6 ms·

Off-Path Network Traffic Manipulation via Revitalized ICMP Redirect (2022) [pdf]

40 points by TechBro8615 3y ago

greyface- 3y ago
Yet another reason to implement BCP 38 on your network. https://www.ietf.org/rfc/bcp/bcp38.html https://www.ietf.org/rfc/bcp/bcp38.html
raggi 3y ago
Someone needs to write "ICMP the good bits", because the traditional response of disable all ICMP isn't great.
- cyberax 3y ago
  Basically, you need: "destination unreachable", "packet too big", "time exceeded", "echo request/reply". Everything else is pretty much useless and/or harmful.
  - NoZebra120vClip 3y ago
    Why do you "need" echo request and reply, if you can basically get this functionality in a dozen different ways? Disabling pings is more or less security theater, when every pentester knows how to work around it and find live hosts.
    - cyberax 3y ago
      Because they are useful for _you_. Ping utility is present everywhere (even on Windows), while nmap requires installation.
- stefan_ 3y ago
  Well thats kinda what happened in IPv6 we were all supposed to move to long ago.
  - janci 3y ago
    From the linked paper: > As a result, our attacks can be easily extended to IPv6 net- works to manipulate a victim originator’s network traffic.
dfawcus 3y ago
For IPv4, this could be mitigated on the host by making use of the 16 bit ID field. It is used together with the SRC-IP,DST-IP,PROTO tuple. So if the host generated IDs on such a basis, maintaining a tuple indexed set of IDs (with some time window), then before any higher level validation is performed , a simple check that the ID in the embedded packet is in the correct range for the SRC/DST/PROTO combo would allow such packets to be discarded. An additional bit could be maintained to indicate that an attack was detected, just in case some device tries to scan through the 16 bit range. Hence catching that on a per target basis. This would allow the on local LAN case to be protected against, and would also serve to protect against the remote case, but that should really be handled by the edge router. e.g. my home router currently shows a number of filtered inbound redirects: 190 deny icmp any any redirect (542 matches) For IPv6 one could probably perform a similar scheme, but using the flow-id field.

40 points by TechBro8615 3y ago

Yet another reason to implement BCP 38 on your network. https://www.ietf.org/rfc/bcp/bcp38.html https://www.ietf.org/rfc/bcp/bcp38.html

raggi 3y ago

Someone needs to write "ICMP the good bits", because the traditional response of disable all ICMP isn't great.

cyberax 3y ago
Basically, you need: "destination unreachable", "packet too big", "time exceeded", "echo request/reply". Everything else is pretty much useless and/or harmful.
- NoZebra120vClip 3y ago
  Why do you "need" echo request and reply, if you can basically get this functionality in a dozen different ways? Disabling pings is more or less security theater, when every pentester knows how to work around it and find live hosts.
  - cyberax 3y ago
    Because they are useful for _you_. Ping utility is present everywhere (even on Windows), while nmap requires installation.
stefan_ 3y ago
Well thats kinda what happened in IPv6 we were all supposed to move to long ago.
- janci 3y ago
  From the linked paper: > As a result, our attacks can be easily extended to IPv6 net- works to manipulate a victim originator’s network traffic.

dfawcus 3y ago

For IPv4, this could be mitigated on the host by making use of the 16 bit ID field. It is used together with the SRC-IP,DST-IP,PROTO tuple. So if the host generated IDs on such a basis, maintaining a tuple indexed set of IDs (with some time window), then before any higher level validation is performed , a simple check that the ID in the embedded packet is in the correct range for the SRC/DST/PROTO combo would allow such packets to be discarded. An additional bit could be maintained to indicate that an attack was detected, just in case some device tries to scan through the 16 bit range. Hence catching that on a per target basis. This would allow the on local LAN case to be protected against, and would also serve to protect against the remote case, but that should really be handled by the edge router. e.g. my home router currently shows a number of filtered inbound redirects: 190 deny icmp any any redirect (542 matches) For IPv6 one could probably perform a similar scheme, but using the flow-id field.