Method and system for detecting a vulnerability in a network

• US 7,073,198 B1
• Filed: 08/25/2000
• Issued: 07/04/2006
• Est. Priority Date: 08/26/1999
• Status: Expired due to Term

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: nCircle Network Security, Inc. (Belden Inc.)
• Inventors: Flowers, John S., Stracener, Thomas C.
• Primary Examiner(s): Revak, Christopher
• Assistant Examiner(s): Moorthy, Aravind K
• Application Number:
  US09/648,211
• Time in Patent Office: 2,139 Days
• Field of Search: 713/201, 713/200
• US Class Current: 726/25
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system and method in accordance with the invention reliably and non-intrusively identifies various conditions of a network. In particular, an embodiment of the invention can identify an operating system, including version and patch level, and a service, including version and patch level, of a remote host on the network. Using this information, an embodiment of the invention can then reliably identify a vulnerability condition of the network. In some embodiments, the operating system and service information can be used to identify a trojan application, unlicensed software use, security policy violations, or even infer vulnerabilities that are yet unknown.

Claims

1. A method of detecting a vulnerability of a network, comprising:

sending a first set of test packets to a remote host on the network;

receiving a first set of reflexive packets from the remote host in response to the first set of test packets, at least part of the first set of reflexive packets including header information that is unique to an operating system;

inferring the operating system;

sending a second set of test packets to the remote host;

receiving a second set of reflexive packets from the remote host in response to the second set of test packets, at least part of the second set of reflexive packets including header information that is unique to a service; and

inferring the service,

identifying a vulnerability of the network based on information obtained from the steps of identifying an operating system and identifying a service,

wherein the first set of test packets includes;

a SYN Packet with false flag in the TCP option header;

a Fragmented UDP packet with malformed header (any header inconsistency is sufficient), where the packet is 8K in size;

a FIN Packets of a selected variable size or a FIN packet without the ACK or SYN flag properly set; and

a generic, well-formed ICMP ECHO request packet;

a generic well-formed TCP Header set to 1024 bytes in size;

a Packet requesting an ICMP Timestamp;

a Packet with min/max segment size set to a selected variable value; and

a UDP packet with the fragment bit set;

a TCP Packet with the header and options set incorrectly;

a well-formed ICMP Packet;

a Fragmented TCP or UDP packet;

a packet with an empty TCP window or a window set to zero;

a generic TCP Packet with 8K of random data; and

a SYN Packet with ACK and RST flags set.

2. A method of examining a network, including:

identifying an operating system of a remote host, including a version and a patch level of the operating system with a first set of packets, the first set of packets comprising at least an operating system packet to determine the operating system, an operating system version packet to determine the operating system version based on the determined operating system, and an operating system patch level packet to determine the operating system patch level based on the determined operating system version;

identifying a service of the remote host, including a version and a patch level of the service with a second set of packets based on the identified operating system, the second set of packets comprising at least a service packet to determine the service, a service version packet to determine the service version based on the determined service, and a service patch level packet to determine the service patch level based on the determined service version; and

identifying a vulnerability of the network based on information obtained from the steps of identifying an operating system and identifying a service.

3. The method of claim 2, wherein:

identifying the operating system includes sending the first set of packets to the remote host and receiving a second set of packets from the remote host in response to the first set of packets, and analyzing the second set of packets for inferential information indicative of the operating system; and

identifying the service includes sending the third set of packets to the remote host and receiving a fourth set of packets from the remote host in response to the third set of packets, wherein information contained in the third set of packets is based on information received in the second set of packets, and analyzing the fourth set of packets for inferential information indicative of the service.

4. The method of claim 3, wherein the inferential information comprises header information associated with the second set of packets, at least part of the header information being unique to the identified operating system.

5. The method of claim 3, wherein the inferential information comprises header information associated with the fourth set of packets, at least part of the header information being unique to the identified service.

6. The method of claim 2, wherein identifying a service comprises directing communications to ports of the remote host based on the identified operating system.