A few more fingerprinting techniques - time and netmask

[danderse () CS UTAH EDU (David G. Andersen)]

The release of nmap reminded me about some work I did a while ago for
yet-more-information-gathering-programs, and I thought it might be
interesting from the perspective of fingerprinting.  Various systems
handle ICMP queries in improper ways for time and netmask requests.
I discussed some of these in a bulletin I didn't bother publically
announcing (http://www.angio.net/consult/secadv/AA-1997-09-02.address-mask)
and they're somewhat relevant here.

(They're also kind of fun for figuring out if places are firewalled,
if links are point to point, if they run time synchronization, etc.)

System          ICMP Time       ICMP Mask

Windows         no              yes
FreeBSD         yes             no
Linux 1.x       yes             yes
Linux 2.x       yes             no
SunOS           yes             yes
Solaris         yes             yes
HPUX            yes             yes
Older IRIX      yes             yes
Newer IRIX      yes             no
MacOS - MacTCP  ?               no
MacOS - TCP/IP  ?               yes?
Apple Internet Server           yes

On some operating systems, these aren't the best ways for
fingerprinting, because they are configurable - FreeBSD and Solaris
allow you to control the behavior, for instance, and I'm sure other
systems may as well.

I asked CERT to send some of the information on to vendors last year
(since responding to ICMP Mask requests when you're not a router is a
violation of the host requirements RFC), but it's not really a high
priority issue. ;-)

Demonstration programs for these (I've only tested them on FreeBSD)
can be found at:

http://www.angio.net/security/icmptime.c
http://www.angio.net/security/icmpmask.c

Sample output:

torrey# ./icmptime www.yahoo.com www.freebsd.org www.netbsd.org www.openbsd.org
www.yahoo.com:  Mon Dec 28 16:13:06 1998
www.freebsd.org:  Mon Dec 28 16:13:14 1998
www.netbsd.org:  Mon Dec 28 16:13:05 1998
www.openbsd.org:  Mon Dec 28 16:13:10 1998

(real time was 16:13:06)

torrey# ./icmpmask www.cisco.com www.bay.com www.nytimes.com
www.cisco.com:  0xFFFFFFE0
www.bay.com:  0xFFFFFFE0
www.nytimes.com:  0xFFFFFF00

  -Dave

--
work: danderse () cs utah edu                     me:  angio () pobox com
      University of Utah                            http://www.angio.net/
      Computer Science - Flux Research Group