start	end	text
7240	9530	Sorry about the slight delay.
12370	18150	My name is Ophir Arkin, and during this talk, I will be releasing XProbe 2.0.3.
19510	24720	Prior to that, I will be talking about several aspects of doing active voice fingerprinting.
25590	33890	Basically, we're going to discuss the problems that are usually associated with active voice fingerprinting,
33890	36090	and we'll see how we can remedy that.
36490	44210	A bit about myself, I'm the founder of the C-Security Group, also founder of NCITEC,
44210	46190	I'm the Chief Technical Officer there.
46930	53710	I've done some research about infrastructure discovery, voice over IP security, and OS detection,
53710	57810	and I'm also a member of the Voice Over IP Security Alliance.
58850	60770	So, what is OS detection?
60770	70930	OS detection is basically the process of trying to determine what is the underlying operating system of a certain remote element.
71370	77750	Traditional approach will send some packets, will examine the stack behavior,
77750	86070	usually with IP, UDP, TCP, and ICP, in order to draw some conclusions about that underlying OS.
86070	95510	Usually, when results are received from a target element, those results will be compared to a certain signature database,
95610	100570	a certain tool will have, in an effort to find a match.
101930	110010	Just because the traditional approach is to use TCP IP stack-based fingerprinting, usually limited to those protocols I've mentioned,
110010	117230	doesn't mean that we cannot use the application layer also to provide us with information about the OS.
120670	126270	There are several tools out there that does active OS fingerprinting.
127130	131270	Nmap, for example, is a good tool doing that, Xpub2 and others.
131270	139410	Basically, these tools vary with the way of operation, usually because of the different tests they are using.
139410	146230	Basically, the packets they are sending to the target host, trying to enumerate the operating system,
146230	149030	the number of packets they are sending, and the way of operation.
152030	156710	Why is that important for us, to identify the underlying operating system?
156710	161510	Well, I guess that for each and one of us, it's something different.
163330	170510	Some need that to do vulnerability assessment, some like to have some context about their network,
170510	180890	and there are some companies who use OS detection as a means to have some context for their network intrusion detection systems and network intrusion prevention systems.
181870	189010	If we go and look at the strength of doing remote active OS fingerprinting,
189010	194690	then one of the things that is the most important is that we can control everything.
194710	198110	We can control what parameters that we would like to scan.
198110	205870	We can control the speed that we perform the scan, the initiation of the scan, the time of the initiation.
207350	212690	Usually such a tool will provide with fast results if there are no obstacles on the way,
212690	216570	and then of course it can also cover entire IP ranges.
218150	220610	Several companies use these kind of tools.
220710	225050	They might scan from one single point to a multipoint.
225050	229590	This is where the tool is installed on one element on the network and scans multiple.
229590	241650	And there are some other implementations where a scanning tool will be installed on different parts of the network and will scan from there other parts of the network.
242750	245330	That's basically it. These are all the strengths.
245330	246750	There are a lot of weaknesses.
248330	252190	The weaknesses go into different categories.
253190	259550	The biggest problem is the scanning conditions and the environment effects on the scan,
260030	266410	the way that the OS detection tool operates, the signature database is not a major caveat,
266770	269690	and also some other tool-related issues.
270470	275110	So let's start by looking at the scanning conditions and the environment effect.
278390	286190	Basically, when we perform an OS detection or basically any other scan,
286190	289030	we do not control the quality of the scan.
289030	291590	We cannot control over anything, basically.
291930	297590	Whatever is between us to the target may determine what we're going to get back.
297910	300490	So probably most of you know this.
300490	304650	If you scan an element on a local network, this is one thing.
304650	308890	If you scan an element that is on the Internet, that is something else.
309690	315690	And basically, those locations of the target systems will determine what you're getting.
315690	321990	It's most likely that when you scan an element that is on your local network, you'll get better results.
321990	326550	When you scan an element that is on the Internet, you'll get, well, sometimes nothing.
326550	334510	And also the path between the scanning element to the target also determines what we will be getting.
334990	346130	The problem currently is that we do not have any kind of intelligence about what do we have between us to the target.
346130	352590	There is currently no tool that is going to tell us,
352590	361750	or something else that prevents us or changed the way either our packet or the returning packet had arrived to us.
364410	371950	In order to have good results with any OS fingerprinting tool, you have to have the target machine willing to talk to you,
371950	375410	meaning that your packets will arrive to the target machine,
375410	380330	and also that the target machine will be operational on the network, meaning it will be up.
