3 ms·

Yup, I've had this: "ICMP is a security hole" lets turn it off. such a tedious conversation to have with the networks(!) team

droopyEyelids 12y ago
TCP and UDP are the real culprits. As a network admin with unquestionable authority I always advocate for banning them on my networks.
- danmaz74 12y ago
  Well, after all some 99.9% of successful hacking attacks use those protocols. They're definitively very dangerous.
  - psykovsky 12y ago
    Dude, I bet those protocols were invented by humans. Humans mostly do destructive stuff. They're definitely very dangerous.
georgerobinson 12y ago
Can you explain how ICMP is insecure? Is it just ping being exploited?
- MichaelCrawford 12y ago
  The kernel doesn't pass ICMP packets through to userspace.
  - georgerobinson 12y ago
    I see. But why is this a security threat?
    - MichaelCrawford 12y ago
      yhbt
- KaiserPro 12y ago
  I'm not sure of the specific reasons in this case. I think it was to do with possible internal host discovery. (I'm not sure how that would work in practice. Yes you can use traceroute, but I'm not sure how that would work behind nat, without forcing a client to open up a port first) Possibly its to do with worry about smurf attacks, but then most firewalls > 2004 should deal with that gracefully.(old company though...) Have a look here, its an easy read and has a nice list: http://resources.infosecinstitute.com/icmp-attacks/ http://resources.infosecinstitute.com/icmp-attacks/
- scurvy 12y ago
  ICMP can be used to affect routing on insecurely configured hosts. That might be an exploit vector? Circa 1995-97 there was the ping of death....but that was 20 years ago. Most of these security best practices are like building code. They get written down and are never updated. For example, showers need a 2" drain pipe but tubs only need 1.5". The theory was that a backed up drain would flood a bathroom with a lower shower rim very quickly. It would take much longer with a tub (higher side wall). No one ever bothered to update the regulations once we stopped allowing 5 gpm showerheads. There's no reason put into it. Just "nope it says 2" required b/c we've always required 2"." "Why?" "Because that's how it is." Same way with computer security.
  - gonzo 12y ago
    "Code is not prescription."

droopyEyelids 12y ago

TCP and UDP are the real culprits. As a network admin with unquestionable authority I always advocate for banning them on my networks.

danmaz74 12y ago
Well, after all some 99.9% of successful hacking attacks use those protocols. They're definitively very dangerous.
- psykovsky 12y ago
  Dude, I bet those protocols were invented by humans. Humans mostly do destructive stuff. They're definitely very dangerous.

georgerobinson 12y ago

Can you explain how ICMP is insecure? Is it just ping being exploited?

MichaelCrawford 12y ago
The kernel doesn't pass ICMP packets through to userspace.
- georgerobinson 12y ago
  I see. But why is this a security threat?
  - MichaelCrawford 12y ago
    yhbt
KaiserPro 12y ago
I'm not sure of the specific reasons in this case. I think it was to do with possible internal host discovery. (I'm not sure how that would work in practice. Yes you can use traceroute, but I'm not sure how that would work behind nat, without forcing a client to open up a port first) Possibly its to do with worry about smurf attacks, but then most firewalls > 2004 should deal with that gracefully.(old company though...) Have a look here, its an easy read and has a nice list: http://resources.infosecinstitute.com/icmp-attacks/ http://resources.infosecinstitute.com/icmp-attacks/
scurvy 12y ago
ICMP can be used to affect routing on insecurely configured hosts. That might be an exploit vector? Circa 1995-97 there was the ping of death....but that was 20 years ago. Most of these security best practices are like building code. They get written down and are never updated. For example, showers need a 2" drain pipe but tubs only need 1.5". The theory was that a backed up drain would flood a bathroom with a lower shower rim very quickly. It would take much longer with a tub (higher side wall). No one ever bothered to update the regulations once we stopped allowing 5 gpm showerheads. There's no reason put into it. Just "nope it says 2" required b/c we've always required 2"." "Why?" "Because that's how it is." Same way with computer security.
- gonzo 12y ago
  "Code is not prescription."