IpMorph : unification de la mystification de la prise d'empreinte - - PowerPoint PPT Presentation

▶
ipmorph unification de la mystification de la prise d
SMART_READER_LITE
LIVE PREVIEW

IpMorph : unification de la mystification de la prise d'empreinte - - PowerPoint PPT Presentation

Apr 10, 2023 286 likes •472 views

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph : unification de la mystification de la prise d'empreinte Guillaume PRIGENT DIATEAM - Brest SSTIC - 5 juin 2009 1 IpMorph is an Open Source project

slide-1
SLIDE 1

This document is licensed under a Creative Commons Attribution 3.0 License

SSTIC - 5 juin 2009

IpMorph is an Open Source project owned, developed and supported by DIATEAM 1

IpMorph : « unification de la mystification de la prise d'empreinte »

Guillaume PRIGENT DIATEAM - Brest

slide-2
SLIDE 2

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Contexte

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 2

Théorème : « Vivons heureux, vivons cachés » Corolaire : « Si une machine peut falsifier son identité et l’usurper, celle ci minimise l’attrait de l’attaquant et perturbe la pertinence des attaques ciblées à sa nature apparente.»

slide-3
SLIDE 3

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Typologie de la prise d’empreinte

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 4

Techniques de détection

Actives Passives

Binaires thc-rut Xprobe2 Nmap Ring2 SinFP p0f SinFP Ettercap « Time-out »

Ecoutes réseau

Entêtes TCP Réponses ICMP Profils ISN Bannières

Collectes Empreintes de pile

slide-4
SLIDE 4

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Principes de détection

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 5

NETWORK REPONSES STIMULI

A A B

SYN

A = B =

SYN+ ACK

Détection active d’empreinte de pile Détection passive d’empreinte de pile

Nmap, SinFP, … p0f, SinFP, …

NETWORK

A =

slide-5
SLIDE 5

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Cas d’utilisation d’IpMorph

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 6

A = B = A = B = A = A =

SYN SYN+ACK SYN SYN+ACK SYN SYN+ACK SYN SYN+ACK

OSFP Actif + Machine réelle OSFP Passif + Machine réelle OSFP Actif + Machines « virtuelles » OSFP Passif + Machines « virtuelles »

A B A A B A

slide-6
SLIDE 6

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Etat de l'art de la mystification [7]

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 7

  • Filtrage

– Stealth patch : Unmaintained as of 2002, GNU/Linux kernel 2.2-2.4 [14] – Blackhole : FreeBSD, kernel options [16] – IPlog : Unmaintaned as of 2001, *BSD [17] – Packet filter : OpenBSD [18]

  • Configuration et modification de pile TCP/IP ("host based")

– Ip Personality [19] – Fingerprint Fucker [12][13] – Fingerprint scrubber [1] – OSfuscate [8]

  • Substitution de pile TCP/IP ("proxy behaviour")

– Honeyd [9] – Packet purgatory / Morph [10]

slide-7
SLIDE 7

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Socle logiciel

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 8

  • Langage C++
  • Application « UserLand »
  • Utilisation du « framework » Qt4
  • Eléments constituants :

– IpMorph (Core) – IpMorph Controller – IpMorph Personality Manager – IpView (IpMorph GUI)

  • Portabilité :

– GNU/Linux – *BSD, Mac OS

  • License GPLv3
slide-8
SLIDE 8

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Interface layer Interface layer

  • Eth. Write

Architecture générale

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 9

  • Eth. Write

TCP Filter & Processor

Context queue Exposed IP stack Protected IP stack TCP UDP ICMP IP ETH TCP UDP ICMP IP ETH

UDP Filter ICMP Filter IP Filter

  • Eth. Read

(R)ARP TCP Filter & Processor UDP Filter ICMP Filter IP Filter (R)ARP

  • Eth. Read

eth tap fd eth tap fd

  • Frag. & Reass.
  • Frag. & Reass.

Scheduler UDP context tracker & data processor (plugins) ICMP context tracker & data processor (plugins) IP context tracker & data processor (plugins) (R)ARP translation processor TCP context tracker & data processor (plugins)

slide-9
SLIDE 9

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Nmap : Format d’une signature

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 10

Fingerprint FreeBSD 7.0-CURRENT Class FreeBSD | FreeBSD | 7.X | general purpose SEQ(SP=101-10D%GCD=<7%ISR=108-112%TI=RD%II=RI%TS=20|21|22) OPS(O1=M5B4NW8NNT11%O2=M578NW8NNT11%O3=M280NW8NNT11%O4=M5B4NW8NNT11%O5=M218NW8NNT11%O6=M109NNT11) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF) ECN(R=Y%DF=Y%T=40%TG=40%W=FFFF%O=M5B4NW8%CC=N%Q=) T1(R=Y%DF=Y%T=40%TG=40%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=Y%DF=Y%T=40%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW8NNT11%RD=0%Q=) T4(R=Y%DF=Y%T=40%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=) T5(R=Y%DF=Y%T=40%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) T6(R=Y%DF=Y%T=40%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=) T7(R=Y%DF=Y%T=40%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=) U1(DF=N%T=40%TG=40%TOS=0%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G) IE(DFI=S%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S) …

SP : TCP ISN Predictability GCD : TCP ISN Greatest Common Divisor ISR : TCP ISN counter Rate TI : TCP IP ID sequence generation algorithm II : ICMP IP ID sequence generation algorithm TS : TCP timestamp

  • ption algorithm

SS : Shared IP ID sequence Boolean W1-W6 : TCP initial win size O1-06: TCP Options (ordering & values) DF: IP don’t fragment bit T: IP initial time-to-live TG: IP initial time-to-live guess W: TCP initial win size S: TCP seq. number A: TCP ack. number F: TCP Flags RD: TCP RST data checksum Q: TCP misc. quirks TOS: IP type of service IPL: IP total length UN: Unused port