380330	387270	And of course, if you don't have elements such as network-based firewalls, host-based firewalls,
387270	393310	not-enabled devices, load balancers, and other things between you to the target.
393310	400510	So, just a quick example, if the scanning machine scans a local network,
400510	403650	there is a firewall between the scanning machine to one of the networks,
403650	410250	and it prevents the sending packets through to targets that part of the network will not be identified,
410250	413090	and those hosts will not be listed by the tool.
413210	416330	This is also true if you have personal firewall installed on a machine.
416330	418730	That will prevent OS detection from working.
418990	422890	You'll never get any active OS detection working like that.
422890	436170	Another example is that if some of you, not hinting, sits at home and wants to scan www.companythatyoulike.com,
437110	443110	and that company that you like.com has load balancers in front of its web servers.
443110	446490	Well, the initial approach of voice fingerprinting will not work here.
447010	451910	Some of those load balancers will answer themselves through the probe.
451910	457850	Some of them will change some of the parameters that will go back to the scanner,
457850	466570	and some of them even, if there is no one OS that operates on the web servers behind the load balancers,
466570	469170	then you might get funny results back.
471730	480790	So basically, the result will be that if the packets that you need in order to draw conclusions about the OS is being dropped,
480790	482710	then you'll not get anything.
484950	493070	Sometimes, when we send packets to the target, there is something along the way, like a scrubber, a firewall.
493290	497870	I don't know how many of you are familiar with checkpoint firewall,
497870	503910	but that firewall can scrub several fields inside a packet that comes back.
503910	511650	And those kind of alterations will prevent us from determining what is the underlying OS there.
512910	523250	Sometimes, if a tool uses malformed packets, those packets will also be dropped by an intrusion prevention system
523250	530250	or other system that checks for the legitimacy of the packet.
530250	538530	So some examples would include some weird TCP-IP flag combinations, like SYNFIN, SYNRESET.
538530	543630	Those will never go through an IPS and will never be able to reach the target.
544210	552170	So of course, if the tool that you are using is using crafted packets and is sending crafted packets throughout the Internet,
552170	556890	then that tool will not be able to provide good results.
556890	564970	The other problem that we have there is that sometimes those malformed packets may have another hidden effect
564970	576490	that might cause some TCP-IP stacks to crash, especially when those stacks don't need to do too many things.
576490	583130	Especially, we can name printers, we can name print servers, and things like that.
583930	593450	And of course, there are some other smart people out there that want to obscure the way that their operating system works.
593710	603530	So they change the characteristics of the TCP-IP stack behavior by altering some kernel parameters, tunable kernel parameters.
603530	612990	So if you are familiar with several commands, for example, the CCTL command and the NDD command on Sun,
612990	618230	then you are able to tune the parameters. Also, on Linux, it's very easy to perform these kinds of things.
622020	626800	So let's go into some signature-based related issues.
627980	633460	The signature database is the most important piece of any OS detection tool.
633460	642480	If the signature database will be corrupted, if the signatures will not be inserted to the signature database in a correct manner,
643040	649120	then at the end of the day, you'll have a corrupted signature database, and it will not help the tool,
649120	654480	even if the tool is using the most admirable test out there.
654680	659640	Still, the results that the tool will be performing will be poor.
660440	669240	This is a traditional argue between those who strictly control their signature database
669240	673720	to those who allow people to submit signatures for their tool.
674200	679380	My approach is that if I want to insert a signature, I want it to work.
679380	686910	In most cases, I won't insert a signature that someone sent me off a firewall device because there is no use of it.
689510	691030	That's music.
692170	696330	So basically, my approach takes it to the extreme.
696330	702550	Basically, I need to go and I need to see the device. I need to verify the OS.
702550	708070	I need to verify, in some cases, what it is actually running.
708890	712470	The lab environment is the best way to do this.
712470	720290	And therefore, when you enter the signature in question to the signature database, it will work in most of the cases.
721410	725670	Some of the other tools that are out there simply would say,
725670	729650	okay, there is a webpage here, let's submit some signatures,
730150	736050	and then you don't know what was the actual test there and that this signature was produced at.
736050	739790	And you try to run a certain test, and at the end of the day,
739790	744470	what you get is a mixed result that never comes close to the reality.
