A security analyst is reviewing a packet capture from a compromised host. The analyst observes ICMP Echo Request packets (Type 8, Code 0) being sent to an external IP address, with unusually large data payloads (e.g., 1000+ bytes). The corresponding ICMP Echo Reply packets (Type 0, Code 0) from the external IP also contain similar large data payloads. This communication pattern occurs frequently and is not associated with any known diagnostic tools or legitimate network activity. Which type of covert channel is most likely being utilized?
- ASSH Tunneling
- BHTTP Tunneling
- CDNS Tunneling
- DICMP Tunneling
Show answer & explanationAnswer & explanation
Correct answer: D. ICMP Tunneling
The observation of large data payloads within ICMP Echo Request and Reply packets, especially when occurring frequently to an external IP and not related to legitimate activity, is a strong indicator of ICMP tunneling. Attackers use this technique to establish covert communication channels (C2 or exfiltration) by embedding data within the data field of ICMP packets, often to bypass firewalls that permit ICMP.
Why the other options are wrong
- A. SSH tunneling uses TCP port 22 to create encrypted tunnels and does not involve ICMP packets in this manner.
- B. HTTP tunneling uses TCP ports 80/443 and HTTP requests/responses, not ICMP packets.
- C. DNS tunneling uses UDP port 53 and encodes data within DNS queries/responses, not ICMP packets.
ICMP Tunneling
ICMP tunneling is a covert channel technique where data is encapsulated and transmitted within the data portion of ICMP (Internet Control Message Protocol) packets. This allows attackers to establish command and control or exfiltrate data, often bypassing firewalls that permit ICMP traffic for diagnostic purposes.
- Uses ICMP protocol (e.g., Type 8/0 Echo Request/Reply).
- Hides data within the ICMP payload.
- Can bypass firewalls that allow ICMP for network diagnostics.
Memory trick: Covert channels are like secret messages in public mail.