Information Security - ajou.ac.kr

12
Information Security Taeshik Shon

Transcript of Information Security - ajou.ac.kr

Page 1: Information Security - ajou.ac.kr

Information Security

Taeshik Shon

Page 2: Information Security - ajou.ac.kr

OS Fingerprinting….

Packet Filtering in Intrusion Detection

Page 3: Information Security - ajou.ac.kr

babylon~> telnet hpux.u-aizu.ac.jpTrying 163.143.103.12 ... Connected to hpux.u-aizu.ac.jp.Escape character is '^]'.

HP-UX hpux B.10.01 A 9000/715 (ttyp2)

login:

Active OS Fingerprinting(old school)

Page 4: Information Security - ajou.ac.kr

babylon> telnet ftp.netscape.com 21Trying 207.200.74.26 ...Connected to ftp.netscape.com.Escape character is '^]'.220 ftp29 FTP server ready.SYST215 UNIX Type: L8 Version: SUNOS

Active OS Fingerprinting(old school, a bit more advanced)

Page 5: Information Security - ajou.ac.kr

babylon> echo 'GET / HTTP/1.0\n' | nc hotbot.com 80 | egrep '^Server:‘

Server: Microsoft-IIS/4.0babylon>

Here, we send a HTTP GET request to a remote server, and observe the webserver software which is identified in the response.

Active OS Fingerprinting(old school, last example)

Page 6: Information Security - ajou.ac.kr

• Sys admins usually turn the login banner OS announce off.

• Applications can be configured to lie.• What we really need is a solution that doesn’t

depend upon the honesty of the application.• Enter: New School Active OS Fingerprinting

Downsides to the old school method

Page 7: Information Security - ajou.ac.kr

• Pioneered by Queso, a now defunct tool, and improved upon by the widely popular nmap.

• Described by Nmap’s author, Fyodor, in his paper “Remote OS detection via TCP/IP Stack FingerPrinting”, October 18, 1998

• http://www.insecure.org/nmap/nmap-fingerprinting-article.html

New school active Fingerprinting

Page 8: Information Security - ajou.ac.kr

• His basic idea was to send a specially crafted packet, usually with an invalid/strange set of options (which is where OS vendors usually differ in implementation), and see what happens.

• He uses several methods, none of which individually identify the remote OS, but combined together will give you a good idea.

Fyodor’s fingerprint method

Page 9: Information Security - ajou.ac.kr

• The FIN probe -- Send a FIN packet (or any packet without an ACK or SYN flag) to an open port and wait for a response.

• The correct RFC 793 behavior is to NOT respond, but many broken implementations such as MS Windows, BSDI, CISCO, and IRIX send a RESET back.

Methods used by Nmap

Page 10: Information Security - ajou.ac.kr

• IPID sampling -- Most operating systems increment a system-wide IPID value for each packet they send. Others, such as OpenBSD, use a random IPID and some systems (like Linux) use an IPID of 0 in many cases where the "Don't Fragment" bit is not set. Windows does not put the IPID in network byte order, so it increments by 256 for each packet.

• Remember that it was the predictability of the IPID field which Bellovin used in his paper “A technique for counting NATted hosts”.

Methods used by Nmap

Page 11: Information Security - ajou.ac.kr

• TCP Initial Window -- This simply involves checking the window size on returned packets. This test actually gives us a lot of information, since some operating systems can be uniquely identified by the window alone

• AIX is the only OS which uses 0x3F25

• In their "completely rewritten" TCP stack for NT5, Microsoft uses 0x402E.

• Interestingly, that is exactly the number used by OpenBSD and FreeBSD.

Methods used by Nmap

Page 12: Information Security - ajou.ac.kr

Q&A


Information technology — Security techniques — Information security … · Information technology — Security techniques — Information security for supplier relationships —

Information technology — Security techniques — Information security … · Information technology — Security techniques — Information security for supplier relationships —

Information Security Information Security Management · PDF fileInformation Security Information Security Management Framework Standard Agencies must develop an Information Security

Information Security Information Security Management · PDF fileInformation Security Information Security Management Framework Standard Agencies must develop an Information Security

2009. 05. Hanjo Lim School of Electrical & Computer Engineering hanjolim @ajou.ac.kr

2009. 05. Hanjo Lim School of Electrical & Computer Engineering hanjolim @ajou.ac.kr

Information Security - Information Classification · PDF fileInformation Security - Information Classification . ... on and recommending information security standards on data classification.