745250	752890	So we can strictly control the process of inserting signatures into the database.
752990	757430	Sure, it has its downside. It's a slower process.
757470	762030	It has a limit on the number of signatures and devices that you can insert into the database
762030	765870	because we can't buy them all or we can't access them all.
765990	769610	And the one plus of it is that it is extremely accurate.
769610	772890	On the other hand, if we do not control the signature database,
772890	776490	then signatures are inserted because they are there.
776970	780330	The creation process is not controlled.
781090	784590	If those signatures are created in a wrongfully manner,
784590	787570	then we have a corrupted database and not a controlled one,
787570	789550	which is extremely inaccurate.
792370	797610	When we do OS fingerprinting, we fingerprint the way that the software reacts
797610	800430	to the probes that we send.
800430	803010	When we fingerprint a hardware-based device,
803010	807170	basically we fingerprint the way the firmware actually answers us.
807170	810830	And this is a common mistake when we go and we try to do this thing
811910	815670	because if you are familiar with hardware-based devices,
815670	818810	then most of them will, for the same manufacturers,
818810	825190	most of them will run either the same firmware or a slightly different firmware.
825190	829670	Usually it depends either on their role,
829670	834630	or the manufacturer decides that he wants one firmware or two.
834830	837390	So there are a few examples with that.
838930	846670	Cisco 7200 will be fingerprinting as 2950, as the Switch 2950,
846670	853190	as a 6500 running iOS, and even as the Aeronet's wireless access points.
853190	854970	Why? Because they are all running iOS,
854970	859130	and with traditional TCP-IP-based stack fingerprinting,
859130	862210	we're not able to tell the difference of their roles.
862510	864610	There are other nice examples.
864890	868330	Foundry Networks usually run the same OS,
868330	870850	sorry, the same firmware on all of their systems,
870850	876170	and also the printers, if you're familiar with HP printers,
876170	880590	those will also run the same firmware or a slightly different firmware,
880590	883610	depending on the year and the updates.
884710	887670	But, unfortunately, some OS fingerprinting tools
887670	889650	don't take this into account,
889650	893590	and at the end of the day, it also brings them to the...
894190	897170	for having a corrupted database,
897170	899230	when you do a fingerprinting of HP,
899230	901770	what you get is not that this is an HP printer,
901770	905970	you get that it might be a home printer,
906310	909870	a corporate printer, or whatever else printer and other things,
909870	913110	but at the end of the day, that's the firmware, not the model.
917730	922930	When we want to expand and use other fingerprinting tests,
922930	925410	and we want to expand what we have,
925410	928250	then we need to go through the entire signature database
928250	929790	and we need to update it.
930850	934950	If we need to do so, as part of the signatures
934950	938210	or part of the tool evolution,
938210	939910	then we need to go through the entire signatures
939910	941590	and update them with new tests.
942410	945770	If we do not control what is inside the database,
945770	947850	then we are unable to update that.
948010	950150	So, we might have new tests that we want to have,
950150	953210	we might have new things that we want to introduce,
953730	955930	but at the end of the day, we can't do that,
955930	957850	because we don't have control of that.
958270	960810	And, of course, there is one other small issue,
960810	962750	which is a political issue.
963470	967110	The political issue is that many open source tools
967110	969290	basically are abused,
969290	971910	because many commercial companies do not read the license
971910	975610	and they take the signature database
975610	979470	and they claim it as their own.
980030	982770	There are some examples for that,
982770	984230	but at the end of the day,
984230	986910	when you contribute something to the open source community
986910	990110	and you hope that it is actually being used,
990110	993430	then you don't want your work to be stolen as well.
994850	999290	This is actually causing some guys that manufacture,
999290	1003570	that actually develop open source tools,
1003570	1007510	not to insert the entire knowledge into those tools,
1007510	1011150	or sometimes not to insert their entire signature database
1011150	1012910	into those tools, because they know
1013190	1017350	that people will just go download the signature database,
1017350	1018450	enjoy what they have done,
1018450	1020810	and basically don't pay them anything.
1023430	1026510	There are some issues that relate to the way
1027350	1030710	the OS fingerprinting tool actually works.
1032790	1034630	Scanning results needs to be matched
1034630	1037170	with the signature database.
1037750	1039830	There are actually two ways of doing that.
1039830	1041950	Actually, there can be more.
