Fingerprinting Hardware Devices Using Clock-skewing - Hackito Ergo Sum
Fingerprinting hardware devices using clock-skewing Renaud Lifchitz renaud.lifchitz@gmail.com #HES2010 8,9,10 April 2010 – Paris, France
Presenter's bio French computer security engineer Main activities: – Penetration testing & security audits – Security trainings (EC-Council CEH, ECSA/LPT, CHFI, CEI certified) – Security research Main interests: – Security of protocols (authentication, cryptography, information leakage, zero-knowledge proofs.) – Number theory (integer factorization, primality tests, elliptic curves) Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 2
Intro
What is clock-skewing? Also known as “clock skew” or “timing skew” Drift compared to the actual exact time Negative or positive skew Why is there a drift? – Software implementation of clock – Material imperfections (e.g. quartz fabrication) – Differences in wire lengths – Differences in input capacitance – Intermediate components – . Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 4
Basis (1/2) The idea is to build a fingerprint from this drift Local or remote fingerprinting! Most important: correct time reference Then, target clock deviation measurements and clustering Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 5
Basis (2/2) “The more imprecise is your clock, the more precise will be your fingerprint!” Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 6
How does it work?
How does a computer handle time? In fact, it has 2 different clocks: – An hardware clock called “RTC” (Real time clock), made of quartz, battery powered – A software clock (“system clock”) handled by the OS kernel with a counter and interrupts (ticks) Under Linux & Windows: – Kernel synchronizes its software clock with RTC at boot time – RTC is almost never read after (even synchronizations are rare) Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 8
Measurement mechanisms First of all, we need the more precise local time for target drift measurement How to measure a clock? Using a better clock! Better clocks: – Atomic clocks – GPS clocks (basically the same!) – Radio clocks (e.g. DCF77, TDF.) Typical atomic clock precision: 1 s./3000 years Fortunately, atomic clocks can be queried using NTP protocol Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 9
Correct time reference Windows (S)NTP client can only guarantee 1-2 second precision We should better use Linux NTP client for measurement (10-30 ms precision!) Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 10
A few words about NTP (1/3) NTP Network Time Protocol Protocol for synchronizing the clock of computer systems One of the oldest internet protocols (September 1985) Works with UDP, port 123 NTP only adjusts the system clock rate so that system clock match exact time Precision (at best): – 10 ms over Internet – 200 µs in LAN Common versions: NTP v3 (RFC 1305) & NTP v4 Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 11
A few words about NTP (2/3) NTP uses a hierarchical, layered system of levels of clock sources: Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 12
A few words about NTP (3/3) U.S. Naval Observatory in Colorado (Stratum 0 source) Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 13
Active measurement of the target (1/2) One can remotely query the time of a target using “ICMP Timestamp Requests” packets (ICMP Type 13 Code 0) Target replies with “ICMP Timestamp Replies” (ICMP Type 14 Code 0) Number of milliseconds since midnight (GMT Time) Generated from system clock Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 14
Active measurement of the target (2/2) ICMP layer of an ICMP Timestamp Reply Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 15
Passive measurement of the target (1/2) Or semi-active! Using TCP timestamps Proportional to uptime Generated from tick counter only Seems more accurate than ICMP timestamps Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 16
Passive measurement of the target (2/2) TCP layer of a “timestamp-enabled” TCP packet Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 17
Precision & measurement resolution (1/3) We have to deal with 10ms of NTP precision and 30ms network latency According to Tadayoshi Kohno's study, average drift: – is stable on a given computer ( /- 1-2 ppm) – varies up to /- 50 ppm This gives 4-6 bits of information Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 18
Precision & measurement resolution (2/3) Least square fitting on the set of measurement points: {(local host time, target time difference)} Obviously, longer measurement better precision Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 19
Precision & measurement resolution (3/3) Enhancement: we can add an additional measurement dimension to fingerprint target clock precision: standard deviation around average slope (if network latency is nearly constant) adds 1-3 bits of information 0.4 0.3 0.2 34.1% 34.1% 0.1 0.1% 0.0 3σ 2.1% 13.6% 2σ 1σ 13.6% µ 1σ Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 2.1% 2σ 0.1% 3σ 20
Distinguishing devices Using those 1 or 2-dimension measurements, we can easily define a distance measure between any 2 points Then, use any known multidimensional clustering algorithm: – Hierarchical algorithms – Partitional algorithms (e.g. k-means) – Density-based algorithms Ability to distinguish between about 2 (6 3) 512 different computers on Internet Can be combined with other fingerprinting techniques for better efficiency (OS TCP/IP fingerprinting, IP IDs, banners.) Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 21
