dark mode light mode Back to ellio.tech

Black Hat 2025: ELLIO debuts new open-source recon shield

Great news! ELLIO is launching a new open-source defense tool at Black Hat 2025 – the TCP Fingerprint Firewall. Built on high-performance eBPF technology, this firewall is designed to detect and block malicious scanners using advanced TCP fingerprinting techniques. It’s designed to meet the demands of a fast-moving threat landscape, especially in an era dominated by mass scanning and automated attacks.

  • Date: Wednesday, August 6, 2025
  • Where: Black Hat Arsenal 2025, Business Hall, Arsenal Station 3
  • Presenters: Vlad Iliushin (ELLIO), Ken Webster (Thales)
  • Black Hat 2025 website

What is TCP Fingerprint Firewall

TCP Fingerprint Firewall is a new Recon Shield, a high-performance, eBPF-based network security tool that leverages TCP fingerprinting to detect and block malicious and promiscuous network scanners with high speed and accuracy. This open-source solution combines the power of XDP (eXpress Data Path) for inline packet processing with MuonFP’s advanced TCP fingerprinting capabilities, allowing security professionals to identify and block reconnaissance activities before they can map your network infrastructure.

Unlike traditional firewalls that operate on simple port/IP rules, TCP Fingerprint Firewall uses MuonFP-based fingerprints – subtle TCP header characteristics that identify scanning tools like Nmap, ZMap, and Masscan, as well as specific operating systems or device fingerprints. 

The innovative pattern matching engine supports wildcards, allowing both precise fingerprint targeting and broader pattern recognition with minimal performance overhead.

About ELLIO
ELLIO is a research lab specializing in real-time detection and in-depth analysis of mass exploitation and recon activity. We uncover attack patterns, anomalies, and emerging threats – delivering actionable IP threat intelligence and tailored solutions to optimize existing resources, mitigate risks, and prevent losses from mass exploitation and network recon.

  • IP Threat Intelligence & ELLIO Metadata Repository.
  • Central IP Management and Monitoring.
  • Intelligent Threat Feeds for Operations.
  • Highly Adaptive, Automated IP Blocking.
Total
0
Shares
Comments 116
  1. I’m often to blogging and i really appreciate your content. The article has actually peaks my interest. I’m going to bookmark your web site and maintain checking for brand spanking new information.

  2. naturally like your web site however you need to take a look at the spelling on several of your posts. A number of them are rife with spelling problems and I find it very bothersome to tell the truth on the other hand I will surely come again again.

  3. naturally like your web site however you need to take a look at the spelling on several of your posts. A number of them are rife with spelling problems and I find it very bothersome to tell the truth on the other hand I will surely come again again.

  4. naturally like your web site however you need to take a look at the spelling on several of your posts. A number of them are rife with spelling problems and I find it very bothersome to tell the truth on the other hand I will surely come again again.

  5. naturally like your web site however you need to take a look at the spelling on several of your posts. A number of them are rife with spelling problems and I find it very bothersome to tell the truth on the other hand I will surely come again again.

  6. You’re so awesome! I don’t believe I have read a single thing like that before. So great to find someone with some original thoughts on this topic. Really.. thank you for starting this up. This website is something that is needed on the internet, someone with a little originality!

  7. naturally like your web site however you need to take a look at the spelling on several of your posts. A number of them are rife with spelling problems and I find it very bothersome to tell the truth on the other hand I will surely come again again.

  8. I’m often to blogging and i really appreciate your content. The article has actually peaks my interest. I’m going to bookmark your web site and maintain checking for brand spanking new information.

  9. You’re so awesome! I don’t believe I have read a single thing like that before. So great to find someone with some original thoughts on this topic. Really.. thank you for starting this up. This website is something that is needed on the internet, someone with a little originality!

  10. You’re so awesome! I don’t believe I have read a single thing like that before. So great to find someone with some original thoughts on this topic. Really.. thank you for starting this up. This website is something that is needed on the internet, someone with a little originality!

  11. naturally like your web site however you need to take a look at the spelling on several of your posts. A number of them are rife with spelling problems and I find it very bothersome to tell the truth on the other hand I will surely come again again.

Leave a Reply

Your email address will not be published. Required fields are marked *