IpMorph: fingerprinting spoofing unification

Abstract

There is nowadays a wide range of TCP/IP stack identification tools that allow to easily recognize the operating system of foreseen targets. The object of this article is to show that fingerprint concealment and spoofing are uniformly possible against different known fingerprinting tools. We present IpMorph, counter-recognition software implemented as a user-mode TCP/IP stack, ensuring session monitoring and on the fly packets re-writing. We detail its operation and use against tools like Nmap, Xprobe2, Ring2, SinFP and p0f, and we evaluate its efficiency thanks to a first technical implementation that already covers most of our objectives.

Unsupervised Clustering Under Temporal Feature Volatility in Network Stack Fingerprinting

“…where 1 is an indicator variable and Using WolframAlpha's integral solver [32] yields (22). Replacing Hershel's p(δ|δ , X ) with (22) and keeping the rest of the method unchanged gives rise to a technique we call Hershel+.…”

“…Replacing Hershel's p(δ|δ , X ) with (22) and keeping the rest of the method unchanged gives rise to a technique we call Hershel+. Our next step is to verify that its accuracy is no worse than that of Hershel even when the assumed Erlang model for T , which uses ν = 4 in all computation below, does not match the true distribution.…”

“…Assuming a is a measurement from some IP, (21)- (22) can be used to obtain similarity score p(a|A j , X ) for each OS j, the highest of which is selected as the match after normaliza- tion. Fig.…”

Hershel

“…A similar direction is to deploy network honeypots [35], [49] or standalone systems [51] that spoof arbitrary operating systems and their services. Placing obfuscation into the network gives rise to intermediate devices known as fingerprint scrubbers [34], [43].…”

“…Besides user interference, vector uj may be modified by intermediate devices along the path (e.g., NAT, IDS, fingerprint scrubbers [10], [34], [40], [43], [51]), whose actions can be clumped under the same umbrella of (16). Since buffering packets for periods of time comparable to RTO (i.e., 3 − 6 seconds) and per-flow state are expensive, it is often safe to assume that these devices do not alter the RTO pattern in significant ways and thus leave enough features by which the OS can still be identified.…”