ICMP covert channel detection

[Rene_Atanassoff]

Hi All

I have been asked by a customer to ensure that all protections for covert channel attacks are enabled on their R77.30 gateways which are managed through an R80.10 Management server.  The customer has threat prevention blades, IPS, AV & Anti-bot enabled.  I could find the IPS signature for DNS tunneling but I don't see anything for ICMP. Could someone please explain how Checkpoint deals with ICMP covert channel attacks?

Thank you

Rene

[G_W_Albrecht]

The TCSEC defines two kinds of covert channels:  Storage channels - Cover communication by modifying a "storage location", such as a hard drive, and Timing channels - Perform operations that affect the "real response time observed" by the receiver.

As for ICMP, this is a supporting protocol not regularly employed by end-user network applications (with the exception of some diagnostic tools like ping and traceroute). So it is a standard to block it in rulebase or restrict it use (no ping to the GW gets answered).

The threat you speak of is covered by APCL - see Application/Categories ICMPTX, Data Exfiltration Toolkit ICMP Mode and ICMP shell, all supported since R80.

[Vladimir]

To add to Guenther's post, unsuccessful UDP queries to DNS may result in ICMP replies from those. It is possible to use this mechanism for exfiltration, modifying payload of the replies. 

[PhoneBoy]

One thing you can do in IPS to limit this is to limit the size of ICMP Echo Requests.

[Rene_Atanassoff]

Thanks guys much appreciate the feedback, I will check out the various options.

[Joe_Sullivan]

I'm a little late on this one... but if you want some insight on how that works, this is a good program for running TCP over ICMP:

Ping Tunnel - Send TCP traffic over ICMP 

This was a popular tool to use in hotels to get out of paying for Internet - then they started blocking ICMP.