ICMP - Vulnerabilities
ICMP is a Network layer protocol used by network devices to exchange error messages and operational information. Some of the most well known diagnostic tools that leverage ICMP include Ping and Traceroute.
Despite its utility for diagnostic and control purposes, ICMP can be exploited in several types of network attacks. Here are some of the common network attacks that leverage ICMP:
-
Ping Flood: This is a type of Denial of Service (DoS) attack where the attacker overwhelms the target with ICMP Echo Request (ping) packets. This can consume both outbound and inbound bandwidth, causing network congestion or slowing down the target's internet connection, potentially rendering it unresponsive.
-
Ping of Death: In this attack, the attacker sends malicious pings to a target. These ICMP packets are oversized or malformed, exploiting vulnerabilities in older, less secure systems. The goal is to cause the target system to freeze, crash, or reboot because of buffer overflows or other failures in handling these packets.
-
ICMP Smurf Attack: This is a reflection-based network amplification attack. The attacker sends ICMP Echo Request packets to a network's broadcast address with the source IP spoofed to the target's IP address. All hosts on the broadcast network respond to the Echo Request, overwhelming the target with ICMP Echo Reply packets.
-
ICMP Redirect Attack: This involves an attacker sending ICMP redirect messages to network devices. By doing so, the attacker can alter the routing tables of the devices, potentially redirecting traffic through a malicious network device for eavesdropping or data modification.
-
ICMP Tunneling: Although more of a method for bypassing network security measures than an attack per se, ICMP tunneling encapsulates data within ICMP packets to sneak through firewalls or evade network monitoring tools that might not scrutinize ICMP traffic as closely as other protocols.
-
ICMP Flood Attack: Similar to a Ping Flood, this broader category of DoS attack involves sending a large number of ICMP packets without waiting for replies. Various ICMP message types can be used, not just Echo Request messages.
-
Traceroute Flood: Utilizing the ICMP Time Exceeded messages generated by routers in response to packets with expired TTL (Time To Live), an attacker can flood a target with these indirect ICMP messages by initiating traceroute processes with spoofed source IP addresses.
These attacks exploit the fundamental mechanisms and features of ICMP for malicious purposes. Mitigating such attacks often involves configuring firewalls and intrusion prevention systems to monitor and limit ICMP traffic, ensuring systems and devices are updated to patch known vulnerabilities, and implementing rate limiting and anti-spoofing measures.
For more information, take a look at ICMP - Mitigating Vulnerabilities to see how to deal with some of these security issues.
Links:
https://networklessons.com/cisco/ccnp-route/icmp-internet-control-message-protocol