1041950	1043530	Either you do strict signature matching,
1043530	1046150	where you search for a 100% match
1046150	1048710	between what you've got to the signature database,
1048710	1052090	or that you use statistical analysis approach,
1052090	1056170	which basically says we'll find the best match for you,
1056170	1058030	and we will present you with the best match,
1058030	1062030	even if some of those tests had failed.
1062590	1065090	So these are the two approaches that we have.
1067910	1071610	Another problem is that Stacks looks alike
1071610	1074490	with new released operating systems,
1074490	1077590	and there are only n number of tests,
1077590	1080370	or n number of parameters that we can look for.
1080370	1083870	So theoretically, somewhere along the line,
1083870	1086830	the number of possible matches should be reached.
1086830	1089130	Although this number is still currently high,
1089130	1091210	there are classes of different operating systems
1091210	1095790	that even when we use several new OS fingerprinting tests
1095790	1097490	or old OS fingerprinting tests,
1097490	1101130	we're still unable to distinguish between their Stacks
1101130	1107250	because the tests that we're using are insufficient to do so.
1107250	1110410	So what we need to have is the ability of a tool
1110410	1116690	to have fingerprinting tests that have multiple parameters inside of them,
1116690	1121150	that they represent different OSs,
1121150	1125670	that many parameters are different among the TCPIP Stack,
1125670	1130190	and that allows us to receive better overall results.
1133690	1135390	Another problem that we have is that
1135390	1139110	when some tests are regarded better than others,
1139110	1141130	it means that if they would fail,
1141130	1144930	then the quality of results that we will have will be lowered.
1146310	1149630	For example, if we would not receive SYNAC response
1149630	1153330	for a SYN request to an open port,
1153330	1155990	or we'll not get this kind of response at all,
1155990	1159830	or we'll not receive port enrichable for UDP packet,
1159830	1163110	then basically the way that we'll have results
1163110	1165830	will not have too much.
1168890	1172010	I've touched this slightly beforehand.
1172290	1175250	This is the problem of having slight differences
1175250	1179750	between the TCPIP Stacks of newly released operating systems
1179750	1181390	to an older one.
1182350	1185250	XPSP2, for example, and Windows 2003
1185890	1189430	share the same characteristics of the stack.
1189430	1196570	So does Windows 2000 and XP with no OSP and SP1.
1196810	1200890	And so does some Linux kernels share the same characteristics.
1201290	1202870	This actually brings us to the point
1202870	1205930	that we cannot have granular results.
1205930	1208050	What we have is just grouped results
1208050	1211070	that at the end of the day might say,
1211070	1213230	okay, this is a Windows system,
1213230	1216450	but actually it will not list the underlying OS.
1219430	1222190	Another problem that we have is that the type of information
1222190	1225490	that we are able to extract using traditional TCPIP Stack
1225490	1227570	fingerprinting is limited,
1227570	1230170	and one of the examples can be shown
1230170	1234070	with the different Windows operating system service packs.
1234970	1237610	Traditional TCPIP-based tools
1238210	1241190	are not able to tell the service pack in most of the cases,
1241190	1245070	and this is a problem if you want to use the information
1245070	1246990	for other tools like vulnerability assessment.
1258310	1261210	When we're using a tool,
1261210	1264370	we would like to have the maximum flexibility with the tool.
1264470	1267670	We would like to have the ability to control what models it is using.
1267670	1270890	So if we know that we operate against a web server,
1270890	1272930	we're not going to use tests that we assume
1272930	1276710	that will be dropped or not be answered.
1276750	1279230	So an active OS fingerprinting tool needs to have
1279230	1281370	all of its models controlled
1281370	1284610	and has to allow the user to specify exactly
1284610	1285830	which models you want to use
1285830	1289750	and what types of packets you want to send
1289750	1293350	to the host.
1297370	1298590	Another problem,
1298590	1301370	and this is the last of the row,
1301370	1305010	is that sometimes active OS fingerprinting tools
1305010	1308570	will pose an out-of-service condition
1308570	1310650	to those elements they're scanning.
1310730	1312910	The problem is that sometimes those will use
1312910	1315910	non-RFC compliant packets
1315910	1318550	or the pace of the scan will be too fast
1318550	1321230	for the element to handle.
1321430	1323950	And that will cause the element to crash
1323950	1326490	or use extra packets.
1328070	1332050	I have a Kyocera Amida FS-1900 printer in my office.
