Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload.

The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP data payload.

.&.1Y..! .b....E.
..x..z. ...)....
....(4.. ......e
-p ADD 1 72.16.1.
21 MASK 255.255.
255.255 10.18.12
.33..... ..

The IPS tagged it as Loki tunneling traffic - but it's limited to a single packet. I thought it could be a random grab from memory, but I saw the exact same packet a few days later.

Has anyone seen anything like this before?

share|improve this question
add comment

2 Answers

Ah, tunneling... SSH, DNS, ICMP, netcat, custom VPN... you name it. Sometimes known as "give me free wifi" and in other cases as "give me your network."

I don't know that specific payload (as a compromise), but I do know you can put things over ICMP. Take a look at the surrounding packets. This kind of reminds me of the old "ATH+++" gag. It may be a similar exploit for something that's being tossed around at random. I'd like to give more for an answer, but I think I'd need more to go on.

share|improve this answer
    
True, it could be anything and the IPS is blocking it, just concerned it maybe something more and the command looks suspiciously like a rule/acl modification –  user1959 Apr 5 '11 at 18:32
    
Well, much like the ATH+++ thing, there is a risk that somehow the target device would interpret that as a command. (The ATH+++ gag would make improperly guarded dialup modems hang up -- a very cute DOS attack). I don't know the source, the target, the systems you have, etc. It is suspicious payload, though. Perhaps somebody has a console forwarded over ICMP and is issuing that command. –  Jeff Ferland Apr 5 '11 at 18:36
    
that would be my guess as well. –  Rory Alsop Apr 5 '11 at 19:20
1  
something like this - cs.uit.no/~daniels/PingTunnel ? –  user1959 Apr 5 '11 at 19:34
add comment

the is a bug in recent dhclient implementations, which allows running shell commands remotely.
dunno why it ICMP echo, if its related anyway,

share|improve this answer
    
not sure it's related - I don't think dhclient would be sending out ICMP packets –  user1959 Apr 6 '11 at 20:30
    
@kukkatz, Do you have a pointer to more information about the vulnerability? –  D.W. Apr 8 '11 at 1:45
    
on second thought, i think @Cher Zakalwe is right. @D. W.: i was referring to this: h-online.com/open/news/item/… –  kuhkatz Apr 8 '11 at 9:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.