bugtraq - Re: ICMP spoofed source tunneling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200409281448.16152.bugtraq@umtstrial.co.uk>
Date: Tue, 28 Sep 2004 14:48:12 +0100
From: Calum <bugtraq@...strial.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: ICMP spoofed source tunneling

On Wednesday 22 September 2004 11:33, fenfire@...esend.de wrote:

> > When V receiving that packet, it sends ICMP echo-reply packet to D, AND
> > FORWARDS TO D ALL DATA IN PAYLOAD!
>
> This could also be used by peer-to-peer networks to achieve sender
> anonymity. (Of course you could also directly send UDP packets with forged
> source addresses...)

A few people started work on this. We built a crude program that would 
transfer files over UDP with spoofed addresses.

http://udpp2p.sourceforge.net/ (We haven't worked on it in ages.)

Main problems? ISPs filter outbound on their routers, which can cause 
problems, and the other big problem was the handshaking/acking/resending. How 
can you tell the guy that you missed a packet if you have no way of 
contacting him.
We used a broadcast method to perform the searches, and "ttl"s to stop it 
going on for ever but we weren't sure how it would scale.

Also the ICMP is a great way of transferring data - just bounce a stream of 
ICMP echo-requests off any host that returns them and has a lot of bandwidth 
- google, bbc.co.uk, cisco, etc, and if you set the source address as the 
target address, no-one knows who you are.

-- 

Random russian saying: The horse may run quickly, but it can't escape its own 
tail.

pgp: http://gk.umtstrial.co.uk/~calum/keys.php
Linux 2.6.7-hardened-r7 14:42:33 up 9 days, 2:46, 1 user, load average: 2.33, 
2.11, 1.94