COEN 152 / 252 Computer Forensics Remote Sniffer Detection

Sniffer Detection On the Host On the Net Look for capture files (typically big and growing). Look for a promiscuous card. Look for unauthorized connections or processes. On the Net Traffic analysis Traffic injection (probing) Much harder.

Network based Sniffer Detection Promiscuous mode detection DNS tests. Network latency tests. Trapping

Network based Sniffer Detection NIC hardware addresses NIC sets up different filters Broadcast: receive all broadcast addresses (with MAC ff:ff:ff:ff:ff:ff) Multicast based on multicast address All multicasts Promiscuous: receive all packets.

Promiscuous mode detection Each Network Interface Card (NIC) has a unique Medium Access Control (MAC) address. Card in non-promiscuous mode only catches packets with that MAC address.

MAC Promiscuous Mode Detection Send an echo request to the right IP address but with wrong MAC address. Only a NIC in promiscuous mode will pick up something with a wrong MAC address. The “Echo Request” package is passed up the stack to the IP layer. IP layer answers it.

MAC detection

ARP Detection Send an arp request with false MAC and correct IP address. Only promiscuous NIC will pick up package. Kernel sends ARP reply.

Software Filtering Based Detection Different OS implement filters differently. We can try: Fake broadcasting messages: FF:FF:FF:FF:FF:FF:FF:FE (Br47): Last bit missing FF:FF:00:00:00:00:00:00 (BR16) Only first 16 bits are the same as for broadcast. FF:00:00:00:00:00:00:00 (BR8) F0:00:00:00:00:00:00:00 (BR4)

Software Filtering Based Detection Different OS implement filters differently. We can try: Fake multicasting messages: 01:00:00:00:00:00:00:00 (Gr) Only group-bit set. 01:00:5E:00:00:00:00:00 (M0) Multicast address zero is usually not used 01:00:5E:00:00:00:00:01 (M1)(assigned to all) Multicast address one should be received by all in the test system 01:00:5E:00:00:00:00:02 (M2)(assigned to different set of nodes) Multicast address two should not be received by systems in the test group. 01:00:5E:00:00:00:00:03 (M3)(not registered)

Software Filtering Based Detection Windows XP WinME / 9x Win2K/NT Linux 2.4.x Free BSD 5.0 B47 -- X B16 B8 Gr M0 M1 O M2 M3 Response to various ARP requests. Normal mode: left column, promiscuous mode: right column O legal response, X illegal response, -- no response

Software Filtering Based Detection ARP requests to fake MAC addresses can determine promiscuous cards in an OS dependent manner. Trabelsi, Rahmani, Kaouech, Frikha: Malicious Sniffing Systems Detection Platform, SAINT ’04.

DNS Detection Technique Password sniffers (or sniffers not in stealth mode) generate network traffic. Sniffers use reverse DNS lookup Because they think they found a password and want to know the system. Because they want to provide the user with the name of the machines.

DNS Detection Technique

Load Detection Technique Sniffers are hard on the machine resources. Sniffer degrades performance when there is a lot of network load. Hence, generate lots of network load and measure timing.

Load Detection Technique

Round Trip Time Measuring Technique Experiments show: Round Trip Times show OS dependent differences of 10% - 40% between normal mode and promiscuous mode. Allows reliable detection. Using ICMP messages is less network load dependent.

Bait Technique Create telnet for a fake telnet server. With lots of logins + passwords. Sniffer takes bait. Telnet attempts to non-existing server. Works like a honey-pot.