Slashdot Mirror
Examining ICMP Flaws
An anonymous reader writes "A recent internet-draft pointed out a number of security flaws in the design of the ICMP protocol. Most open source projects and vendors have addressed the flaws to some level, but this interesting article on KernelTrap examines the true extent of the problem, and how so far only OpenBSD has implemented all possible counter-measures. Theo de Raadt is quoted saying, "here we have a 20 year old protocol, a part of the Internet infrastructure that hasn't been touched in 10 years and we were all sure was right, and now is cast in doubt.""
"We don't put HTTP servers in the kernel." Umm, khttpd is pretty much an http server in the kernel. But more on topic, what a pain in the ass it would be to have to install and maintain yet another network server. I'd rather just have it in the kernel personally. If I really had a problem with it, I'd take it out. That's the beauty of Linux.
I wasn't really familier with ICMP, so did a quick google. Found couple of good links
You must be new around here...we don't really even advocate reading the article, and absolutely forbid background research...
Before you mod me funny, think, perhaps I was insightfully funny?
The scary thing is that the parent is talking about ICMP without actually knowing what it is.
You see, this is one of the failures of the moderation system: when someone posts something like this, it seems intelligent because it mentions a lot of familiar things, but overally it's not even making sense. The problem is that moderators work like this:
Argument: check
Clear line of thinking: check
Windows comparison: check
The problem is that this checklist does not include VERIFYING THINGS like what ICMP is. This is how the parent got +5, insightful while it's one of the most misinformed posts i've seen in a while.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
How the heck did this get modded insightful?
ICMP runs on a different layer than all of the services you mentioned. ICMP is a network layer protocol (like IP and IPv6, also called "layer 3"), and all the protocols you mentioned are application layer (layer 7) protocols. There's no direct comparison to be made to any of the protocols (HTTP, SMB, FTP and NFS) you mentioned.
If you want to compare having ICMP in the kernel to other sinilar protocols, your best argument (if you can call it that) is that we should have *IP*, another layer 3 protocol, "running as an ordinary user process, not root, and especially not as a kernel process." Obviously, IP *is* included in the kernel, for plenty of good reasons. Comparing ICMP to application-layer protocols like HTTP holds no weight whatsoever, unless you're completely ignorant of network fundamentals.
How it got modded to +5 Insightful baffles me. I'd have thought this crowd would have a better handle on the basics.
I think you could send a redirect via ICMP too, to generate your own man-in-the-middle attack. It's been too long since I've read the RFC.
DHCP has a whole bunch of issues too. For example, what if a DHCP client gets a DHCPACK from some machine? I'll bet that it would just reconfigure itself using the information in the packet. Bam, you've got a man-in-the-middle attack.
Help me out here, I seriously want to understand you comment. How can ICMP outlined in RFC792 http://www.ietf.org/rfc/rfc0792.txt?number=792/ allow for a sequence number when it is designed as an unreliable protocol without a port number or sequence number in the header? I mean unless we rewrite ICMP as a layer four protocol I don't see how we can prevent this?
We knew about the problems with ICMP when we first designed applications around it in the mid 80s. But at that time it just was not critical or exposed enough for us to really spend too much time planning workarounds or suggesting changes to the specification.
At that time we really didnt think that there would be such a huge number of users for what we thought was something with a very limited audience.
Wow. It is about time to stop buying Cisco products. Their idea of security is calling people who help them make it better "terrorists". No fucking thanks.
My other car is first.
Regardless I see greater challenges for ICMP with much more complicated answers needed. Until then I still see old school acl's as the best prevention, I will have to owe everyone some change on those two cents.
This seems very typical of science in all fields. An unproven theory goes unrebutted for some time untill someone realizes we made a big mistake. The world was once flat remember guys! One thing this should point us to is that no matter how solid something appears, it will always be broken whether it be a theory, a protocol or yes even the fortress known as open bsd *duck* Jokes a side, remember nothing is secure.
Later,
Phil
IRC networks have been plagued with ICMP unreachables for years
u ke.html
http://www.rs-labs.com/papers/tacticas/ircutils/p
nothing new to see here, move along.
I run OpenBSD stable, and some belligerent asshole stays up all night worrying about the best possible response to the latest threats. Sure, I will buy a CD http://openbsd.org/items.html#37.
And Theo, thank you for being a belligerent asshole for the good guys.
If Cisco wants to "Empower the Internet Generation" then they should show a little more old-fashioned Internet Netiquette and proactively share new ideas and address security issues openly with the community rather than cowardly behind lawyer's doors. (Afterall, haven't they too benefited from all the opensource code they've integrated it into their products?)
Take a millicent, give a millicent.
it is not illegal to write the code. It would be useful to see if this hack does work. If so, then it will point out weaknesses in the networks as well as an issue with the protocol.
Now, with that said, Yeah, it is theft, and it is federal. So, I am sure that s?he will not be using illegally. Or at least, I hope not.
I prefer the "u" in honour as it seems to be missing these days.
becuase you don't need to physically go to a computer to break into it
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Idiots like you are why we can't use PMTU discovery reliably.
Get it through your thick skull: ICMP != PING
ICMP is the *PROTOCOL* that ping uses, but other things use ICMP as well.