linux
    machine" for example. One would have to tweak almost every part of the
    networking code in order to make the packets appear that they're coming
    from some other particular operating system. If someone actually did
    this, the nmap authors could conceivably update their code to correct
    for the modifications in a later version, which then defeats the purpose
    of the modifications, which then creates a vicious circle that spirals
    out of control, causing earthquakes and eradicating whole hemispheres of
    the planet, ad ininitum, ad nauseum, etc.

    You can see that it would just be a huge mess that, frankly, nobody
    wants to deal with. For information on how nmap fingerprinting works,
    see:

    http://www.insecure.org/nmap/nmap-fingerprinting-article.html

    I'd guess that a good firewall and applying proper security procedures
    would go a lot further than trying to spoof your OS fingerprint.

    Charles Ulrich

    P.S. You want your server to appear to be running Windows instead of
    Linux for security reasons? You're an interesting character. :) 

    -- 
http://bityard.net
  • Next message: Truxton Fulton: "Re: how to change OS idenfication?"

    Relevant Pages

    • Re: how to change OS idenfication?
      ... >> I have operated linux sevrer and I would like to change the OS ... >> security reason. ... nmap detects the remote operating system by ...
      (Focus-Linux)
    • Re: Get your Mac, its raining Trojans
      ... What is really needed is an entirely new operating system from ... Linux distros have almost daily security updates you need to apply to ... Windoze boxes are attacked because it is so easy and possible to attack ... think any Linux Distro that became the dominate OS would not be the target ...
      (microsoft.public.windowsxp.general)
    • Re: linux vs mac
      ... There is a lot of software you can get to run on Linux, ... you might also want to consider another operating system, ... Even Fink is only a marginal improvement, since the packages are so out of date. ... This is especially true for the X11 version. ...
      (comp.sys.mac.advocacy)
    • Re: Identifying Kernel 2.4.x based Linux machines using UDP
      ... > Linux Kernel 2.4.x has a bug with the UDP implementation which allows ... It also isn't specific to UDP -- you'll find ... Last year I added a feature to Nmap which automates this IPID ...
      (Bugtraq)
    • Re: linux vs mac
      ... There is a lot of software you can get to run on Linux, and the Ubuntu ... Macintosh is a better solution. ... you might also want to consider another operating system, ...
      (comp.sys.mac.advocacy)