CAPEC-323: TCP (ISN) Counter Rate Probe

MITRE CAPEC attack pattern

Description

This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-200

Prerequisites

• The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

Consequences

• Confidentiality: Read Data
• Confidentiality, Access Control, Authorization: Bypass Protection Mechanism, Hide Activities

Source

• MITRE CAPEC CAPEC-323