Attacks using ICMP (Destination Unreachable)

A considerably old Denial of Service attack is sending ICMP Unreachable Messages (Port Unreachable) to a host to reset a TCP connection.

A TCP connection is defined by a host/port pair.

 www.client.com:1234 <–> www.webserver.com:80

It is sometimes the case an attacker knows one host/port pair in the connection.  In the example above it would be www.webserver.com:80.  This is mostly useless in this context because http tends to keep short lived connections, unless the Keep-alive option is used.

 The attack then goes like this.

 The attack starts bruteforcing ICMP Destination Unreachable Messages (Port Unreachable), for the source port of the client that he doesn’t know.  He sends these ICMP messages to either the client or the server.  After enough bruteforcing, the correct host/port pair is found, and the TCP Connection is dropped.

Historically, client ports were chosen deterministically, so you really only had to brute force a thousand or two ports.  It was a very successful attack and a known protocol problem in TCP/IP.

This type of attack I suspect was a specific attack that Mudge/L0pht was thinking about when he talked about ‘being able to take down the internet in 30 minutes’.  Also written was a tool by ADM that I think implemented this type of attack against critical internet infrastructure.

Today, everyone has broadband, so these types of attacks are easier to implement.  Also more common is for networks to filter ICMP messages, so this type of attack is less effective.

One response to “Attacks using ICMP (Destination Unreachable)

  1. Most operating system’s network stacks nowadays are treating these ICMP messages as “soft errors” meaning that TCP won’t ever drop a connection due to them.

    More info on Fernando Gont’s paper here:
    http://www.gont.com.ar/drafts/icmp-attacks/draft-ietf-tcpm-icmp-attacks-01.html

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s