Using system fingerprints to track attackers

Using system fingerprints

totrack

attackers

Using system fingerprints

totrack

attackersLance Cottrell

Ntrepid/Anonymizer

When You Are Under Attack

You may ask:

Who was that masked man?

As a Defender, You See...

IP: 37.123.118.67Lat / Long: +54 / -2Country: UKPing: 110msISP: as13213.net (AKA UK2.net) server hostingOpen Ports: SSH, HTTP

Is THIS Really the Attacker?

Which is the “Real” Attacker?

It’s Turtles All the Way Down

What If You Could Spot People Hiding?

Block Web Access

Redirect to Honeypot

Add Firewall Rule

Deny Credit Card

Flag in Logs

NOTRESPASSING

DETOUR

What If You Could Identify Your Attacker?

How Do They Hide?

Proxies

Chained VPNs / TOR

Botnets / Compromised Hosts

Tradecraft

How Can You Spot Them?

Known Anonymous IP

Anon IPs are well known

Open Proxy / Ports

Obviously not a home PC

Non-Consumer IP

Identifying non-consumer IP

9 xe-0-3-0-5.r04.lsanca03.us.bb.gin.ntt.net (129.250.9.229) 1.555 ms xe-0-3-0-3.r04.lsanca03.us.bb.gin.ntt.net (129.250.9.201) 1.545 ms 4.888 ms

10 ae-3.r05.lsanca03.us.bb.gin.ntt.net (129.250.2.221) 1.429 ms 1.514 ms 1.465 ms

VS13 te-18-10-cdn04.windsor.ca.sfba.comcast.net (68.85.101.34) 27.851 ms 32.571 ms 29.858 ms

14 c-98-248-25-27.hsd1.ca.comcast.net (98.248.25.27) 25.532 ms !X 25.736 ms !X 28.775 ms !X

Latency vs. Ping Time

HTTP / Javascript

DHCP Ping

DNS Mismatch

HTTP from Chicago

DNS from Nigeria

Identify the Attacker

Identity Leakage

Embedded Media

Apps bypass proxy / VPN

Phone home

Fortunately (for you),

Good OPSEC is HardTools can be slow and cumbersome

May go direct for “innocent” activity / reconnaissance

May forget to use it

Accidentally cross the streams of personas

Correlate attacker print with all previous activity

Cookies and Bugs

Browser Fingerprints

Fingerprint Entropy

12.3 - User Agent

5.4 - HTTP_ACCEPT Headers

21.9+ - Browser Plugin Details

5.0 - Time Zone

7.5 - Screen Size and Color Depth

21.9 - System Fonts

0.4 - Cookie Test

0.9 - Super Cookie Test

Attacker Use of Virtualization

Advantages Disadvantages

Easy to Clean Cloned Each Time

No Cookies or Super-Cookies

Too Clean or Outdated Cruft

Detection as VM Requires Local Execution

Can Be Detected as VM

Dread Pirate Roberts

Why Should YOU be StealthyLurk in IRC and Forums

Discover Plans

Learn Techniques

Hide your interest & activity

Bait Honeypots

Drop False Leads and Links

Government

Has Other More Aggressive Options26

Thanks

Contact me at:

Email: lance.cottrell@ntrepidcorp.com

Commercial / Gov: http://ntrepidcorp.com

Consumer: http://anonymizer.com

Blog: http://theprivacyblog.com

Twitter: @LanceCottrell

LinkedIn: http://linkedin.com/in/LanceCottrell

Using system fingerprints to track attackers

Technology

Transcript of Using system fingerprints to track attackers

Fingerprints. Chapter 4 Fingerprints 2 Kendall/Hunt Publishing Company 2 You will understand: Why fingerprints are individual evidence. Why there may.

Fingerprints of Faith - Securing Today and Capturing Tomorrowd1274fqh34kz8u.cloudfront.net/.../Fingerprints-of...Fingerprints of Faith - Securing Today and Capturing Tomorrow ... reach

“Fingerprints cannot lie, but liars can make fingerprints.” —Unknown.

Fingerprints have been used since 1901 Fingerprints? DNA Fingerprints ! DNA Fingerprints since 1986.

Chapter 4: Fingerprints: History and Anatomy “Fingerprints can not lie, but liars can make fingerprints.” —Unknown.

Puddinhead Fingerprints

Reading Fingerprints

Fingerprints. The Study of Fingerprints: Dactyloscopy.

Fingerprints Forensic Science Al Capone’s Fingerprints.

Altered Fingerprints

Chapter 4 Intro to Fingerprints “Fingerprints cannot lie, but liars can make fingerprints.” —Unknown.

Fingerprints “Fingerprints can not lie, but liars can make fingerprints.” —Unknown.

Mining attackers mind

Dealing With Attackers

LATENT FINGERPRINTS. Latent Prints Fingerprints identification uses the distinctive ridges found on the tips of our fingers. 1. Known fingerprints A.

Fingerprints Overview

Detecting Altered Fingerprints - Biometricsbiometrics.cse.msu.edu/Publications/Fingerprint/...altered fingerprints) of the first 1,000 fingerprints in SD4 are used to train LIBSVM

Fingerprints (1)

Identifying Fingerprints

FINGERPRINTS. Wednesday - 10/19/11 Objective: To describe the characteristics of fingerprints Do Now: Are fingerprints considered class or individual.