|
|
发表于 2004-1-9 16:50:27
|
显示全部楼层
http://project.honeynet.org/papers/finger/
Notice the following paragraph in this paper:
Passive fingerprinting can be used for several other purposes. It can be used by the bad guys as 'stealthy' fingerprinting. For example, to determine the Operating System of a 'potential victim', such as a webserver, one only needs to request a webpage from the server, then analyze the sniffer traces. This bypasses the need for using an active tool that can be detected by various IDS systems. Also, Passive Fingerprinting may be used to identify remote proxy firewalls. Since proxy firewalls rebuild connection for clients, it may be possible to ID the proxy firewalls based on the signatures we have discussed. Organizations can use Passive Fingerprinting to identify 'rogue' systems on their network. These would be systems that are not authorized on the network. For example, a Microsoft or Sun shop can quickly identify 'rogue' Linux or FreeBSD systems that mysteriously appeared on their network. Passive Fingerprinting can be used to quickly inventory an organizations operating systems without touching or imapcting any systems or network performance. You would be surprised how may organizations do not know what systems they have on their internal network. For individuals conducting security assessment, Passive Fingerprinting also allows one to quickly identify critical systems (such as Unisys Mainframe). This method can also be used to identify rogue or unautorized systetms or OS types within an organization, a possible indication of 'blackhat' activity. |
|