Skip to content

ICMP redirect & tunneling

1. Context & stakes

Hijack routing via ICMP redirect; covert ICMP channel.

ICMP redirect messages let a router tell a host of a better next hop, and hosts historically obey them without authentication, so a forged redirect reroutes a victim's traffic through the attacker. ICMP echo payloads also carry arbitrary bytes, turning ping into a covert tunnel. Ignoring ICMP redirects and inspecting echo payloads counter the two abuses.

2. Theory

ICMP carries control messages. A redirect (type 5) tells a host of a 'better' next-hop, so a forged one reroutes a victim through the attacker. And because the echo (ping) payload is arbitrary and rarely inspected, ICMP also serves as a covert tunnel - data smuggled in echo request/reply bodies.

3. Attack (PoC)

netlab-icmp attack --i-own-this-network --iface veth-host
  1. ICMP redirect -> MITM
  2. Tunnel data in the ICMP payload

4. Detection

netlab-icmp detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Ignore redirects (sysctl)
  • DPI / payload inspection

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading