RE: ICMP (Ping)

From: McGill, Lachlan (mcgilll1_at_anz.com)
Date: 09/09/03

  • Next message: gregh: "Re: Remotely manage Zone Alarm" 
    Date: Tue, 9 Sep 2003 08:34:07 +1000
To: "Chris Ess" <azarin@tokimi.net>, <security-basics@securityfocus.com>

    We must also remember that the variant of the Blaster worm: Nachi used ICMP pings to determine the next host to infect. Blocking ICMP in this instance would have been an effective deterrant.

    -----Original Message-----
    From: Chris Ess [mailto:azarin@tokimi.net]
    Sent: Tuesday, 9 September 2003 2:38 AM
    To: security-basics@securityfocus.com
    Subject: RE: ICMP (Ping)

    Okay. We've probably gotten slightly off-topic, but I figured I'd throw
    my two copper pieces in anyway. I'll provide one example for why blocking
    pings might be a good idea... and one where it doesn't matter if you
    block them or not. However, I'm no expert.

    * Saved by blocking pings: nmap

    Yes, nmap. Everyone on this list has used nmap or is hopefully familiar
    with what it does. For those of you who don't know, nmap is a
    portscanning utility.

    The first thing nmap appears to do before it actually runs a scan is ping
    the host. If it cannot ping the host, it returns:

    Note: Host seems down. If it is really up, but blocking our ping probes,
    try -P0

    nmap can be used to scan a host or a network. It's not a very nice or
    graceful way but it works. And, hey, Joe Q. Script-Kiddie doesn't care
    if it's graceful as long as it works.

    In this case, if you block pings, nmap won't bother to scan your machine
    unless the person running it has specified '-P0' on the command line. In
    which case, he'd better not be expecting results anytime soon.

    He can still come back later and run another scan, but if we assume that
    he's running nmap as his opening move, a machine that does not ping will
    be that much less likely to be targeted.

    But... if his opening move is different, how much safer will you be?

    This takes us to...

    * W32.Blaster.Worm et al

    Why am I bothering to include a worm here, you may wonder.

    To really oversimplify things, what is a worm other than a vulnerability
    scanner that then exploits said vulnerability? (As I said, to really
    oversimplify things.)

    Worms, and many vulnerability scanners, do not necessarily ping a host
    before they try to connect. In fact, I do not know of a worm that does
    ping the host whose IP it randomly generates before it tries to test (and
    then possibly exploit) the host. Some vulnerability scanners may not
    bother to ping because people have been blocking pings or other ICMP
    traffic from their machines -- or maybe just because it's too much bother.
    (If the machine isn't running a service, you'll just timeout after five
    minutes or so and keep going.)

    Blocking pings or other ICMP traffic not the magic piece of armor that
    will protect you from being attacked. It's a deterrent, nothing more.
    Think of it like barbed wire on the top of a fence -- some people will
    stay away from it and decide not to mess with whatever's inside, while
    those who really want to get in will continue to attempt different
    measures to gain entry. However, the barbed wire is no replacement for
    other, stronger measures, like electrifying the fence, employing armed
    guards and vicious dogs, and, for the extremely paranoid, land mines.

    Blocking pings is ultimately the decision of the administrators running
    the machine or network. For the paranoid, dropping pings is probably best
    for them. For my personal machine at home, though, I don't think the risk
    from responding to pings is high enough to cause concern. And, for the
    moment, having it respond to pings is useful to me.

    Sincerely,

    Chris Ess
    System Administrator / CDTT (Certified Duct Tape Technician)

    ---------------------------------------------------------------------------
    Captus Networks
    Are you prepared for the next Sobig & Blaster?
     - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
     - Precisely Define and Implement Network Security
     - Automatically Control P2P, IM and Spam Traffic
    FIND OUT NOW - FREE Vulnerability Assessment Toolkit
    http://www.captusnetworks.com/ads/42.htm
    ----------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    Captus Networks
    Are you prepared for the next Sobig & Blaster?
     - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
     - Precisely Define and Implement Network Security
     - Automatically Control P2P, IM and Spam Traffic
    FIND OUT NOW - FREE Vulnerability Assessment Toolkit
    http://www.captusnetworks.com/ads/42.htm
    ----------------------------------------------------------------------------

  • Next message: gregh: "Re: Remotely manage Zone Alarm"

    Relevant Pages

    • Re: Blocking ICMP
      ... So if you get a host unreachable response you know the host isn't there. ... So by blocking pings you have supplied two pieces of info to a potential ...
      (uk.telecom.broadband)
    • RE: ICMP (Ping)
      ... pings might be a good idea... ... Yes, nmap. ... If it cannot ping the host, ... scanner that then exploits said vulnerability? ...
      (Security-Basics)
    • Re: ICMP (Ping)
      ... If pings are a security threat to your ... > ICMP pings to determine the next host to infect. ... > nmap can be used to scan a host or a network. ... > bother to ping because people have been blocking pings or other ICMP ...
      (Security-Basics)
    • RE: ICMP (Ping)
      ... I'll provide one example for why blocking ... pings might be a good idea... ... Yes, nmap. ... If it cannot ping the host, ...
      (Security-Basics)
    • Help with Expect
      ... I need some help with an expect script I'm trying to write. ... If the host responds to pings telnet into it. ...
      (freebsd-questions)