Weaknesses Not so high resolution on Internet (need for longer measurement or additional characteristics) Sensitivity: – Temperature: /- 1 ppm in typical computer temperature – Altitude – High computer activity: see known attacks on Tor anonymity network (ref. [1]) Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 22
Applications
Identification of stolen devices Compute the fingerprint of your computer in case you loose it You are now able to find it remotely among hundreds of similar computer (a lot easier on a LAN). even if IP address / MAC address / hard drive was changed! (OS type shouldn't have been changed.) Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 24
Detection of remote virtual machines If guest VMs are time-synchronized with host (option in most virtualization solutions), they will share a very similar fingerprint Otherwise, same guest OSes on the same host will have similar fingerprints Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 25
Computer forensics These kinds of fingerprints can be computed offline Fingerprints computed from a short PCAP network capture done on a wellsynchronized computer Ability to fingerprint an attacker computer even if entire attack isn't completely recorded Compare attack fingerprint with suspected computer fingerprints Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 26
Countermeasures
Countermeasures Frequent NTP synchronizations Disable: – TCP timestamps – ICMP or ICMP timestamp requests/replies – Any service delivering time (or just the time fonctionality, not the service!): e.g. Apache “Date” HTTP header Regularly change: – Your temperature – Your altitude – Your computer activity – Your processor & motherboard! Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 28
Tool & demo
Tool No tool seems to exist! Open source tool using Python & Scapy Very basic & naive tool for the moment “Quick and dirty” coded Tool will be published on Google Code just after the event Feel free to contribute & improve the tool! Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 30
Live demo (1/2) Requirements: – Computers on a wired network (latency is too important on wireless networks): either TCP or ICMP-enabled – Some NTP servers for suitable time synchronization – Python & Scapy installed Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 31
Live demo (2/2) Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 32
Outro
References [1] Tadayoshi Kohno, Andre Broido, and K.C. Claffy, “Remote physical fingerprinting”, IEEE Transactions on Dependable and Secure Computing, 2(2):93-108, 2005. [2] Talk “Fingerprinting hosts through clock skew”, Steven Murdoch, EuroBSDCon, 2007 [3] “NTP, une simple histoire de temps”, GNU/Linux Magazine France, Diamond Editions, April 2010 Hackito Ergo Sum 2010 – 8,9,10 April 2010 “Fingerprinting hardware devices using clock-skewing” Renaud Lifchitz 34
Thanks! Questions?
Hackito Ergo Sum 2010 - 8,9,10 April 2010 "Fingerprinting hardware devices using clock-skewing" Renaud Lifchitz 4 What is clock-skewing? Also known as "clock skew" or "timing skew" Drift compared to the actual exact time Negative or positive skew Why is there a drift? - Software implementation of clock - Material imperfections (e.g. quartz fabrication)
deviations in device hardware: clock skews. Our techniques do not require any modification to the fingerprinted devices. Our techniques report consistent measurements when the measurer is . Classes of fingerprinting techniques. We consider three main classes of remote physical device fingerprinting techniques: passive, active, and semi .
The extensive lyrics of their traditional songs . 5 o'clock (lit.: hour 5) 6 o’clock at 6 o’clock o’clock 7 at 7 o’clock o’clock 8 at o’clock 8 o'clock 11 half . Saturday Unleashing the brain’s potential Learning to music is not only
3M Cogent Fingerprinting Services c/o Bay Shore Services, Inc. 1235 Pemberton Dr. Salisbury, MD 21801 410.341.0307 x106 3M Cogent Fingerprinting Services Main-One (M-1) Solutions, Inc 4300 Forbes Blvd. Suite 220 Lanham, MD 20706 301.702.7200 3M Cogent Fingerprinting Services
scopic deviations in device hardware: clock skews. CLASSES OF FINGERPRINTING TECHNIQUES. We con-sider three main classes of remote physical device finger-printing techniques: passive, active, and semi-passive. The first two have standard definitions — to apply a passive fingerprinting technique, the fingerprinter (measurer, at-
B. Hardware Fingerprinting Different hardware components of mobile devices have been investigated to generate fingerprints. Wireless transmitters can be fingerprinted by radio frequency (RF)[19]. Network devices have distinguishing and stable clock skews [20], [21], which can be used for fingerprinting [22]. The source network inter-
Fi technology using fingerprinting method. Thus, we combine this typical method with trilateration to enhance our system accuracy and consistency. Firstly, we process the RSS signal received [7-8] from nearby Wi-Fi access points to reduce its fluctuations. The processed signals are then compared to the fingerprinting radio-maps stored in
Time Clock Page ð Using the Time Clock You can access the time clock from any of the following locations: 1. Shortcut: You can create a shortcut on your desktop. Choose Start All Programs PostalMate. Right-click on Time Clock and choose Send to Desktop create shortcut . 2. PostalMate: Choose Everyday Tools Time Clock. 3.
The One Blue Dot reference guide was compiled over many months and aimed to cover the broad range of issues associated with environmentally sustainable diets. It’s such a huge topic however that we expect reading the documents will prompt many new questions from dietitians and other nutrition experts. This document starts to collate some of these and will be added to as the discussions .
