Tag Info

Hot answers tagged

66

Compared to other IP protocols ICMP is fairly small, but it does serve a large number of disparate functions. At its core ICMP was designed as the debugging, troubleshooting, and error reporting mechanism for IP. This makes it insanely valuable so a lot of thought needs to into shutting it down. It would be a bit like tacking >/dev/null 2>&1 to the ...


33

The ICMP Echo protocol (usually known as "Ping") is mostly harmless. Its main security-related issues are: In the presence of requests with a fake source address ("spoofing"), they can make a target machine send relatively large packets to another host. Note that a Ping response is not substantially larger than the corresponding request, so there is no ...


18

ICMP exists for a reason, and not all of that reason is ping. It's the "meta" protocol that is used to communicate control messages about the network itself. Have a look at ICMP on Wikipedia to get a better idea of what it is and what it's for. Other ICMP messages also include destination host unreachable, fragmentation required, congestion control, TTL ...


15

ICMP has a data component to it. It can be used to build tunnels, and this is not just a theory thing, it's available in the wild. It's been found by several different researchers as parts of malware toolkits. Not to mention there is a prominent howto on this topic, not to mention the wiki, or the hackaday ICMPTX uses the ICMP echo and ICMP reply. ICMP ...


8

It is true that ICMP can be used by attackers to gain information, transport data covertly, etc. It is also true that ICMP is extremely useful, and that disabling it can often cause problems. Traceroute does in fact use ICMP, so disallowing certain ICMP types will break it. The question highlights the classic balance of security and functionality, and it's ...


6

I think that outbound echo reply is more dangerous that inbound echo request because of ICMP amplification (either rate limit or deny this traffic). However, after decades of pondering this topic -- I've concluded that ICMP is more dangerous than useful, and thus it should be blocked in both directions, with logging on potentially spoofed outbound traffic. ...


5

"ICMPTX" is a very, very minor risk in most real-world situations. It's basically a way for two cooperating programs to sneak data past a firewall that's only looking for data exfiltration over traditional protocols (TCP, UDP, etc.). Unless your AWS VPC is infested with malware and your firewall is inspecting packets for attempted data exfiltration, I ...


5

If you're allowing ICMP echo requests (type 8, code 0), then presumably you'll be allowing ICMP echo replies (type 0, code 0) back in. ICMP echo replies can be used for inverse mapping of a target network, even when there's a filtering device (such as a firewall on the perimeter). This is an old attack though and modern firewalls can easily block it ...


4

The theory is that it reduces the amount of information available to attackers. A good traceroute can be most informative. In addition, and in theory, every additional service running on a machine is a possible source of vulnerabilities. The thingumajig that answers ICMP requests is no exception, although they are mostly very old and small thingumajigs ...


4

I had the same problem, constant pings to 202.39.253.11. I have removed ASUS Ai SUITE II and ran the uninstall cleaner and the pings have stopped The cleaner was at http://rog.asus.com/forum/showthread.php?28319-AI-Suite-II-uninstall-cleaner


3

In general, tunneling one protocol under another is done because there are networking devices in between that only can handle or allow specific protocols. If routers or firewalls allow (don't drop) and don't record (don't log) the full ICMP packet, then just looking at the protocol shows pings or something happening. This causes the covert comms channel to ...


3

Snort does not block packets. Snort is an intrusion detection and prevention system. The React rule option is intended to be used with TCP connections. The react keyword, when it matches, will generate multiple reset packets to both end of the connection to shoot it down. Since ICMP is a datagram protocol that operates at the network level, there is no ...


3

Some attackers may use outbound ICMP packets to send data out of victim machine, read more about Covert channel.


3

Some that come to mind: Protecting against attacks (say a basic ICMP DDOS) coming from compromised machines within the company. Preventing compromised machines from easily announcing their presence to C&C As part of a "default deny" policy to only explicitly permit traffic. This gives you a very high security posture, at a high cost to convenience. ...


