Full Disclosure mailing list archives
RE: ICMP Covert channels question
From: <lists-security () nettracers com>
Date: Sat, 29 Jan 2005 00:37:26 -0800
Paul Schmehl Said:
No, because non-routeable addresses are...well....non-routeable.
But Paul, I route non-routable addresses all the time. It is only internet routers that are usually configured to not route certain addresses. I go into many nets where the router is attempting to send out 192.168's 172.'s and 10's out the external interface. Now they don't get far since the ISP won't take them or just sinks them, but the routers will try to handle them. Some routers (plenty won't) will probably try to "return" those ICMP's to the internal interface, thus providing your covert channel. Furthermore, you may be able to do some interesting things with the type and code fields to encode further information. - Bryan - bwatson () nettracers com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- ICMP Covert channels question cyberpixl (Jan 28)
- Re: ICMP Covert channels question Andrew Farmer (Jan 28)
- Re: ICMP Covert channels question Paul Schmehl (Jan 28)
- RE: ICMP Covert channels question lists-security (Jan 29)
- RE: ICMP Covert channels question Paul Schmehl (Jan 29)
- RE: ICMP Covert channels question lists-security (Jan 29)
- RE: ICMP Covert channels question lists-security (Jan 29)
- Re: ICMP Covert channels question cyberpixl (Jan 30)
- Re: ICMP Covert channels question Gadi Evron (Jan 28)
- <Possible follow-ups>
- Re: ICMP Covert channels question Darren Bounds (Jan 29)