Tag Info

Hot answers tagged

55

Compared to other IP protocols ICMP is fairly small, but it does serve a large number of disparate functions. At its core ICMP was designed as the debugging, troubleshooting, and error reporting mechanism for IP. This makes it insanely valuable so a lot of thought needs to into shutting it down. It would be a bit like tacking >/dev/null 2>&1 to the ...


22

The ICMP Echo protocol (usually known as "Ping") is mostly harmless. Its main security-related issues are: In the presence of requests with a fake source address ("spoofing"), they can make a target machine send relatively large packets to another host. Note that a Ping response is not substantially larger than the corresponding request, so there is no ...


14

ICMP exists for a reason, and not all of that reason is ping. It's the "meta" protocol that is used to communicate control messages about the network itself. Have a look at ICMP on Wikipedia to get a better idea of what it is and what it's for. Other ICMP messages also include destination host unreachable, fragmentation required, congestion control, TTL ...


14

ICMP has a data component to it. It can be used to build tunnels, and this is not just a theory thing, it's available in the wild. It's been found by several different researchers as parts of malware toolkits. Not to mention there is a prominent howto on this topic, not to mention the wiki, or the hackaday ICMPTX uses the ICMP echo and ICMP reply. ICMP ...


7

It is true that ICMP can be used by attackers to gain information, transport data covertly, etc. It is also true that ICMP is extremely useful, and that disabling it can often cause problems. Traceroute does in fact use ICMP, so disallowing certain ICMP types will break it. The question highlights the classic balance of security and functionality, and it's ...


6

I think that outbound echo reply is more dangerous that inbound echo request because of ICMP amplification (either rate limit or deny this traffic). However, after decades of pondering this topic -- I've concluded that ICMP is more dangerous than useful, and thus it should be blocked in both directions, with logging on potentially spoofed outbound traffic. ...


5

If you're allowing ICMP echo requests (type 8, code 0), then presumably you'll be allowing ICMP echo replies (type 0, code 0) back in. ICMP echo replies can be used for inverse mapping of a target network, even when there's a filtering device (such as a firewall on the perimeter). This is an old attack though and modern firewalls can easily block it ...


4

The theory is that it reduces the amount of information available to attackers. A good traceroute can be most informative. In addition, and in theory, every additional service running on a machine is a possible source of vulnerabilities. The thingumajig that answers ICMP requests is no exception, although they are mostly very old and small thingumajigs ...


3

Some attackers may use outbound ICMP packets to send data out of victim machine, read more about Covert channel.


3

Some that come to mind: Protecting against attacks (say a basic ICMP DDOS) coming from compromised machines within the company. Preventing compromised machines from easily announcing their presence to C&C As part of a "default deny" policy to only explicitly permit traffic. This gives you a very high security posture, at a high cost to convenience. ...


3

I had the same problem, constant pings to 202.39.253.11. I have removed ASUS Ai SUITE II and ran the uninstall cleaner and the pings have stopped The cleaner was at http://rog.asus.com/forum/showthread.php?28319-AI-Suite-II-uninstall-cleaner


2

Snort does not block packets. Snort is an intrusion detection and prevention system. The React rule option is intended to be used with TCP connections. The react keyword, when it matches, will generate multiple reset packets to both end of the connection to shoot it down. Since ICMP is a datagram protocol that operates at the network level, there is no ...


2

ICMP was designed to help determine characteristics of the network. PING is an application of ICMP. ICMP has two modes of operation: Query the network by requesting packets and interpreting the answer Report non-transient error conditions through error messages The errors are produced in special conditions such as: Network is unreachable: this would ...


2

I don't know of any such attack. That doesn't mean no such attack ever existed -- just that nothing pops to mind at the moment. There are a few others that are related, which you might possibly have been thinking of: Back in the day, the "ping of death" was a malicious ICMP packet that crashed the recipient computer, but it did not allow execution of ...


2

since they are all echo's... i dont think they are for tunneling BUT! you might be hacked. Some malwares are sending ping-like packets to weird ip addresess or websites. these are mainly bot net malwares... Your PC is saying I AM HERE .... I AM HERE by sending those echo messages and at some point, when there will be an attack, hacker will actually own the ...


2

The ICMP timestamp response contains the remote host's date and time. This information could theoretically be used against some systems to exploit weak time-based random number generators in other services


1

A gratuitous ARP is basically an ARP response that never had a request for it and is how most ARP spoofing programs work. Normally you send an ARP request and wait for the ARP response. A gratuitous ARP is when you just send your details even though there was no request. These can happen legitimately when say your IP or MAC address change so you can update ...


1

... are these attack vectors still something one should worry about? No, not really. I would venture to guess that few, if any, commercial firewalls accept LSRR/SSRR packets. It might even be the case that backbone routers drop these packets. Assuming your target is using some sort of home brew of iptables/pf it seems likely that rules to block these ...


1

Instead of answering the primary question of "what are the security risks of ping", I'll answer your sub-question of "Is it a good idea to block/disable on production web servers" I think we can find a balance between security and utility here. Support staff generally find ping useful when checking the latency or availability of a certain node. Security ...


1

You'll want to capture the packets with a sniffer, such as Wireshark, and look at the payload and source addresses, and see if it is expected traffic.



Only top voted, non community-wiki answers of a minimum length are eligible