Security threats Toolkit
Story: Protect your network from slow scanning
Slow Scan HoneyNet detection via time stamp enumeration
Mike,
"The smartest attackers will always try to come in under your detection radar. "
Yup and one little attack you may not be aware of can be used to detect HoneyNets and therefore avoid them.
Put simply you can look at network time stamps and do a delta on them that effectivly shows changes in the CPU frequency of a system.
Due to resource limitations a lot of HoneyNets use virtualisation techniques to make a small number of machines look like a whole network of them (VMware etc). The problem is that all the virtual machine on the same hardware have exactly the same CPU clock therefore their network time stamps are related...
A couple of simple apparently brain dead script kiddy network scans will show up network addresses that appear to have the same time stamps.
Using this information alone may well show that enough of the network addresses are running on the same machine to make a very experianced attacker very cautious.
A more cautious attack would use the initial brain dead scan to identify possible suspect networks (ie if it don't get blocked then it could be a HoneyNet) or those with low security. The next problem is to identify if it is a sheep or a wolf.
IF you make time spaced network scans for the time stamps you can cross corelate them to show which have independant time stamps in their delta functions (that is change rate not absolut values).
Obviously virtual machines would show almost identical deltas including those due to load variation (more heat in the box changes cap value on CPU clock XTAL).
If any machines on the network show a high index of coincidence on their delta functions then the network is suspect, the more that show coincidence the higher the probability it is a wolf (ie a Honey net).
So your experianced attacker will take his day zero attack somewhere else to prolong it's usefulness, or sale value for Malware purposes.
Regards,
Clive Robinson
P.S. if you want to know more have a look on,
http://www.schneier.com/blog/archives/2006/10/hackercontrolle.html#c122018
or
http://www.lightbluetouchpaper.org/2006/09/04/hot-or-not-revealing-hidden-services-by-their-clock-skew/
Full Talkback thread
