One of the issues that we need to prepare ourselves for is the fact that during the reconnaissance phase,
there's going to be typically a very concerted effort to discover the operating systems that are in
play in your infrastructure.
Operating system discovery is also known as banner grabbing.
This is grabbing the information in like banner messages and this kind of verbiage, which isn't so
common anymore.
As far as the actual banner that some operating system is giving its version and stuff like that.
But the concept of banner grabbing is still how we refer to operating system discovery.
So it's good to know it as banner grabbing as well.
And we divide this into active and passive active.
Banner grabbing is the art of sending certain messages to devices, knowing how operating systems are
going to respond.
Now, once again, active here is great as far as the information we're going to receive, but it is
bad as far as being detected.
If we're engaging in active, you know, manipulation of traffic to the device in analysis of that traffic,
we can get caught.
What's sneakier and more problematic for us is passive banner grabbing, where they're able to figure
out what operating system we're running from, error messages or sniffing or page extensions.
In fact, in a moment, I'll go ahead and show you in fact, I'll show it to you.
Next, how I gleaned information from an error message lately, not necessarily about the operating
system, but about the technology used.
Let me show you.
So look at this error message that I received on a inside of a mobile application.
Check this out.
So I went to pay.
All right?
I went to transfer money and notice cloud front wasn't able to connect to the origin.
So we get this cloud front information.
And what is cloud from?
Cloud front is the caching service used by AWB.
So you can clearly see we're gleaning information here from an error message that's giving us great
detail into the exact technologies that are used.
This is not good.
Now something that we also need to be aware of is the fact that in a very passive way.
So passive banner grabbing, we can have attackers determine what operating system we're using from
clues.
For instance, the time to live and window sizes are going to really give clues as to an operating system.
Google Linux will be using a time to live in packets of 64 with a window size of 5720, where an iOS
router would be using time to live values at 255 in a window size of 41 and 28 or 4128.
So you get the idea.
Attackers can enumerate what they are dealing with as far as an OS goes from these time to live values
and window sizes.
And let's not forget that there are tools out there that can be helpful to us when we're trying to document
our own network.
But in the hands of attackers, they can be vicious.
They'll map out the entire network topology.
There's network topology mapper as an example product, but we've seen already where something like
an end map can build you a nice map of your topology.
Pretty scary.
Well, what would you do to counteract the OS footprint against you?
Well, a lot of companies will run tools that will even help them give false banner information.
So they will really throw attackers off by making their Linux box look like a Windows server.
You can only imagine how difficult that would be for an attacker if they had that wrong.
Also, we this is a tried and true technique.
You need to go to all of your devices, I mean, all of your network devices, and you need to kill
off unnecessary services.
This is a primary step in what we call device hardening, and it's what we should be doing.
There shouldn't be services there that we don't need that increases what we call the attack service.
And a lot of times we'll need to go in and disable detailed reporting capabilities and things of that
nature that will give too much information.
Our operating systems or software that we have in place.
So, yes, there is a lot of information that can be scanned and determined about your network.
We're seeing it step by step and we're seeing how there are going to be great countermeasures that we
can put in place.
Thank goodness.