1332190	1333570	If I scan it with nmap,
1333570	1335650	the printer crashes to the point that I have to go
1335650	1338490	and I have to power off the printer and power it on.
1342550	1343310	So,
1343310	1345970	the summary for this is that
1346990	1348890	we need to understand the Terran,
1348890	1350730	we need to understand what we're scanning,
1350730	1353550	we need to understand what's between us to the target.
1354470	1357410	If we cannot meet the conditions that we need
1357410	1359790	in order to get good results, then basically
1360370	1362710	we're not going to get any kind of results.
1364950	1367430	We need to understand those conditions
1367430	1370910	in order to build better tools that will allow us
1370910	1373270	to receive results even if we're operating
1373270	1375910	against a well-fortified element
1376430	1379270	sitting behind different
1379270	1383250	kind of security mechanisms.
1388640	1389620	There are some other
1389620	1392000	approaches that came and said, okay, let's decide
1392000	1394760	or let's see if we can bypass those problems and
1394760	1398100	basically what they have said is that, okay, let's take one protocol,
1398100	1401720	we try to analyze that and we'll use only that protocol
1401720	1404460	in order to draw conclusions about what we see.
1404460	1406500	So there are some researchers,
1407420	1410100	if you heard about a tool called TBIT,
1410820	1414080	basically they look for the current state
1414080	1416920	of TCP implementation or TCP implementations
1416920	1420060	on web servers. So they took the tool and said,
1420060	1422700	okay, this is something that we can use
1422700	1424660	in order to do OS fingerprinting,
1424660	1426920	but the problem is that using
1428180	1430740	multiple tests only against an open
1430740	1433780	TCP port, it actually doesn't do anything
1433780	1436700	because you're still at the point
1436700	1439900	which the Windows operating
1439900	1442740	system as a group will be identified. And we can actually
1442740	1445120	perform these kind of tests
1445660	1448120	only with one packet when we do not need
1448380	1450720	all of those packets in order to do that.
1450720	1453560	So if we look at the needed solution,
1453560	1456860	then we need intelligence in scanning, we need to understand
1456860	1459580	the terrain that we operate against, and we need
1459580	1462620	the active OS fingerprinting tool to understand the quality of received
1463240	1465680	results in order to react to the received
1465680	1468260	results with proper targeted
1469860	1471720	OS detection tools.
1472600	1474680	So at the end of the day, what we're looking for
1474680	1477800	is we're looking for a tool that will have
1477800	1480240	the ability not only to perform
1481600	1483860	stack-based OS fingerprinting, the traditional
1483860	1486460	approach, but also to have the ability
1486460	1488740	to have application-based
1491060	1493620	fingerprinting tests along with the tool.
1494280	1495840	Something along the lines of...
1495840	1498800	you can't see this because it's all screwed...
1499620	1500680	something along the lines of
1501720	1505000	we send several packets, we analyze what we receive
1505000	1507760	back, we see which ports are open, what
1507760	1510840	services, what type of family of operating
1510840	1513420	system we're operating against, and then
1513840	1516860	the tool will be able to launch automatically the kind of
1516860	1520460	application-based fingerprinting
1520460	1522800	test that needs to be run against those family
1522800	1525940	of operating systems. Questions
1525940	1527240	until this point?
1528660	1530980	No questions. Okay.
1530980	1534220	So, for the past
1534220	1536920	four years, I've been one of the developers of
1536920	1539680	Xprog2, which is an active OS fingerprinting tool.
1540020	1543140	Open source, remote active OS fingerprinting
1543140	1545780	tool that you can use... I mean, if you like it, you use it.
1545780	1547080	If you don't, you don't.
1548980	1552500	The project represents our take, our beliefs,
1552500	1555020	and basically it's our fund to create it. If you use it,
1555020	1557920	great. If not, again, it's your choice.
1559000	1561040	It was voted one of the top
1561040	1564220	75 network security tools. It replaced Nmap
1564220	1566920	as the OS detection engine for Nessus after...
1567940	1569720	if you're familiar with Nessus, Nessus uses
1570380	1572840	SMB, NTP, and then it will use
1572840	1576100	the OS fingerprinting test that I found with Xprog2.
1577480	1578440	Yeah.
1583500	1585180	Unfortunately, yes. If you are
1585180	1587160	the application layer, they will play with some of those
1587980	1589280	parameters as well.
1592660	1593960	Xprog2 basically uses
1594600	1596940	less packets than any other OS fingerprinting tool.
