Presentation Plan

• Device fingerprinting, passive fingerprinting, DHCP fingerprinting
• Defensive use cases
• Offensive use cases
• FingerBank announcement
• FingerBank's future

Who I am

Olivier Bilodeau

• System architect working at Inverse inc
• PacketFence lead developer since 2009
• Teaching InfoSec to undergraduate in Montreal
• ...
• new father, Open Source nuts, enjoying CTFs a lot, android developer, brewing beer

Social stuff

• twitter: @packetfence / identi.ca: @plaxx
• delicious: plaxxx / linkedin: olivier.bilodeau

Device fingerprinting reminder

Identifies software or hardware components

Various types

• Operating Systems
• Devices
• Browsers
• Web Server
• Web Applications

Two approaches of gathering fingerprints

• Active
  • Pros: On demand
  • Cons: Detectable, sometimes intrusive
• Passive
  • Pros: Stealth
  • Cons: not on demand

Passive fingerprinting reminder

• Networks are really noisy
• Some protocols use broadcast
• Sometimes you are in between
• Just wait for the goods to come to you
• Fingerprinting on the LAN...
• mDNS, TCP, ARP, DHCP, ...
• Fingerprinting on the WAN...
• honeypots, firewall, routers

DHCP Fingerprinting reminder

• DHCP
  • broadcast-based
  • on every LAN segment
• aggregation infrastructure: IP Helpers (UDP Helper Address), easy to collect centrally
• Just add one helper to point to your fingerprinting tool

• DHCP fingerprints
  • Easy to collect
  • broadcast remember?
  • Rarely spoofed
  • well, since you're here: it's controlled by /etc/dhclient.conf

DHCP Fingerprinting reminder (contd.)

DHCP Elements to fingerprint

• DHCP retransmission timing
• Several problems: RFC not followed (2^x delayification) actual vs in packet differs invalid secs field user (1 sec == 256)
• IP TTL on DHCP packets
• Problems: Some relay implementation will modify the TTL
• DHCP Options (55: requested parameters, 60: vendor id, ...)
• Option 60 even misleading sometimes. Win ME labeled as MSFT98
• Number and order of option 55 is particularly precise and interesting
• PF: what we use and it's quite reliable
• Satori's format does more

See the slides of the Using DHCP for Passive OS Identification by David LaPorte and Eric Kollman at BlackHat Japan 2007 presentation for more details on the topic.

URL in the last slide

DHCP Fingerprinting reminder (contd.)

With simple option 55 fingerprints

• 160 different and unique OS / devices identified
• Covering
  • Traditional OS (Win, Mac, Linuxes, Unixes)
  • Corporate devices (VoIP, Printers, Routers, APs, Storage)
  • Consumers devices (Home routers, Gaming consoles, smartphones, tablets)
  • ...
  • thin clients, UPS, inventory tools, flukes, etc.
  • switches fingerprint! who uses DHCP for that?
• Some overlap (Vista or Win7 / iPhone or iPad)
• Some clashes (Blackberry, OEM Wireless Router)

Defensive Use Cases

• Easy LAN Operating System Inventory
  • Even more powerful if IP-Helpers use DHCP Option 82
  • Cisco stuff that adds switchport/vlan info to dhcp in transit
  
• Firewall / NAC integration to blacklist end-of-life OS
  • ex: Win 2000 and earlier

or BackTrack? but not sure if we have that

PacketFence does this

p0f has been integrated into pf (firewall) to do a similar thing

• NAC integration to automatically allow dumb devices (shh!)

Like printers, VoIP, and any other browser-less IP device. Yes, it's stupid since it's client controlled but users find it sooo convenient.

Note to pentesters: We [PacketFence] are not the only ones doing this. Avoid at least the backtrack fingerprint and mimic a Win32 one!

Offensive Use Cases

• Stealth LAN Recon!

Identify OS and IPs on the same segment as you are

Delivery joke

• ...
• Any other ideas?

Why FingerBank?

• There are User-Agent databases out there
• There are snort signature databases out there
• What about DHCP Fingerprints?
• Consolidate information hidden in silos
• well, yes they were already open databases but hidden in other projects

• Regroup communities that would benefit from sharing this information
• Raise awareness about this easy to use technique
• ... we have a ton of anonymous fingerprints we need help identify

What is FingerBank?

A website dedicated to sharing DHCP fingerprint and tools.

• Two extensive DHCP fingerprint databases (PacketFence, Satori)
• DHCP fingerprinting tools
• for now, Satori (win-based) and PF's own pfdhcplistener (badly integrated at the moment)
• A community (mailing list)

Who's backing FingerBank?

• Eric Kollman - Satori
• doing the research
• David LaPorte - PacketFence original founder
• original idea
• Olivier Bilodeau - PacketFence lead developer
• Inverse inc.
• for allowing me to work on this at work

FingerBank's future

Based on community participation

• Improve fingerprint sharing tools
• Consolidate data formats
• Room for new / better tools
• including a pentester oriented one
• Support and share about new passive fingerprint types?
• fingerbank: generic name
• we'll see

References

• DHCP Fingerprinting
  • Using DHCP for Passive OS Identification, BlackHat Japan 2007, David LaPorte, Eric Kollmann, http://myweb.cableone.net/xnih/download/bh-japan-laporte-kollmann-v8.ppt
• Users of current DHCP Fingerprint databases
  • PacketFence, http://www.packetfence.org
  • Satori, http://myweb.cableone.net/xnih/
• Other fingerprinting tools
  • nmap, http://www.nmap.org/
  • Blind Elephant, Web Application Fingerprinter, http://blindelephant.sourceforge.net/
  • p0f, Passive TCP/IP fingerprinting, http://lcamtuf.coredump.cx/p0f.shtml
  • SinFP, Active or Passive TCP/IP fingerprinting, http://www.gomor.org/bin/view/Sinfp/WebHome
  • Fingerprinting within OpenBSD's PF, http://www.w4g.org/fingerprinting.html
• Inspiration
  • Browser ID Strings, http://www.zytrax.com/tech/web/browser_ids.htm
  • Emerging Threats, http://www.emergingthreats.net