Re: ICMP spoofed source tunneling

[Calum <bugtraq@xxxxxxxxxxxxxxx>]

On Wednesday 22 September 2004 11:33, fenfire@xxxxxxxxxxx wrote:

> > When V receiving that packet, it sends ICMP echo-reply packet to D, AND
> > FORWARDS TO D ALL DATA IN PAYLOAD!
>
> This could also be used by peer-to-peer networks to achieve sender
> anonymity. (Of course you could also directly send UDP packets with forged
> source addresses...)

A few people started work on this. We built a crude program that would 
transfer files over UDP with spoofed addresses.

http://udpp2p.sourceforge.net/ (We haven't worked on it in ages.)

Main problems? ISPs filter outbound on their routers, which can cause 
problems, and the other big problem was the handshaking/acking/resending. How 
can you tell the guy that you missed a packet if you have no way of 
contacting him.
We used a broadcast method to perform the searches, and "ttl"s to stop it 
going on for ever but we weren't sure how it would scale.

Also the ICMP is a great way of transferring data - just bounce a stream of 
ICMP echo-requests off any host that returns them and has a lot of bandwidth 
- google, bbc.co.uk, cisco, etc, and if you set the source address as the 
target address, no-one knows who you are.

-- 

Random russian saying: The horse may run quickly, but it can't escape its own 
tail.

pgp: http://gk.umtstrial.co.uk/~calum/keys.php
Linux 2.6.7-hardened-r7 14:42:33 up 9 days, 2:46, 1 user, load average: 2.33, 
2.11, 1.94