How to prevent data leakage via ICMP tunnel

On February 28, MITRE Engage released V1 (as shown in Figure 1). MITRE Engage is a framework used to plan and discuss adversary engagement, helping us achieve security goals through adversary engagement. Adversary engagement is an active defense measure that uses cyber denial and cyber deception through strategic planning and analysis to achieve combat goals, which is equivalent to offensive defense. The combat activities in the Engage matrix are mapped to the MITRE ATT&CK matrix (as shown in Figure 2). By mapping combat activities to the ATT&CK matrix, we can ensure that our combat activities are driven by attack behaviors and can better plan which combat activities should be taken. This will bring great reference value to the majority of cybersecurity practitioners.

Figure 1 MITRE Engage

Figure 2 ATT&CK V10.1

As security threats have evolved over the years, security solutions have also advanced. From firewalls, Intrusion Detection and Prevention Systems (IDS & IPS), and Security Information and Event Management (SIEM) systems to User and Entity Behavior Analytics (UEBA), stateful protocol analysis, and steganography — traffic monitoring has become increasingly strict, and attackers are forced to find new ways to stay undetected. Today, we will analyze ICMP tunneling, a commonly used method by hackers for transmitting gathered information (C&C Communication) or conducting data exfiltration.

I believe cybersecurity practitioners have all used ICMP. Internet Control Message Protocol (ICMP) is an OSI network layer protocol used to discover and control routing problems in a network. When network devices detect certain errors, they generate ICMP packets to notify the endpoints of what happened.

When we use Ping to send an Echo packet with some data to a host, the pinged host will reply with an Echo Reply containing the same data. But the data can be arbitrary, as the ICMP RFC does not define strict specifications.

Therefore, attackers can exploit this design choice to obfuscate malicious network behavior. Instead of communicating explicitly with a machine in a chosen protocol, each data packet can be injected into an Echo or Echo Reply packet. The communication flow appears to be a series of Ping operations rather than a TCP connection or similar.

ICMP tunneling is a common form of non-application layer protocol tunneling. When protocols are tunneled, this behavior helps hide malicious traffic within seemingly harmless communication forms, successfully creating covert C&C and data exfiltration channels between two machines, thereby assisting in evading detection. Attackers can exploit this by transmitting traffic within ICMP protocol packets allowed in regular network environments (especially across different security domains within large networks or internal networks). ICMP is a non-application layer protocol, but it is important for network operations and maintenance and is a mature tool. Thus, enterprises are unlikely to monitor it as closely as they would typical data exfiltration communication protocols (HTTP, HTTPS, TCP, IMAP). Because in many cases, ICMP functionality cannot be completely disabled, and running it only requires general user privilege levels, it is frequently exploited by attackers, helping them hide their identities and gains.

Let's look at an example:

The figure below is a packet capture screenshot (Figure 3). It shows normal Ping packets between two machines, containing many Ping packet Echo Requests / Replies. We can note that their Length is 98 bytes. Under normal circumstances, the Length of a Ping packet does not exceed 100 bytes.

Figure 3

The figure below is also a packet capture screenshot (Figure 4), which similarly contains many Ping packet Echo Requests / Replies. We can see that its Length is 1486 bytes.

Figure 4

Although the Ping packets of the ICMP protocol do not contain very large or massive amounts of information, if the infected host and the C&C server continuously use the ICMP Tunnel protocol to transmit and exfiltrate data, it can very easily bypass firewall or IPS rules.

We can compare the Data portion of these two types of ICMP Ping packets. The Data portion of a normal Ping packet is shown in the figure below (Figure 5).

Figure 5

The Data portion of the Ping packet exploited by the attacker is shown in the figure below (Figure 6).

Figure 6

The result obtained by decoding Figure 6 using a Base64 decoding tool is shown below (Figure 7).

Figure 7

Through the above analysis, we can see that attackers can easily exploit protocols you allow to bypass multiple existing detection methods and exfiltrate data. Therefore, it is recommended to improve through the following methods to reduce this probability:

• Utilize security validation tools to continuously simulate data exfiltration this way between various security domains to confirm whether security measures between those domains allowing ICMP can detect or block large Ping packets or long-duration abnormal ICMP traffic. Subsequently, make improvements and optimizations to undetected or unblocked security measures. Also, verify whether the SIEM or SOC (if built) can notify security operations/response personnel to handle such events after analyzing the alert logs of security measures.

• Pay attention to whether network forensics equipment can automatically generate reports on abnormal Ping packet sizes and confirm whether it can restore the content of the Ping packet's Data portion to reconstruct the original data to determine what data was leaked. If the data is encrypted, it must at least be able to alert that it is encrypted and specify the encryption algorithm used.

• Regularly review firewall rules and delete those policies that opened ICMP for testing or IT changes but are no longer needed now.

• Upgrade IDS/IPS equipment so that they can detect, discover, and block Non-Arbitrary ICMP Payload.