XProbe, the Year After

Ofir Arkin explores xprobe, the year after at DEF CON 10, examining os-fingerprinting and practical defenses.

Summary

Architecture and Background

Ofir Arkin - XProbe, The Year After Xprobe, written and maintained by Fyodor Yarochkin & Ofir Arkin, is an active operating system fingerprinting tool based on Ofir Arkin's "ICMP Usage in Scanning" research project ( Last year at the Blackhat briefings, July 2001, the first generation of Xprobe was released. The tool's first generation (Xprobe v0.0.1) relies on a hard coded static-based logic tree.

Vulnerability Analysis

Although it has a lot of advantages (1-4 packets only, accurate, fast, efficient, etc.) the tool suffers from a major drawback - its logic is static. At Defcon 10 we will be releasing Xprobe2, a complete re-written active operating system fingerprinting tool with a different approach to operating system fingerprinting.

Exploitation and Demonstrations

Xprobe2 rely on fuzzy signature matching, probabilistic guesses, multiple matches simultaneously, and a signature database. As with the previous year - Don't miss the demonstration!

Remediation and Defensive Strategies

Ofir Arkin is the Founder of the Sys-Security Group ( a free computer security research body. Ofir has published several papers as well as articles and advisories. Most known are the "ICMP Usage in Scanning", and "Trace-Back" research papers. Some of his research was mentioned in professional computer security magazines. He is an active member with the Honeynet project and participated in writing the Honeynet's team book, "Know Your Enemy" published by Addison-Wesley.