Hacker News Reader

Comment by INTPenis | Hacker News Reader

Of course but security is multi layered and blocking ICMP is one layer, while using internal DNS is another. It's mitigation that costs nothing.

View on HN

What does blocking ICMP get you? (other than a broken network) Blocking ICMP fragments is fine if you are worried about DDoS attacks, but don't blanket block everything ICMP (especially ICMPv6).

Just curious as to what problem you are solving by blocking ICMP.

ICMP ECHO has an additional payload field thay we often ignore. Some malware is known to use the ICMP payload as a C&C channel, or to tunnel out stolen information: https://en.wikipedia.org/wiki/ICMP_tunnel

You can tunnel inside almost any protocol. That's not a great reason. Valid, sure; good, no.

While true - ICMP is a ubiquitous protocol used all over the internet, but computers and network devices a like.

It also often gets overlooked, so while "you can tunnel inside almost any protocol", it is very common for malware to use ICMP for C&C.

This isn't to say ICMP should be blocked completely. But limiting the size and the value of the payload in ICMP ECHO requests and replies can definitely help.

> it is very common for malware to use ICMP for C&C.

This is not true in the slightest.

And it'd only be realistic on windows as all other prevalent platforms require administrative privileges for such.

Good thing malware doesn't have administrative privileges.

Unless you're a member of ac1db1tch3z and happen to be sitting on a particularly big pile of local 0days, as a malware developer you wouldn't rely on having such privileges.

Lets be real here, ICMP is a particularly bad protocol for malware and that's why nobody uses it.

ICMP is a valuable diagnostics and control tool. Blocking it doesn't come without a cost.

Reply on news.ycombinator.com