Information Security - Information Classification · PDF fileInformation Security - Information Classification . ... on and recommending information security standards on data classification.

Information Security Policy - British Columbia · Information Security Program, headed by the Chief Information Security Officer, as the Executive Director of the Information Security

Information Security Policy - British Columbia · Information Security Program, headed by the Chief Information Security Officer, as the Executive Director of the Information Security

Cyber Security Specialist Information Security • Cyber ... · Cyber Security • Security Analyst • Cyber Security Specialist Information Security • Cyber Operations Manager

Cyber Security Specialist Information Security • Cyber ... · Cyber Security • Security Analyst • Cyber Security Specialist Information Security • Cyber Operations Manager

Information Security & Identity Theft - Banking with … · Information Security & Identity Theft What is Information Security? (continued) ® Information Security Core Principles

Information Security & Identity Theft - Banking with … · Information Security & Identity Theft What is Information Security? (continued) ® Information Security Core Principles

Information technology – Security techniques – Information ... · INTERNATIONAL STANDARD ISO/IEC 27005 Information technology – Security techniques – Information security

Information technology – Security techniques – Information ... · INTERNATIONAL STANDARD ISO/IEC 27005 Information technology – Security techniques – Information security

Information Technology Information and Systems Security/Compliance Information Security

Information Technology Information and Systems Security/Compliance Information Security

Certified Information Systems Security … Information Systems Security Professional (CISSP) Course 1 - Information Security and Risk Management

Certified Information Systems Security … Information Systems Security Professional (CISSP) Course 1 - Information Security and Risk Management

Information security in general practice...Information security in general practice 3Practice information security policies Polices should be created to support information security

Information security in general practice...Information security in general practice 3Practice information security policies Polices should be created to support information security

Information Security Awareness Training. Agenda What is Information Security? Information Ecosystem C-I-A Godrej & Boyce Information Security Organization.

Information Security Awareness Training. Agenda What is Information Security? Information Ecosystem C-I-A Godrej & Boyce Information Security Organization.

Heterogeneity-aware Ad hoc Networking [Routing Perspective] Dr. Young-Bae Ko (youngko@ajou.ac.kr) Dept. of Information and Computer Engineering Ajou University.

Heterogeneity-aware Ad hoc Networking [Routing Perspective] Dr. Young-Bae Ko ([email protected]) Dept. of Information and Computer Engineering Ajou University.

Information Security What is Information Security?

Information Security What is Information Security?

Disclaimer - ajou.ac.kr

Disclaimer - ajou.ac.kr

Admission of Foreign Students - ajou.ac.kr · PDF filee-government homepage for Foreigners ... System Engineering gnwang@ajou.ac.kr ... Admission of Foreign Students Graduate School

Admission of Foreign Students - ajou.ac.kr · PDF filee-government homepage for Foreigners ... System Engineering [email protected] ... Admission of Foreign Students Graduate School

Handbook AS-805 - Information Security - November 2019 · 2-2.21 Manager, Corporate Information Security Office Information Systems Security. information security. Service. Service.

Handbook AS-805 - Information Security - November 2019 · 2-2.21 Manager, Corporate Information Security Office Information Systems Security. information security. Service. Service.

Information Security Management System.€¦ · Information Security Management System. Information Security at Bühler. V1.0, March 2020. 2 Information Cyber Security at Bühler.

Information Security Management System.€¦ · Information Security Management System. Information Security at Bühler. V1.0, March 2020. 2 Information Cyber Security at Bühler.

Information Security 1 Information Security: Demo of Some Security Tools Jeffy Mwakalinga.

Information Security 1 Information Security: Demo of Some Security Tools Jeffy Mwakalinga.

Information Security Trends The Information Security Process Information Security Trends Emiliano Kargieman ek@corest.com.

Information Security Trends The Information Security Process Information Security Trends Emiliano Kargieman [email protected].