Hacker News Reader

You can tunnel inside almost any protocol. That's not a great reason. Valid, sure; good, no.

While true - ICMP is a ubiquitous protocol used all over the internet, but computers and network devices a like.

It also often gets overlooked, so while "you can tunnel inside almost any protocol", it is very common for malware to use ICMP for C&C.

This isn't to say ICMP should be blocked completely. But limiting the size and the value of the payload in ICMP ECHO requests and replies can definitely help.

> it is very common for malware to use ICMP for C&C.

This is not true in the slightest.

And it'd only be realistic on windows as all other prevalent platforms require administrative privileges for such.

Good thing malware doesn't have administrative privileges.

Unless you're a member of ac1db1tch3z and happen to be sitting on a particularly big pile of local 0days, as a malware developer you wouldn't rely on having such privileges.

Lets be real here, ICMP is a particularly bad protocol for malware and that's why nobody uses it.

Reply on news.ycombinator.com