CAPEC-312: Active OS Fingerprinting
Description
An adversary engages in activity to detect the operating system or firmware version of a remote target by interrogating a device, server, or platform with a probe designed to solicit behavior that will reveal information about the operating systems or firmware in the environment. Operating System detection is possible because implementations of common protocols (Such as IP or TCP) differ in distinct ways. While the implementation differences are not sufficient to 'break' compatibility with the protocol the differences are detectable because the target will respond in unique ways to specific probing activity that breaks the semantic or logical rules of packet construction for a protocol. Different operating systems will have a unique response to the anomalous input, providing the basis to fingerprint the OS behavior. This type of OS fingerprinting can distinguish between operating system types and versions.
- Likelihood of attack
- Medium
- Typical severity
- Low
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.
Consequences
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Hide Activities
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
Related attack patterns
Parent
More specific patterns
- CAPEC-317IP ID Sequencing ProbeDetailed
- CAPEC-318IP 'ID' Echoed Byte-Order ProbeDetailed
- CAPEC-319IP (DF) 'Don't Fragment Bit' Echoing ProbeDetailed
- CAPEC-320TCP Timestamp ProbeDetailed
- CAPEC-321TCP Sequence Number ProbeDetailed
- CAPEC-322TCP (ISN) Greatest Common Divisor ProbeDetailed
- CAPEC-323TCP (ISN) Counter Rate ProbeDetailed
- CAPEC-324TCP (ISN) Sequence Predictability ProbeDetailed
- CAPEC-325TCP Congestion Control Flag (ECN) ProbeDetailed
- CAPEC-326TCP Initial Window Size ProbeDetailed
- CAPEC-327TCP Options ProbeDetailed
- CAPEC-328TCP 'RST' Flag Checksum ProbeDetailed
- CAPEC-329ICMP Error Message Quoting ProbeDetailed
- CAPEC-330ICMP Error Message Echoing Integrity ProbeDetailed
- CAPEC-331ICMP IP Total Length Field ProbeDetailed
- CAPEC-332ICMP IP 'ID' Field Error Message ProbeDetailed