a journey...
summary
Shows a concrete pipeline: passive fingerprints (HTTP user‑agent, TTL 64, DHCP vendor class option 60, DNS names) feed weekly CSV lookups of MAC prefixes (submac length 10 and 11) that are pruned (require 2/16 devices for length 11, 25 for length 10), exploded and neighbor‑filled, then searched for first prefix match. Confidence is a heuristic: longer prefix, higher proportion, neighbor lowers score; MAC randomization is detected via the second hex and excluded. Kato reports ~6% coverage from this method.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 1:27Talk agenda and IoT security
- 2:54Why IoT security matters
- 4:49Passive vs active fingerprinting
- 6:17Passive fingerprinting examples
- 8:30Deploying fingerprinting systems
- 9:13MAC address and OSI layer
- 14:12Combining protocols for signatures
- 15:40Pros and cons of passive fingerprinting
- 19:17Classification confidence in fingerprinting
- 21:29Statistical fingerprinting fundamentals
- 23:18MAC address structure and stats
- 24:46MAC randomization impact
- 26:31Building the statistical lookup table
- 31:18Pruning and exploding lookup data
- 35:33Neighboring and finalizing lookup table
- 37:21Classifying new devices
- 38:47Integrating passive and statistical engines
- 39:29Effectiveness of statistical fingerprinting
- 40:33Pros and cons of statistical fingerprinting
- 41:38Summary
related talks
44mNetsec is Dead(?): Modern Network Fingerprinting for...
41mInternet Spelunking: IPv6 Scanning and Device Fingerprinting
58mFIRSTCON21 - June 8 | Stream 3 Part 2 (14:30-15:30 UTC)
17mOS Fingerprinting From Scratch (Or) Offensive Scapy
59mCatching Malware En Masse: DNS and IP Style
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
43mWho are the people in your neighborhood? Tracking 'Shady' CIDR blocks
22mAPT Attribution and DNS Profiling