Home > CAPEC List > CAPEC-332: ICMP IP 'ID' Field Error Message Probe (Version 2.9)  

CAPEC-332: ICMP IP 'ID' Field Error Message Probe

 
ICMP IP 'ID' Field Error Message Probe
Definition in a New Window Definition in a New Window
Attack Pattern ID: 332
Abstraction: Detailed
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

An attacker sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. The internet identification field (ID) is typically utilized for reassembling a fragmented packet. RFC791 and RFC815 discusses about IP datagrams, fragmentation and reassembly. Some operating systems or router firmware reverse the bit order of the ID field when echoing the IP Header portion of the original datagram within the ICMP error message. There are 3 behaviors that can be used to distinguish remote operating systems or firmware.

  • The IP ID field is echoed back identically to the bit order of the ID field in the original IP header.
  • The IP ID field is echoed back, but the byte order has been reversed.
  • The IP ID field contains an incorrect or unexpected value.

Different operating systems will respond by setting the IP ID field differently within error messaging. This allows the attacker to construct a fingerprint of specific OS behaviors.

+ Target Attack Surface

Target Attack Surface Description

Targeted OSI Layers: Network Layer

Target Attack Surface Localities

Server-side

Target Attack Surface Types: Host

Target Functional Services

Target Functional Service 1: None
Protocol 1: ICMP
Protocol Header 1
Protocol RFCProtocol Field NameProtocol Field DescriptionProtocol Operation CodeProtocol Data
RFC 792
Type
The ICMP Type Field determines the function of the ICMP query. A Type 8 message directs the target to reply to the sender of the echo request message with an echo reply message. In forming an echo reply the source and destination addresses are switched, the Type field is set to '0', any data contained in the data portion of the echo request is sent "echoed" back to the host, and the checksum is recalculated.
8
ICMP echo requests may contain arbitrary data as a payload. When the ICMP Type is 8 (echo request), the data received in the echo message must be returned in the echo reply message.
Related Protocol: Internet Protocol
Relationship Type
Uses Protocol
+ Attack Prerequisites
  • The ability to send a UDP datagram to a closed port and receive an ICMP Error Message Type 3, "Port Unreachable.

+ Typical Severity

Low

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Confidentiality
"Varies by context"
Confidentiality
Access_Control
Authorization
Bypass protection mechanism
Hide activities
+ References
[R.332.1] [REF-20] Stuart McClure, Joel Scambray and George Kurtz. "Hacking Exposed: Network Security Secrets & Solutions". Chapter 2: Scanning, pg. 56. 6th Edition. McGraw Hill. 2009.
[R.332.2] [REF-23] J. Postel. "RFC792 - Internet Control Messaging Protocol". Defense Advanced Research Projects Agency (DARPA). September 1981. <http://www.faqs.org/rfcs/rfc792.html>.
[R.332.3] [REF-24] R. Braden, Ed.. "RFC1122 - Requirements for Internet Hosts - Communication Layers". October 1989. <http://www.faqs.org/rfcs/rfc1122.html>.
[R.332.4] [REF-26] Ofir Arkin. "A Remote Active OS Fingerprinting Tool using ICMP". The Sys-Security Group. April 2002. <http://ofirarkin.files.wordpress.com/2008/11/login.pdf>.
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team

More information is available — Please select a different filter.
Page Last Updated or Reviewed: December 07, 2015