2

Instead of answering the primary question of "what are the security risks of ping", I'll answer your sub-question of "Is it a good idea to block/disable on production web servers" I think we can find a balance between security and utility here. Support staff generally find ping useful when checking the latency or availability of a certain node. Security ...


2

I don't know of any such attack. That doesn't mean no such attack ever existed -- just that nothing pops to mind at the moment. There are a few others that are related, which you might possibly have been thinking of: Back in the day, the "ping of death" was a malicious ICMP packet that crashed the recipient computer, but it did not allow execution of ...


2

since they are all echo's... i dont think they are for tunneling BUT! you might be hacked. Some malwares are sending ping-like packets to weird ip addresess or websites. these are mainly bot net malwares... Your PC is saying I AM HERE .... I AM HERE by sending those echo messages and at some point, when there will be an attack, hacker will actually own the ...


2

The ICMP timestamp response contains the remote host's date and time. This information could theoretically be used against some systems to exploit weak time-based random number generators in other services


2

Ping and Traceroute are required to troubleshoot networks. With modern firewalls, and security tools there is very little, and bordering on non-existant chance of either protocol being used successfully in an malicious way. In 1996, sure it was a problem, but it is now 2015 almost 20 years later, and blocking these only leads to dramatically increased ...


2

The general "risk" of ping is worrying about someone using the icmp protocol to either exfiltrate data or control malware. I think many times it was disabled as an "I don't know why I need it so I'll disable it mentality". This is why it became the default rule. While these are both real valid concerns if you are still in the "I have a perimeter" mentality ...


2

ICMP was designed to help determine characteristics of the network. PING is an application of ICMP. ICMP has two modes of operation: Query the network by requesting packets and interpreting the answer Report non-transient error conditions through error messages The errors are produced in special conditions such as: Network is unreachable: this would ...


1

Is it must for a packet sniffer to enable promiscuous mode?Can packets be sniffed without the NIC being in promiscuous mode? No it is not a must and sniffing can be done in non-promiscuous too. Also when in promiscuous mode the NIC accepts all packets which are not addressed to it's MAC address.Does it also mean that it responds to all ...


1

Simply put, if not in promiscuous mode, NIC will drop any L2 traffic that is not intended for it. Any and all traffic that is neither directly addressed to the NIC nor a {broad,multi}cast will be dropped before it reaches the OS assuming the NIC behaves normally.


1

On the one hand, as it has been stated, I think that the DDoS risk is definitely not the reason why you should block ICMP. On the other hand, if ICMP or DNS is allowed, you can open a tunnel with a remote host over this protocol and totally bypass the captive portal. If those protocols are not blocked (or at the very least monitored), you basically have ...


1

As per this StackExchange answer, you can find it using lsof by looking for st=07 on a raw socket: # lsof -n | grep -i st=07 ping 19241 gowenfawr 3u raw 0t0 477269 00000000:0001->00000000:0000 st=07 # ps aux | grep 1924[1] gowenfawr 19241 0.0 0.0 8596 832 pts/0 S+ 07:26 0:00 ping ...


1

Regarding periodic (1 second interval) ICMP from Ai Suite II, simply disable the "Network iControl" option to stop the pings. No need to completely remove this ASUS service.


1

A gratuitous ARP is basically an ARP response that never had a request for it and is how most ARP spoofing programs work. Normally you send an ARP request and wait for the ARP response. A gratuitous ARP is when you just send your details even though there was no request. These can happen legitimately when say your IP or MAC address change so you can update ...


1

... are these attack vectors still something one should worry about? No, not really. I would venture to guess that few, if any, commercial firewalls accept LSRR/SSRR packets. It might even be the case that backbone routers drop these packets. Assuming your target is using some sort of home brew of iptables/pf it seems likely that rules to block these ...


1

You'll want to capture the packets with a sniffer, such as Wireshark, and look at the payload and source addresses, and see if it is expected traffic.



Only top voted, non community-wiki answers of a minimum length are eligible