1596940	1599680	Well, we at least try to. It does not
1599680	1601800	disturb the operation of the target system.
1602300	1605240	You can control whatever models you would like to use. And of course,
1605860	1608320	at the end of the day, if you use it in the lab against
1608320	1611480	whatever you put there, you'll see that it will give you more accurate results
1611480	1613340	than any other tool.
1614340	1616800	I'll skip this slide. Basically, what we did
1616800	1618320	along the four years.
1620220	1622960	The different software models that we have there.
1623080	1625820	Basically, we have some discovery models,
1625820	1628820	some information gathering models, and some
1629720	1631760	OS detection models, of course.
1634380	1637660	The tool has a very extensive command line options,
1637660	1641520	which I will not go into, because you didn't come for this now.
1641520	1644700	The tool is able to detect if there are obstacles
1644700	1647640	between the tool and the target system.
1647640	1650580	So, for example, if you have a proxy between you and the target system,
1650580	1652160	it is able to detect that.
1653220	1655740	And other gizmos that I will go through.
1656540	1659460	So, very fast, discovery models basically are designed
1659460	1661060	to perform host detection.
1661700	1665580	Their aim is not only to see that the host is alive,
1665580	1668920	but also to aid the automatic
1668920	1672060	receive timeout mechanism in understanding
1672060	1674760	what is the timeout that needs to be automatically selected for
1674760	1677700	the target host. This is important because when you
1677700	1682300	are scanning something, you don't want to timeout too fast on that one.
1683000	1684380	There is also a port scanner
1684380	1686980	with the tool. You can specify
1686980	1689760	ports to be scanned, either capital T or
1689760	1693660	capital U for UDP and TCP, respectively.
1693760	1695960	There are some examples for that.
1695960	1699040	So you get a list with any other tool
1699040	1701900	of the open ports, closed ports and filtered ports.
1703320	1705120	So, if you want perfect
1705120	1708140	results, you need to have an open TCP
1708140	1711340	port, a closed TCP port, a closed UDP port
1711340	1714200	and either receive replies
1714200	1717280	for echo request, timestamp request
1717280	1718600	and address request.
1720180	1723060	Before this version, we introduced another
1723060	1725780	OS fingerprinting model called ResetAct. Basically
1725780	1728520	what we do there is we send two
1729140	1732220	scenes to a closed port and we compare them.
1732220	1735040	That test actually allowed us to differentiate
1735040	1738060	between the different groups of the Linux
1738060	1741140	kernels and we can actually divide them into
1741780	1743340	seven groups.
1743780	1746560	This is a very useful tool if you need to
1747460	1750120	have the understanding if this is a 2.4
1750120	1752620	based kernel or a 2.6 based kernel and also go
1752620	1755820	inside those families of kernels and have
1755820	1758560	some information there.
1759260	1762020	Some other useful command line options
1762020	1764260	by default, if you run xprog2 with
1764260	1767760	"-v and "-b", it automatically will try to enumerate
1767760	1770760	several ports, so you don't need to
1771540	1773360	specify a port scan, you just do
1774080	1776720	lower v, uppercase B and the IP address.
1776720	1779600	You are also able to automatically generate signatures
1780920	1782980	using the capital F command line
1782980	1785380	and you can save the information using the
1785380	1788740	"-o command line".
1788740	1792000	Okay, that you can do yourself at home, you can play with it.
1794180	1795420	The version that
1795420	1797900	we are releasing today is available
1797900	1800380	for download, you can either go to my website or
1800380	1803000	directly go to our page at
1805720	1806920	sourceforge.org.
1806920	1807940	Basically what we have
1808760	1812040	is we have two new application-based
1812040	1814200	OS fingerprinting models inserted to the tool
1814200	1817160	in order to help the tool operate better
1817960	1820480	in different scanning conditions.
1820480	1824680	We also have new signatures and we also have several bug fixes.
1825180	1827440	The first app-based
1827440	1829440	OS fingerprint model that we have entered
1829440	1832720	and it's not something new, but it's good to have in a tool.
1832980	1835340	It's an SMB-based model, basically very good
1835340	1838440	against Microsoft Windows-based machines that have
1838440	1840800	their file and print sharing working.
1841380	1844440	It basically retrieves the native OS
1844440	1846140	and native Lundman parameters
1847140	1851260	from the SMB session setup and NX replies.
