Re: Now only if we had another PhD candidate in http://www.dslreports.com/forum/r12882226 en Sat, 28 Nov 2009 23:14:53 EDT Sat, 28 Nov 2009 23:14:53 EDT Re: Now only if we had another PhD candidate http://www.dslreports.com/forum/remark,12882226 anon : From what I understand, with Windows boxes....

1. Windows Client connects to our discovery device (this could be a web site etc...)
2. Windows client has timestamps turned off. syn/ack begins.
3. discovery device replies to the windows box with timestamp information included.
4. Windows box ignores that timestamps are turned off and decides to send timestamps in return. Hummmm windows is such a smart OS.

Then fingerprinting can begin. Still unsure of even if this method of fingerprinting is valid but I would assure you that if it is, it will not be patched by OS vendors if the vunerability is patched it may defeat the efforts of our goverment. May I remind everyone of the Patroit Act. ]]> http://www.dslreports.com/forum/remark,12882226 Thu, 10 Mar 2005 21:55:49 EDT Re: Now only if we had another PhD candidate http://www.dslreports.com/forum/remark,12830600 Done_Posting : What a fascinating article. I'll have have to keep my eyes peeled for more info. ]]> http://www.dslreports.com/forum/remark,12830600 Fri, 04 Mar 2005 14:13:49 EDT Re: Now only if we had another PhD candidate http://www.dslreports.com/forum/remark,12830595 TKJunkMail :
said by DonLibes See Profile:

This should be easy to block. Just run a little daemon that randomly adjusts your system time (backwards and forwards) by a few milliseconds every so often.
Or turn off timestamps with DrTcp as shown in this post:
»Block timestamps using BBR's DrTCP stops method
--
My Web Page
My Blog
Join Red Room Forum]]> http://www.dslreports.com/forum/remark,12830595 Fri, 04 Mar 2005 14:13:19 EDT Re: Now only if we had another PhD candidate http://www.dslreports.com/forum/remark,12830578 DonLibes : This should be easy to block. Just run a little daemon that randomly adjusts your system time (backwards and forwards) by a few milliseconds every so often.]]> http://www.dslreports.com/forum/remark,12830578 Fri, 04 Mar 2005 14:10:05 EDT Now only if we had another PhD candidate http://www.dslreports.com/forum/remark,12830539 oliphant : would could write a paper on how to block it ;)]]> http://www.dslreports.com/forum/remark,12830539 Fri, 04 Mar 2005 14:04:06 EDT