  • unreach. field

nonzero RID: Returned probe IP ID value RIPCK: Returned probe IP checksum value RUCK: Returned probe UDP checksum RUL: Returned probe UDP length RIPL: Returned probe IP total length value

slide-10
SLIDE 10

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

PatternTcpFlags

idPatternTcpFlags(PK) patternTcpFlagsHeuristic0 patternTcpFlagsHeuristic1 patternTcpFlagsHeuristic2

SinFP : Base des signatures (sqlite)

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 11

IpVersion

idIpVersion(PK) ipVersion

Os

idOs (PK)

  • s

OsVersionChildren

idSignature idOsVersion

OsVersionFamily

idOsVersionFamily(PK)

  • sVersionFamily

PatternBinary

idPatternBinary (PK) patternBinaryHeuristic0 patternBinaryHeuristic1 patternBinaryHeuristic2

PatternTcpMss

idPatternTcpMss(PK) patternTcpMssHeuristic0 patternTcpMssHeuristic1 patternTcpMssHeuristic2

PatternTcpOptions

idPatternTcpOptions(PK) patternTcpOptionsHeuristic0 patternTcpOptionsHeuristic1 patternTcpOptionsHeuristic2

SystemClass

idSystemClass(PK) systemClass

OsVersion

idOsVersion(PK)

  • sVersion

Vendor

idVendor(PK) vendor

PatternTcpWindow

idPatternTcpWindow(PK) patternTcpWindowHeuristic0 patternTcpWindowHeuristic1 patternTcpWindowHeuristic2

Signature

idSignature(PK) idIpVersion idSystemClass idVendor idOs idOsVersion idOsVersionFamily idP1PatternBinary idP1PatternTcpFlags idP1PatternTcpWindow idP1PatternTcpOptions idP1PatternTcpMss … idP3PatternBinary idP3PatternTcpFlags idP3PatternTcpWindow idP3PatternTcpOptions idP3PatternTcpMss trusted

slide-11
SLIDE 11

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

SinFP : Format d’une signature

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 12

104,1,IPv4,Windows,Microsoft,Windows,Vista,Vista, B11113,B…13,B….., F0x12:F0x12:F0x12, M1460,M1[34]..,M\d+, O0204ffff,O0204ffff,O0204ffff, W8192,W8[012]..,W\d+, B11113,B…12,B….., F0x12,F0x12,F0x12, M1460,M1[34]..,M\d+, O0204ffff010303080402080affffffff44454144,O0204ffff(?:01)?(?:030308).(.:0402)?(?:080affffffff44454144)?,O0204ffff(?:01)?(?:030308).(.:0402)?(?:080affffffff44454144)?, W8192,W8[012]..,W\d+, B11121,B…21,B….., F0x04,F0x04,F0x012, M0,M0,M0, O0,O0,O0 W0,W0,W0

idSignature ipVersion systemClass vendor

  • s
  • sVersion
  • sVersionFamily

trusted Test P1 Test P2 Test P3 Binary : heuristic0, heuristic1, heuristic2 TcpFlags : heuristic0, heuristic1, heuristic2 TcpMss : heuristic0, heuristic1, heuristic2 TcpOptions : heuristic0, heuristic1, heuristic2 TcpWindow : heuristic0, heuristic1, heuristic2

slide-12
SLIDE 12

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

p0f : Format d’une signature

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 13

8192:128:1:52:M*,W8,N,N,N,S:.:Windows:Vista (beta) TCP Window Size TCP Initial TTL IP Don’t Fragment Bit TCP SYN Packet Size TCP Options Quirks OS System Class OS Name

  • Version 2.0.8 (2006)
  • 6 paramètres d’analyse
  • Uniquement sur un SYN (par défaut = p0f.fp)
  • Autres fichiers de signatures pour autres modes (expérimentaux)
slide-13
SLIDE 13

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Ring2 - Mystification de la congestion

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 14

slide-14
SLIDE 14

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Personality Manager

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 16

slide-15
SLIDE 15

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

Perspectives

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 17

  • Juin 2009 – SSTIC 2009

– Présentation « officielle » – « Beta release » 0.1 (en « download » par courriel)

  • Fin 2009 – Début 2010

– « Refactoring » (Qt4 ?, uIp !, tests en production …) – PersonalityManager, Intégration filtrage, … – Version 0.2 en « download » Internet – Documentation, « UserGuide », … – Intégration de quelques « scrubbers » applicatifs (DNS, SMB, DHCP, …) ?

slide-16
SLIDE 16

This document is licensed under a Creative Commons Attribution 3.0 License IpMorph is an Open Source project owned, developed and supported by DIATEAM v0.1

IpMorph : « unification de la mystification de prise d'empreinte»

1 - Interface tap0

Démonstration

2009/06/05 guillaume.prigent@diateam.net - DIATEAM 18 192.168.10.110 Linux Ubuntu 8.04 192.168.10.73 Nmap, Xprobe2, SinFP, P0f tap0 eth0 LAN

Scénario de la démonstration

4 - Xprobe2 2 - VirtualBox 3- IpMorph 5 - Nmap 6 - SinFp en actif 7 - SinFp en passif 8 - p0f

Configuration Prise d’empreinte « active » Prise d’empreinte « passive »

slide-17
SLIDE 17

This document is licensed under a Creative Commons Attribution 3.0 License

SSTIC - 5 juin 2009

IpMorph is an Open Source project owned, developed and supported by DIATEAM 2009/06/05 19

Merci de votre attention.