1851700	1853620	And it helps us differentiate between
1853620	1856320	different Windows OSes such as
1856320	1859140	Windows XP in 2003 between several
1859140	1862320	problems that we have between 2000 and XP.
1862320	1865380	And basically it allows us granularity when it comes to
1865380	1868140	Windows operating systems. So we have different
1868140	1871500	you have new keywords that you specify the information there
1871500	1874440	called SMB underscore Lundman and SMB underscore
1874440	1876960	native OS. You put the information there
1876960	1879780	it all works. This is an example
1881540	1883400	not using the SMB
1883400	1885760	model at the end of the day what you see is the results
1886400	1889280	are all mixed up. XP with 2000 and we
1889280	1891620	can't see really the differentiation.
1893100	1895480	This model works automatically when you tell the
1895480	1898260	model to use port 139 when you port scan
1898260	1901060	port 139. So you specify the minus T
1901700	1904400	139 with the command line. It's
1904400	1907340	automatically executed and at the end of the day the results are
1907340	1910340	Windows 2000 because this is a Windows 2000 service pack
1910340	1913300	for a machine. Another model
1913300	1916360	that we have inserted is SNMP based
1916360	1919140	model. Mostly it's good when
1919140	1921380	it is used against
1922440	1925460	well, those elements that use SNMP but also
1925460	1928480	when you have certain kind of
1928480	1931360	an element which is a hardware based and you want to
1931360	1933680	extract that information in order to help you
1934270	1937440	detect what's the underlying operating system.
1937440	1940140	SNMP based model. Currently only SNMP v2 is
1940140	1942440	being supported but the next version will have v1 and v3
1942440	1944840	as well. And it needs to have
1944840	1949260	UDP port 161 open in order to operate.
1949260	1951280	So this is an example with
1951280	1954620	FreeBSD 5.3. You can see if you can
1954620	1959660	look at it actually, that the SNMP
1959660	1960560	community stream was public.
1960560	1963800	There you can look at the export2.conf
1963800	1966440	and specify there and what the information was
1966440	1969000	extracted from the FreeBSD 5.3
1969400	1972500	based machine. You can see that this actually contributed
1972500	1974900	to the fact that we got FreeBSD 5.3
1975660	1978640	with 100% and the other FreeBSDs
1978640	1980720	with less percentage than that.
1981440	1984740	We have also new signatures for
1984740	1987540	the different Apple Mac OS X.
1987540	1990500	We have missed those signatures for quite a long time.
1990660	1993740	We have updated the signatures for Linux, FreeBSD and OpenBSD
1993740	1997060	and we also have fixed several bug fixes that we have with the tool.
2000120	2002640	And we would like to take the tool to
2003300	2005880	a different level by automating the scans,
2005880	2008320	by understanding the Terran, but
2008320	2011280	I guess it will take us a bit of time to do that.
2011800	2014040	Questions? Yes.
2014820	2021460	If you use SMB and SNMP
2021460	2023760	and you do port scan, you are not stealth.
2025520	2027540	Any IDS, IPS or
2028100	2030240	anything that will look for these kind of parameters
2030240	2031720	will pick you up easily.
2032900	2035860	That's the problem as well. If you are not
2036420	2038780	having the information prior, then
2039860	2041720	you cannot really be stealth.
2043040	2044080	Yes.
2051110	2052790	Any test actually
2052790	2055890	has its own weight inside
2055890	2059110	the BigPi of OS fingerprinting
2059110	2062450	tests. Each parameter has its own weight as well.
2062450	2064890	So if one of them is not being matched
2064890	2067930	or there is a problem matching that parameter
2067930	2070230	with the signature database, that will take
2070230	2073590	the percentage of hit
2073590	2076530	to be less than 100%.
2076530	2079990	One other thing that I want to mention,
2079990	2081330	this is a project that
2082510	2086470	my fellow co-authors are doing.
2086470	2088470	It's called STIF. It stands for
2088470	2091630	Security Tools Integration Framework.
2091630	2094730	It basically is a platform to automate
2094730	2097430	security analysis. You can check
2099250	2100530	that project
2100530	2103330	with the URL that is being
2103870	2106330	shown at the bottom. It's a very cool project.
2106330	2109410	Very cool guys. You should check their project as well.
2110170	2111250	Other questions?
2113150	2115090	Thank you for having me today.
2115610	2117070	Enjoy the conference.