Preventing remote OS detection

[gilbert () pgci ca (Patrick Gilbert)]

A technique exists to determine a remote operating system by sending
obscure tcp
packets and analyzing the response. Two utilites known as queso and nmap
can
determine with enough precision your operating system. This has been
known for quite some time, but I haven't seen much on how to prevent it.

There are many other ways to determine the operating system as well,
most of which are described in a fairly recent phrack article (number 54
if I am correct)
by fyodor, and are addressed in the article mentionned below.

How can we mask our operating system from these tcp/ip stack
fingerprinting tools while still being functional?

This module is particularly useful for bastionned hosts in front of the
corporate firewall who run public services such as mail, ftp and http,
and cannot filter incoming connections.

The answer can be found in the latest security improvement module at:

http://www.pgci.ca/fingerprint.html

As always, comments and suggestions are welcome.

Cheers,
Patrick

--
Patrick Gilbert                                     +1 (514) 865-9178
CEO, PGCI                                          http://www.pgci.ca
Montreal (QC), Canada CE AB B2 18 E0 FE C4 33  0D 9A AC 18 30 1F D9 1A