Remote Physical Device Fingerprinting Authors: Tadayoshi Kohno, Andre Broido, KC Claffy Presented: IEEE Symposium on Security and Privacy, 2005 Kishore Padma Raju

OUTLINE 1. Introduction and Prerequisites 2. Techniques 3. Investigations 4. Applications 5. Conclusion 6.Strengths and Weaknesses

Introduction and Prerequisites Fingerprinting – Fingerprinter – fingerprintee There are a number of reliable techniques for remote operating system fingerprinting – nmap – Xprobe One step further: remotely fingerprint a physical device without that device's known cooperation

Introduction and Prerequisites Three different techniques – Active fingerprinting Fingerprinter initiates the connection – Semi passive After fingerprintee initiates the connection fingerprinter interacts – Passive Observes traffic from fingerprintee

Introduction and Prerequisites Parameter(microscopic deviations in device) – Clock skew A standard clock circuit uses crystal oscillator, similar to any modern wristwatch, some amount of imprecision and thus exhibit drift over time. – offset = time reported – true time Clock skew – S = d Offset(t) / dt Measured in PPM(μs/s)

Introduction and Prerequisites How much skew? – +/- 4 seconds a day common – (25 minutes a year) Importantly, paper argues skew of a device is (generally) consistent and distinctive to that device – Thus can use as a fingerprint for this device 24 hours later

OUTLINE 1. Introduction and Prerequisites 2. Techniques – Exploiting the TCP TSopt (passive) – The semi-passive technique – Exploiting ICMP Timestamp Requests (active) 3. Investigations 4. Applications 5. Conclusion 6.Strengths and Weaknesses

Exploiting the TCP TSopt TSopt – 32-bit timestamp contained in each packet – clock that is “at least approximately proportional to real time” – Usually reset to zero upon reboot – Usually not affected by changes to the device's system clock

Exploiting the TCP TSopt The measurer – any entity capable of observing TCP packets from the fingerprintee Create a trace of TCP packets from fingerprintee For each packet plot a point – X value: Amount of actual time passed between reception of first packet in trace and the current packet – Y value: The offset observed for this packet, based on timestamp

TSopt clock skew estimates for two sources from a OC-48 link of a US Tier 1 ISP over a two hour period.

Exploiting the TCP TSopt Use linear programming to determine the equation of the line y = αx + β that best upper- bounds this set of points – α is the estimate of the clock skew – β is an initial observed offset

The semi-passive technique Windows 2000 and XP machines do not set timestamp flag in their initial SYN packets RFC 1323 mandates that none of the following TCP packets in the connection can include timestamp Thus, previous approach will not work if a Windows machine is behind NAT, firewall

The semi-passive technique Paper’s trick: The measurer includes timestamp in the responding SYN/ACK packet Windows machines then include timestamp in all subsequent packets of this connection SYN SYN, TSopt

ICMP Timestamps Reports value of system clock (milliseconds past midnight) RFC 792 requires frequency is 1000 Hz (1 ms resolution) If system clock is updated via NTP regularly, will be relatively accurate – However, most hosts do so infrequently

Exloiting ICMP Timestamp Requests (Active Approach) The measurer: entity capable of sending ICMP Timestamp Request and storing the fingerprintee's subsequent ICMP Timestamp Reply messages Limitation: Fingerprintee must not be behind a firewall that filters ICMP Estimation of clock skew is similar to that in TSopt methods.

QUESTIONS CLOCK SKEW What is the distribution of clock skews among devices? How stable are these clock skews over time? Can these clock skews be measured accurately, independent of network topology and access technology?

OUTLINE 1. Introduction and Prerequisites 2. Techniques 3. Investigations – Distribution of clock skews – Stability of clock skews – Independence of access technology and topology – Independence of distance and of measurer – Effects of OS, NTP and other features 4. Applications 5. Conclusion 6.Strengths and Weaknesses

Distribution of clock skews-Experiment 1 Figure 1: Histogram of TSopt clock skew estimates for sources in a 2 hour network trace from a OC-48 link of a US Tier 1 ISP. (Considered only sources that sent packet over a period of at least 50 minutes per hour, and sent at least 2000 packets per hour.)

Distribution of clock skews Could this skew simply reflect different operating system and hardware configurations? To answer this, TSopt clock offsets were measured for 69 Pentium II machines running Windows XP SP1 over 38 days 48 TCP packets with timestamp per hour

Distribution of clock skews - Experiment 2

Stability of Clock Skews Use the traces from Experiment 2: – divided them into 12- and 24- hour periods – compared all periods of same length for each machine Differences between maximum and minimum clock skew estimated for one machine: – 12-hour periods: 1.29 – 7.33 ppm – 24-hour periods: 0.00 – 4.05 ppm Clock skews are rather constant over time – Other experiments with modern processors support this observation

Independence of Access Technology Experiment 3: Connected laptop at different locations via multiple access technologies to the internet The measurer host1 remained the same and was synchronized via NTP laptop was not synchronized via NTP Skew estimates all within a fraction of a ppm of each other:

Independence of Network Topology Experiment 4: 10 PlanetLab machines in USA, Canada, Switzerland, India and Singapore with approximately accurate system times Laptop again as fingerprintee Skew estimates all within 0.4 ppm of each other (except IIT, India, with additional 1.2 ppm)

Effects of OS and other features Start timeOperating System NTPskew estimate (TCP tstamps) skew estimate (ICMP tstamps) , 12:00 PDT , 08:00 PDT , 21:00 PDT , 21:00 PDT Red Hat 9.0 Windows XP SP2 NO YES NO YES ppm ppm ppm ppm ppm ppm ppm 1.69 ppm

Applications Distinguish virtual honeynets from real networks and virtual hosts from real ones Counting the number of devices behind a Firewall Forensics – eg. argue that a given device was not involved in a recorded event Tracking individual devices (with some probability)

Strengths Shows that it is possible to extract relevant security information from data considered noise Approach could be used with any other protocols that leak information about a device’s clock

Weaknesses Further experimentation required – Laptop running Windows XP SP2 has a noticeably different TSopt clock skew after switching to battery power – Newer processors throttle their speeds based on temperature and load, affects voltage from power supply Easy to circumvent particular methods – echo 0 > /proc/sys/net/ipv4/tcp_timestamps – Randomize TSopt timestamp – Filter ICMP timestamp

Improvements Utilization of approach with other protocols that leak information about a device’s clock Use of profiling in combination with skew data – Skew is within a certain range and machine visits certain websites frequently – OS profiling techniques