COEN 252 Computer Forensics Remote Sniffer Detection Sniffer

COEN 252 Computer Forensics Remote Sniffer Detection

Sniffer Detection n On the Host n n n Look for capture files (typically big and growing). Look for a promiscuous card. Look for unauthorized connections or processes. Rootkits can prevent sniffers from being detected. n On the Net Traffic analysis n Traffic injection (probing) Much harder. n

Network based Sniffer Detection n n Promiscuous mode detection DNS tests. Network latency tests. Trapping

Network based Sniffer Detection n NIC hardware addresses n NIC sets up different filters n n Broadcast: receive all broadcast addresses (with MAC ff: ff: ff: ff) Multicast based on multicast address All multicasts Promiscuous: receive all packets.

Promiscuous mode detection n n Each Network Interface Card (NIC) has a unique Medium Access Control (MAC) address. Card in non-promiscuous mode only catches packets with that MAC address.

MAC Promiscuous Mode Detection n n Send an echo request to the right IP address but with wrong MAC address. Only a NIC in promiscuous mode will pick up something with a wrong MAC address. The “Echo Request” package is passed up the stack to the IP layer answers it.

MAC detection

ARP Detection n Send an arp request with false MAC and correct IP address. Only promiscuous NIC will pick up package. Kernel sends ARP reply.

Software Filtering Based Detection n Different OS implement filters differently. n We can try: n Fake broadcasting messages: n n FF: FF: FE (Br 47): n Last bit missing FF: 00: 00: 00: 00 (BR 16) n Only first 16 bits are the same as for broadcast. FF: 00: 00: 00: 00 (BR 8) F 0: 00: 00: 00: 00 (BR 4)

Software Filtering Based Detection n Different OS implement filters differently. n We can try: n Fake multicasting messages: n n n 01: 00: 00: 00: 00 (Gr) n Only group-bit set. 01: 00: 5 E: 00: 00: 00 (M 0) n Multicast address zero is usually not used 01: 00: 5 E: 00: 00: 01 (M 1)(assigned to all) n Multicast address one should be received by all in the test system 01: 00: 5 E: 00: 00: 02 (M 2)(assigned to different set of nodes) n Multicast address two should not be received by systems in the test group. 01: 00: 5 E: 00: 00: 03 (M 3)(not registered)

Software Filtering Based Detection Windows XP Win. ME / 9 x Win 2 K/NT Linux 2. 4. x Free BSD 5. 0 B 47 -- X -- X B 16 -- X X X -- X B 8 -- -- -- X Gr -- -- X M 0 -- -- X M 1 O O O O O M 2 -- -- X M 3 -- -- X Response to various ARP requests. Normal mode: left column, promiscuous mode: right column O legal response, X illegal response, -- no response

Software Filtering Based Detection n ARP requests to fake MAC addresses can determine promiscuous cards in an OS dependent manner. Trabelsi, Rahmani, Kaouech, Frikha: Malicious Sniffing Systems Detection Platform, SAINT ’ 04.

DNS Detection Technique n n Password sniffers (or sniffers not in stealth mode) generate network traffic. Sniffers use reverse DNS lookup n n Because they think they found a password and want to know the system. Because they want to provide the user with the name of the machines.

DNS Detection Technique

Load Detection Technique n n n Sniffers are hard on the machine resources. Sniffer degrades performance when there is a lot of network load. Hence, generate lots of network load and measure timing.

Load Detection Technique

Round Trip Time Measuring Technique n Experiments show: n n n Round Trip Times show OS dependent differences of 10% - 40% between normal mode and promiscuous mode. Allows reliable detection. Using ICMP messages is less network load dependent.

Bait Technique n Create telnet for a fake telnet server. With lots of logins + passwords. Sniffer takes bait. Telnet attempts to non-existing server. n Works like a honey-pot. n n n