Slashdot Mirror
Covert Channel: ASCII Art Over ICMP
An anonymous reader writes "Have you ever had a particularly lossy Cisco ping, which you were sure was trying to tell you something? I mean, really *tell* you something. Echoart allows you to return a simple ascii art image in response to a Cisco-style ping."
The Army reading list
I did up a silly perl script, using curses, that ran an ascii art animation of stick figure A throwing a grenade at stick figure B.
;)
I, the guy that owned the machine, was figure A. The guy trying to telnet to my machine was figure B. After figure B was reduced to a crater I printed some message along the lines of "you aren't welcome here, go away".
Ran it out of hosts.deny and left it up for quite a while. I was bored, sounded more fun than setting up a firewall like I should have.
It worked surprisingly well, even with the windows telnet client.
Lots of potential for unique idents, a revival of the old ASCII art, and a return of classic IRC "finger" gags to the mainstream - what more could you want?
(The IRC thing - well, a friend of mine used to have ASCII art of a hand throwing the finger. Thus, anyone who fingered him got fingered in return...)
IMHO this does, as parent says, seem like a very cool and very harmless bit of fun screwing with corporate level technology. It would also have a good place in the corporate market - if, say, MS incorporated something similar into Longhorn, it could use a Windows logo as its default reply, or various Linux distros could use a Tux, a BSD demon, or a fedora. Other brand-name companies could work an ASCII version of their logo into it.
(Not to mention, you could also use those 70 lines to advertise - provide your company's contact info, or if you're a hosting company, give your pingers a free list of your latest packages. But how long til someone abuses it? Sure, the goatse guy is OK as net humour, but how long til we're fighting off idiots who want to incorporate spam messages in these ping responses?)
"It is dark. You are likely to be eaten by a grue." -- Zork
ok, so you are going to go through all of that trouble to run code like that as root. great idea!
tcpdump -lni dc0 'icmp[0] == 8' | \
while read x input x ip x; do \
nemesis-icmp -v -i 0 -S ${ip//:/} -D $input -P $input_file; \
done
substitute hping or whatever your tool of choice is.
and if you want it to only reply to specific OS's then obsd's tcpdump can do it with -o and an extra condition in the script.
-nocfed
A Cisco ping command basically spews out some number of ping packets as fast as possible.
:)
The results then get displayed in order, with a dot displayed for every packet that times out and a ! displayed for every packet that actually gets echoed back.
So the upshot of this is that the echo art program isn't actually sending artwork, it's responding to packets or not responding to packets based on the artwork file you give it, which will cause it to draw the art on the other side, the guy doing the pinging.
Neat trick, actually.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
It's actually slightly more complex than that..
Cisco style ping: "A '.' is printed for every packet sent and a backspaced '!' for every valid response."
So it prints a . then backspaces over it and prints a ! if it gets a response.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.