Malicious ICMP tunneling: defense against the vulnerability

Authors:
Abhishek Singh;Ola Nordström;Chenghuai Lu;Andre L. M. Dos Santos
Affiliations:
Georgia Tech. Information Security Center, Center for Experimental Research in Computer Systems, College of Computing, Georgia Institute of Technology, Atlanta, GA;Georgia Tech. Information Security Center, Center for Experimental Research in Computer Systems, College of Computing, Georgia Institute of Technology, Atlanta, GA;Georgia Tech. Information Security Center, Center for Experimental Research in Computer Systems, College of Computing, Georgia Institute of Technology, Atlanta, GA;Georgia Tech. Information Security Center, Center for Experimental Research in Computer Systems, College of Computing, Georgia Institute of Technology, Atlanta, GA
Venue:
ACISP'03 Proceedings of the 8th Australasian conference on Information security and privacy
Year:
2003

Citing 0
Cited 5

A novel covert channel based on the IP header record route option

International Journal of Advanced Media and Communication
Simulation, optimisation and integration of covert channels, intrusion detection and packet filtering systems

GIIS'09 Proceedings of the Second international conference on Global Information Infrastructure Symposium
The research on information hiding based on command sequence of FTP protocol

KES'05 Proceedings of the 9th international conference on Knowledge-Based Intelligent Information and Engineering Systems - Volume Part III
Traceroute based IP channel for sending hidden short messages

IWSEC'06 Proceedings of the 1st international conference on Security
Cloak: a ten-fold way for reliable covert communications

ESORICS'07 Proceedings of the 12th European conference on Research in Computer Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper presents a systematic solution to the problem of using ICMP tunneling for covert channel. ICMP is not multiplexed via port numbers and the data part of the ICMP packet provides considerable bandwidth for malicious covert channels. These factors make it an integral part of many malicious software like remote access and denial of service attack tools. These tools use ICMP to establish covert communication channels. In this paper a stateless model is proposed to prevent ICMP tunneling. A Linux kernel module was implemented to demonstrate the proposed stateless solution. The module enforces a fixed payload policy for ICMP packets and virtually eliminates ICMP tunneling which arises due to the data carrying capability of ICMP. The performance impact on end hosts and routers due to the stateless monitoring model is described.