CWE-207, Observable Behavioral Discrepancy With Equivalent Products, covers a product that runs where its existence or identity should stay hidden, but behaves differently from other products that offer the same function in a way an attacker can see.
MITRE explains the concern. Many product types have several interchangeable choices, such as web servers, network interfaces or intrusion detection systems. Attackers fingerprint them by their differences. Once the product is identified, attacks can be tailored and made more efficient. Often an organization is fine with being identifiable. In some environments it is not, and every product is expected to behave the same way.
How it happens
A product handles an edge case in its own way. Examples from the record:
- CVE-2002-0208: a product modifies the TCP/IP stack and ICMP error messages in unusual ways that show it is in use.
- CVE-2004-2252: a behavioral leak by responding to SYN-FIN packets.
- CVE-2000-1142: a honeypot generates an error on a "pwd" command in a particular directory, letting an attacker know they are inside a honeypot.
What an attacker gains
MITRE lists reading application data and bypassing a protection mechanism. The honeypot case is the sharpest: the attacker learns the system is a trap and walks away, or avoids the trap entirely.
How to find it
- Decide first whether anonymity matters for the product. For most public services it does not.
- Where it does matter, compare behavior against the product you are imitating or blending in with, using unusual packets and commands.
- Look specifically at error handling, since that is where implementations diverge.
How to fix it
MITRE does not list mitigations. The logical fix is to match the behavior of the equivalent products in the places attackers test, and to treat unavoidable differences as a risk to document where anonymity is a requirement.
Quick check
Does every product need to hide its identity?
No. MITRE notes that organizations often allow it. The weakness applies where being identified is unacceptable.
