Hot answers tagged icmp
43
Compared to other IP protocols ICMP is fairly small, but it does serve a large number of disparate functions. At its core ICMP was designed as the debugging, troubleshooting, and error reporting mechanism for IP. This makes it insanely valuable so a lot of thought needs to into shutting it down. It would be a bit like tacking >/dev/null 2>&1 to the ...
17
The ICMP Echo protocol (usually known as "Ping") is mostly harmless. Its main security-related issues are:
In the presence of requests with a fake source address ("spoofing"), they can make a target machine send relatively large packets to another host. Note that a Ping response is not substantially larger than the corresponding request, so there is no ...
14
ICMP has a data component to it. It can be used to build tunnels, and this is not just a theory thing, it's available in the wild. It's been found by several different researchers as parts of malware toolkits. Not to mention there is a prominent howto on this topic, not to mention the wiki, or the hackaday
ICMPTX uses the ICMP echo and ICMP reply. ICMP ...
11
ICMP exists for a reason, and not all of that reason is ping. It's the "meta" protocol that is used to communicate control messages about the network itself. Have a look at ICMP on Wikipedia to get a better idea of what it is and what it's for.
Other ICMP messages also include destination host unreachable, fragmentation required, congestion control, TTL ...
7
It is true that ICMP can be used by attackers to gain information, transport data covertly, etc. It is also true that ICMP is extremely useful, and that disabling it can often cause problems. Traceroute does in fact use ICMP, so disallowing certain ICMP types will break it.
The question highlights the classic balance of security and functionality, and it's ...
6
I think that outbound echo reply is more dangerous that inbound echo request because of ICMP amplification (either rate limit or deny this traffic). However, after decades of pondering this topic -- I've concluded that ICMP is more dangerous than useful, and thus it should be blocked in both directions, with logging on potentially spoofed outbound traffic.
...
5
If you're allowing ICMP echo requests (type 8, code 0), then presumably you'll be allowing ICMP echo replies (type 0, code 0) back in. ICMP echo replies can be used for inverse mapping of a target network, even when there's a filtering device (such as a firewall on the perimeter). This is an old attack though and modern firewalls can easily block it ...
3
Some that come to mind:
Protecting against attacks (say a basic ICMP DDOS) coming from compromised machines within the company.
Preventing compromised machines from easily announcing their presence to C&C
As part of a "default deny" policy to only explicitly permit traffic. This gives you a very high security posture, at a high cost to convenience.
...
2
ICMP was designed to help determine characteristics of the network. PING is an application of ICMP.
ICMP has two modes of operation:
Query the network by requesting packets and interpreting the answer
Report non-transient error conditions through error messages
The errors are produced in special conditions such as:
Network is unreachable: this would ...
2
I don't know of any such attack. That doesn't mean no such attack ever existed -- just that nothing pops to mind at the moment.
There are a few others that are related, which you might possibly have been thinking of:
Back in the day, the "ping of death" was a malicious ICMP packet that crashed the recipient computer, but it did not allow execution of ...
1
... are these attack vectors still something one should worry about?
No, not really.
I would venture to guess that few, if any, commercial firewalls accept LSRR/SSRR packets. It might even be the case that backbone routers drop these packets. Assuming your target is using some sort of home brew of iptables/pf it seems likely that rules to block these ...
1
Instead of answering the primary question of "what are the security risks of ping", I'll answer your sub-question of "Is it a good idea to block/disable on production web servers"
I think we can find a balance between security and utility here. Support staff generally find ping useful when checking the latency or availability of a certain node. Security ...
Only top voted, non community-wiki answers of a minimum length are eligible
