RE: Strange TCP headers

From: Benjamin Tomhave (falcon@cybersecret.com)
Date: 05/11/02 

From: "Benjamin Tomhave" <falcon@cybersecret.com>
To: <incidents@securityfocus.com>
Date: Sat, 11 May 2002 11:30:13 -0600

I remember seeing an announcement on the nmap list a couple weeks ago for a
different OS fingerprinting technique (there was some discussion as to
whether or not this was actually a new approach). They say that they use
SYN packets in their testing. Has anybody tested this tool against their
firewall or IDS to see how the scans show up?

Here's the original announcement (with corrected links) on this "new" OS
fingerprinting technique...

-----Original Message-----
From: Franck Veysset [mailto:franck.veysset@intranode.com]
Sent: Wednesday, April 17, 2002 11:25 AM
To: pen-test@securityfocus.com
Cc: ring@intranode.com
Subject: OS fingerprinting technique

Carefully studying the way TCP works, especially some timer value
inside the TCP stack, we have derived on a new technique for remote OS
detection, based on temporal response analysis.

The idea is quite simple: send a TCP SYN packet to an open port on a
remote system, and listen the different answers (usually successive
SYN/ACK packets). By measuring the number of response, the delay
between retries, and the optional presence of a "RST" packet after a
few answers, we can easily recognize some operating systems.
The nice thing is that it only required to send one packet on an open
TCP port, which make this method really quiet.

As a proof of concept, we also developed a standalone tool "RING"
that will perform these testings and identifications, using a signature
file.

More information is available at:
http://www.intranode.com/site/techno/techno_articles.htm

The open source tool can be downloaded from:
http://www.intranode.com/pdf/techno/ring-0.0.1.tar.gz

The full, 13 pages, white paper is available at:
http://www.intranode.com/pdf/techno/ring-full-paper.pdf

We will be very happy to get your feedback on this technique.
Feel free to contact us at: ring@intranode.com

Thanks,

-Franck 

--
Franck Veysset    --   http://www.INTRANODE.com
       Intranode Software Technologies

It is always possible to aglutenate multiple separate
problems into a single complex interdependent solution.
In most cases this is a bad idea. (RFC 1925)

-----Original Message-----
From: Michel Arboi [mailto:arboi@yahoo.com]
Sent: Saturday, May 11, 2002 1:33 AM
To: pbsarnac@ThoughtWorks.com; incidents@securityfocus.com
Subject: Re: Strange TCP headers

 --- pbsarnac@ThoughtWorks.com a écrit :
> The interesting thing is that a majority of the scans are originating
> from port 6346, which snort.org informs me is the gnutella server
> port.

I suspect that your Pix is not decoding those packets (or fragments)
correctly.
If this is a new scanning technique, I hardly understand its use. Some
kind of fingerprinting maybe? They would use the 6346 port because it
might be unfiltered (on personal firewall at least), just like some
people used the 20 (FTP data) port to go through stupid stateless
filters.

> All those I've verified that at least
> two of the clients that these packets were directed to were running
> various file-sharing clients.

So I'd rather bet for
1. an artefact created by the Cisco
2. some data corruption (bad phone line, deffective modem, whatever)
3. some IP layer bug

___________________________________________________________
Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français !
Yahoo! Mail : http://fr.mail.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Re: Changing iptables on the fly
    ... What I'd suggest is using the firewall directly. ... uses an 'open' and 'close' knock, though he's using the default SSH port. ... the reason most people don't recommend the PHP technique you ...
    (comp.security.firewalls)
  • TCP segments reordering and covert channels
    ... The original sequence of the packets is guessed by the receiver with the sequence number of ESP or AH. ... The author says that this technique is not applicable to IP or TCP ... TCP segments can also be reordered. ...
    (Vuln-Dev)
  • Re: [Full-disclosure] Microsoft Windows and *nix Telnet PortNumber Argument Obfuscation
    ... > technique described probably does affect many networking tools, ... > and the user should have been told that the port number is out of range. ... but shouldn't the telnet programmer let him ...
    (Full-Disclosure)
  • Re: OT: Old Port stuff
    ... Using the patented Mavis Beacon "Hunt&Peck" Technique, ... >>> Anyone like old Port? ... >> Tonight has involved 10 y/o Tawny and now currently an '89 Vintage. ...
    (uk.rec.motorcycles)
  • Re: French Run - ferry times
    ... Using the patented Mavis Beacon "Hunt&Peck" Technique, Phil Launchbury typed ... toil chateau.murray btinternet.com wrote: ... it to the port? ...
    (uk.rec.motorcycles)
Loading