Hacker News Reader

Comment by scurvy | Hacker News Reader

What does blocking ICMP get you? (other than a broken network) Blocking ICMP fragments is fine if you are worried about DDoS attacks, but don't blanket block everything ICMP (especially ICMPv6).

Just curious as to what problem you are solving by blocking ICMP.

View on HN

ICMP ECHO has an additional payload field thay we often ignore. Some malware is known to use the ICMP payload as a C&C channel, or to tunnel out stolen information: https://en.wikipedia.org/wiki/ICMP_tunnel

You can tunnel inside almost any protocol. That's not a great reason. Valid, sure; good, no.

While true - ICMP is a ubiquitous protocol used all over the internet, but computers and network devices a like.

It also often gets overlooked, so while "you can tunnel inside almost any protocol", it is very common for malware to use ICMP for C&C.

This isn't to say ICMP should be blocked completely. But limiting the size and the value of the payload in ICMP ECHO requests and replies can definitely help.

> it is very common for malware to use ICMP for C&C.

This is not true in the slightest.

And it'd only be realistic on windows as all other prevalent platforms require administrative privileges for such.

Good thing malware doesn't have administrative privileges.

Unless you're a member of ac1db1tch3z and happen to be sitting on a particularly big pile of local 0days, as a malware developer you wouldn't rely on having such privileges.

Lets be real here, ICMP is a particularly bad protocol for malware and that's why nobody uses it.

Reply on news.ycombinator.com