Can hackers detect my operating system?

Question

I've seen people demonstrating the use of BackTrack to attack VMs. In one of the components of BackTrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, I would like to know if it is possible for attackers to know that I am using an outdated OS and exploit its vulnerabilities.

Edit: I would also like to know if it should be a concern if attackers know my operating system. I assume that with an antimalware product like MSE with the latest definitions I should be safe.

Edit 2: From what I've gathered, the threat is real. Personally, I will be shutting off my access to the internet for the time being. I will wait a few months or so after April. If things get bad, I will upgrade my OS. The thing about Windows XP is that it is still a very capable OS that many still find comfortable to use.

Answer 1

My first two cents:

What is the actual problem here? Attackers knowing you are running a vulnerable operating system or you not upgrading it?

Now in regards to your question. There are a number of utilities which can be used to fingerprint an operating system. There are several JavaScript libraries which allow you to get information about a person's browser and operating system.

Browsers are not the only thing you can try to fingerprint. Other services like SMB also can be used (as they will advertise certain versions) to attack a machine. Basically any service you are running could be used to try and guess your operating system. There are hardening guides which will assist you in making your print as low as possible (have a quick google).

Also note that if you are a regular consumer, chances are most of those services will not be accessible from the internet as you will be behind a NAT router or even a firewall.

Answer 2

Yes, this is very possible.

In fact, support for this is built into the most popular port scanning tool in use, nmap. This feature, OS detection, can be activated by passing the -O flag to the nmap tool. What nmap does is send different TCP and UDP packets to the target and examine the response. By comparing the response to a database of existing operating systems fingerprints, nmap can determine with reasonable accuracy what operating system is running on the system.

Answer 3

The short answer is that yes attackers can usually detect your operating system in standard configurations.

Usually this would come while your browsing, and the browser will provide that information to systems that you contact in the User-Agent String (N.B. with some browsers and plugins this can be changed to anything you like).

Also as @terrychia notes, attackers who can send traffic directly to your system (e.g. if they're on the same network as you) can likely work out your OS version based on responses to requests they make to your computer.

To address the point at the end of your questions, 2 things. One I wouldn't rely on A-V alone to protect a system which is unsupported (e.g. Windows XP after April), secondly specifically for MSE, AFAIK there will be no more updates for MSE on XP after April (i.e. support for MSE on XP ends when XP goes out of support)

Answer 4

TL;DR: Yes, it is possible for an attacker to fingerprint your system and yes it will help him to attack your system. So you should correctly protect your system (an antivirus is not enough).

How does fingerprint work ?

There are different kinds of fingerprint, mainly fingerprint at network level and application level.

At network level

Operating systems does answer differently to use cases not precisely defined in standards. For instance, there are different options allowed by the TCP protocols and each operating system uses different ones. So it is possible to fingerprint a system either actively (by generating custom packets sent to the host, for instance with the tool nmap) or passively (by listening packets with a tool like p0f). If you consider only your home laptop, it's not a big deal as long as you are protected by a correct firewall (many home routers now block all incoming connections). If you also consider servers, it's more complex and several solutions have been developed to defeat fingerprinting however they are often complex and mostly outdated (look this article)

At Application Level

On server side, many services give very precise informations in banners (for instance Apache/2.0.48 (Fedora) Server at 127.0.0.1 Port 80 for an appache web server) and you should take care to correctly configure your services to disable these banners (and of course disable useless services).

On client-side, the most critical application is your web browser as 99% of your traffic uses it, and it is really easy to fingerprint your browser:

• Your browser gives his name and version in each request through the User Agent parameter. You can modify it with browser addons
• Even without the user agent, it is possible to gather a lot of informations about your systems through your browser (screen size, fonts, extensions...). The EFF has proven with its application panopticlick, that it is possible to uniquely identify >99% of browsers

So what ?

It's not such a big deal as such informations only help attackers but it won't allow them to compromise your system. It gives them the address of your house not the keys. So you should restrict informations available by attackers when possible but first, you should take care to correctly protect your system

How can you protect your system ?

Antiviruses are really badly efficient, it's trivial to modify a malware so that it won't be detected by 99% of antiviruses. You should follow a list of best practices to avoid attacks :

• Update your system and applications : this is the #1 rule ! On unix-like systems, you can rely on the package system. On windows, a tool like Secunia PSI can help you to identify the vulnerable softwares. The most critical softwares are your browser and its plugins (Flash, Java, Silverlight...) so keep them up to date all the time
• Use strong password and use different password for different websites : there are a lot of password leakage nowadays so you should take care of your passwords. A tool like keepass to securely store your password can be helpfull. Also use two-factor authentication when possible
• Use a personal firewall : even if you should be most of the time behind a home firewall, it is always useful
• Use an antivirus : to my mind, don't spend money on it but there are free antiviruses on Windows
• Be smart on Internet : take care of weird emails, weird web sites...

So it is definitely dangerous to continue using Windows XP after april 2014, you should really consider upgrading (or moving to another OS).

Answer 5

An even better solution than trying to harden your system (although of course this is always still a good idea) is to use a tool like http://portspoof.org/ . As the page explains this can even be leveraged as a reverse exploitation framework; make it appear that your server is using a known vulnerable service, and then using an exploit on the attacker. A few examples can be found in https://github.com/drk1wi/portspoof/blob/master/tools/portspoof.conf

Answer 6

Check nmap, it is a tool for port scaning which does fingerprinting (it identifies your probable OS giving various answers and a percentage with the probability of success in the recognition). Here is the link to the info.

You would very probably have a router to connect to the internet, which would be provided by your ISP, if that is your case, most routers come preconfigured with all incoming conections to your computer ports blocked. In that case, it is not possible to identify your OS testing your ports.

But you can give that information away very easily. Every connection to a web page is probably giving out that information. Check your web browser's USER AGENT here. That is a very simple way to know what OS you might have, it can also be used to prepare an attack for known vulnerabilities of your OS from a web page that is formed specifically for that. You can change that by simply using a plugin that allows you to change the user agent. For instance, I am currently on a Windows machine but my user agent displays as

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20130331 Firefox/21.0

So the pages where I connect to don't know my real OS, they think it is Linux. I haven't yet found any pages that doesn't work correctly because of this, and if I run into any, I can always disable the substitution.

Conclusion: Yes, your OS can be guessed, but you have ways to try to hide that information (not in port scanning, but if you use a router that is well configured your machine can't be access directly from the outside unless you change the configuration. There may be ways to circumvent this though)

Answer 7

Right, the answer is yes and no to the question of identifying your operating system. The internet was designed for extreme sharing of information. By design it is a noisy / verbose channel of communication. Only recently have people began to abuse this by making use of the data exchanged over the internet.
Your computer has a number of services that communicate over the internet via port numbers. A lot of these services announce themselves by use of what are called banners. Take for example the smtp service that windows xp users leave enabled and unsecured whenever they blindly enable IIS. Or worse the ftp service. These services annouce themselves, what operating system they are on and the service pack installed.
If an attacker knows your service pack level, they know which exploits are still open and thus know how to hack you. I once sent a guy an email from his own computer using his own smtp service :-) I had found his ftp was running and he had tonnes of porn. Needless to say I wrote to him as his mum who had an account on the same computer. I told him about both the services and the services were stopped or secured in a few days.
The solution is to use a crazy paranoid firewall that blocks all ports so that you only open those you need, and then browse with https-everywhere extension added to your browser. That should reduce your footprint. Shields up is a good site to measure your footprint.
I say yes and no because not everyone knows how to footprint your computer or what to do with that footprint.
Is it a concern? If you are cautious no.