Security Cloak – Mask Against TCP/IP Fingerprinting for Windows

Find your website's Achilles' Heel


I’ve seen quite a lot of discussion lately on how to ‘defend against nmap’ or how to change the properties of your TCP/IP Stack so your Windows OS appears to be something else (As in you can guess the OS from the TTL value passed back in a TCP/IP packet).

One way you can do this is with Security Cloak.

Security Cloak is designed to protect against TCP/IP stack fingerprinting and computer identification/information leakage via timestamp and window options by modifying relevant registry keys. The settings used are based on the results of SYN packet analyization by p0f. While the OS reported by other OS detection scanners were not identical to those of p0f, testing against Nmap, xprobe2, queso and cheops showed that they were unable to identify the correct operating system/version after Security Cloak settings had been applied.

Note that in order to properly emulate some Operating Systems, the MTU must be changed. While most of these require the MTU to be 1500 (the default for most network connections),depending on your network connection, this could degrade/interfere with your connectivity, so be sure to check your current MTU before applying these changes. It is reccomended that you save all the original key values before using this program in the event that your computer responds negatively to the changes.

You can find the authors page here: http://www.craigheffner.com/security/

And a direct download here: Security Cloak


Posted in: Countermeasures, Network Hacking, Windows Hacking

, , , , , , , ,

Recent in Countermeasures:
- Pulled Pork – Suricata & Snort Rule Management
- Signal Messaging App Formal Audit Results Are Good
- Snort – Free Network Intrusion Detection & Prevention System

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,376 views
- Password Hasher Firefox Extension - 117,979 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,778 views


3 Responses to Security Cloak – Mask Against TCP/IP Fingerprinting for Windows

  1. JB March 20, 2006 at 5:53 am #

    Interesting idea. I have used the vulnerability scanning service offered by Qualys, and while the TCP/IP fingerprinting is not the most severe issue, I was curious if it could be masked somehow. I plan to test this out and see what my scans come up with. I’ll try to post the results.

  2. Darknet March 20, 2006 at 6:14 am #

    JB: Thanks, would be interested to know your results for sure!

Trackbacks/Pingbacks

  1. Kioto blog - Security Cloak - Herramienta anti OS Fingerprinting para Windows - March 30, 2006

    […] El OS Fingerprinting es la técnica que usan la mayoría de escaneadores de puertos avanzados (como el nmap, queso o p0f) para adivinar el sistema operativo de la víctima. Está basado en los tiempos de respuesta a los diferentes paquetes ACK y SYN al establecer una conexión en el protocolo TCP/IP de cada máquina.LA solución es cambiar los tiempos de respuesta que tiene por defecto nustra máquina y así hacer creer que se trata de otro tipo de máquina.He encontrado cantidad de información de como cambiar estos tiempos de respuesta en Linux manualmente, pero nada en Windows.Se han acsabado mis busquedas, este programa me permite deficir automaticamente (desde la linea de comandos) que máquina me gustaría ser, desde una consola Dreamcast, un Windows CE 3, un BeOS 5.0-5.1 o hasta un SunOS 4.1.x. Todos esto en tan sólo 20 KB y además incluye el código fuente en C. ¿Qué más se le puede pedir?Enlace: Security CloakVía: Darknet   […]