WEBVTT 00:00.450 --> 00:07.380 One of the issues that we need to prepare ourselves for is the fact that during the reconnaissance phase, 00:07.380 --> 00:14.640 there's going to be typically a very concerted effort to discover the operating systems that are in 00:14.640 --> 00:16.320 play in your infrastructure. 00:17.070 --> 00:21.870 Operating system discovery is also known as banner grabbing. 00:22.110 --> 00:31.770 This is grabbing the information in like banner messages and this kind of verbiage, which isn't so 00:31.770 --> 00:32.670 common anymore. 00:33.240 --> 00:38.860 As far as the actual banner that some operating system is giving its version and stuff like that. 00:38.880 --> 00:44.760 But the concept of banner grabbing is still how we refer to operating system discovery. 00:45.210 --> 00:48.330 So it's good to know it as banner grabbing as well. 00:48.540 --> 00:52.590 And we divide this into active and passive active. 00:52.620 --> 01:02.610 Banner grabbing is the art of sending certain messages to devices, knowing how operating systems are 01:02.610 --> 01:03.720 going to respond. 01:03.930 --> 01:11.520 Now, once again, active here is great as far as the information we're going to receive, but it is 01:11.520 --> 01:14.130 bad as far as being detected. 01:14.370 --> 01:21.930 If we're engaging in active, you know, manipulation of traffic to the device in analysis of that traffic, 01:21.930 --> 01:23.010 we can get caught. 01:23.430 --> 01:31.200 What's sneakier and more problematic for us is passive banner grabbing, where they're able to figure 01:31.200 --> 01:39.000 out what operating system we're running from, error messages or sniffing or page extensions. 01:39.240 --> 01:43.650 In fact, in a moment, I'll go ahead and show you in fact, I'll show it to you. 01:43.650 --> 01:51.570 Next, how I gleaned information from an error message lately, not necessarily about the operating 01:51.570 --> 01:53.780 system, but about the technology used. 01:53.790 --> 01:54.420 Let me show you. 01:55.080 --> 02:01.420 So look at this error message that I received on a inside of a mobile application. 02:01.440 --> 02:02.170 Check this out. 02:02.190 --> 02:04.380 So I went to pay. 02:04.620 --> 02:04.950 All right? 02:04.950 --> 02:11.160 I went to transfer money and notice cloud front wasn't able to connect to the origin. 02:11.730 --> 02:15.060 So we get this cloud front information. 02:15.270 --> 02:17.010 And what is cloud from? 02:17.010 --> 02:21.570 Cloud front is the caching service used by AWB. 02:21.960 --> 02:28.770 So you can clearly see we're gleaning information here from an error message that's giving us great 02:28.770 --> 02:32.790 detail into the exact technologies that are used. 02:32.910 --> 02:34.170 This is not good. 02:35.010 --> 02:41.850 Now something that we also need to be aware of is the fact that in a very passive way. 02:42.090 --> 02:49.770 So passive banner grabbing, we can have attackers determine what operating system we're using from 02:49.770 --> 02:50.520 clues. 02:50.790 --> 02:58.230 For instance, the time to live and window sizes are going to really give clues as to an operating system. 02:58.620 --> 03:07.230 Google Linux will be using a time to live in packets of 64 with a window size of 5720, where an iOS 03:07.230 --> 03:15.600 router would be using time to live values at 255 in a window size of 41 and 28 or 4128. 03:15.810 --> 03:17.070 So you get the idea. 03:17.280 --> 03:25.110 Attackers can enumerate what they are dealing with as far as an OS goes from these time to live values 03:25.350 --> 03:26.970 and window sizes. 03:27.270 --> 03:33.840 And let's not forget that there are tools out there that can be helpful to us when we're trying to document 03:33.840 --> 03:34.620 our own network. 03:34.800 --> 03:37.920 But in the hands of attackers, they can be vicious. 03:38.190 --> 03:42.030 They'll map out the entire network topology. 03:42.030 --> 03:48.240 There's network topology mapper as an example product, but we've seen already where something like 03:48.240 --> 03:52.860 an end map can build you a nice map of your topology. 03:53.100 --> 03:53.880 Pretty scary. 03:54.540 --> 04:00.690 Well, what would you do to counteract the OS footprint against you? 04:00.930 --> 04:07.590 Well, a lot of companies will run tools that will even help them give false banner information. 04:07.680 --> 04:15.150 So they will really throw attackers off by making their Linux box look like a Windows server. 04:15.150 --> 04:19.920 You can only imagine how difficult that would be for an attacker if they had that wrong. 04:20.310 --> 04:24.690 Also, we this is a tried and true technique. 04:24.900 --> 04:32.580 You need to go to all of your devices, I mean, all of your network devices, and you need to kill 04:32.580 --> 04:34.500 off unnecessary services. 04:34.890 --> 04:40.890 This is a primary step in what we call device hardening, and it's what we should be doing. 04:41.190 --> 04:48.780 There shouldn't be services there that we don't need that increases what we call the attack service. 04:49.080 --> 04:55.500 And a lot of times we'll need to go in and disable detailed reporting capabilities and things of that 04:55.500 --> 04:59.160 nature that will give too much information. 04:59.810 --> 05:03.260 Our operating systems or software that we have in place. 05:03.860 --> 05:11.180 So, yes, there is a lot of information that can be scanned and determined about your network. 05:11.330 --> 05:17.090 We're seeing it step by step and we're seeing how there are going to be great countermeasures that we 05:17.090 --> 05:18.020 can put in place. 05:18.320 --> 05:19.130 Thank goodness.