runZero Hour: Episode 4

Episode 4 of the runZero Hour webcast discussed lookalikes on the network, which can include: human-machine interfaces found in OT environments, simulators/probes, honeypots, rogue devices, and compatible devices that happen to look alike just because they speak the same protocol. Most of these serve legitimate purposes for testing and monitoring, so their presence isn’t necessarily malicious, but they present challenges for fingerprinting. How do you differentiate a lookalike from the real thing?

The hurdle is incredibly steep if you're just doing passive discovery. It can't always differentiate between request and response with some protocols, such as Factory Interface Network Service (FINS). You really need to initiate the conversation for accurate fingerprinting.

Beyond that, you must leverage other techniques to identify the device doppelgängers. For example, with GasPot for the Automatic Tank Gauge (ATG) protocol, you can leverage line endings–carriage return line feed (\r\n) versus line feed (\n)--as a “tell”. Another fun example would be IoT/OT devices and their Windows lookalikes. You can actually use the discrepancy between ICMP and TCP syn response times as a giveaway.

Lookalikes was just one segment in this episode of runZero Hour. Watch the recording for more insights.