RE: [Full-Disclosure] ICMP Covert channels question

[<lists-security@xxxxxxxxxxxxxx>]

Paul Schmehl Said:
>No, because non-routeable addresses are...well....non-routeable.  

But Paul, I route non-routable addresses all the time.  It is only internet
routers that are usually configured to not route certain addresses.  I go
into many nets where the router is attempting to send out 192.168's 172.'s
and 10's out the external interface.  Now they don't get far since the ISP
won't take them or just sinks them, but the routers will try to handle them.

Some routers (plenty won't) will probably try to "return" those ICMP's to
the internal interface, thus providing your covert channel.  Furthermore,
you may be able to do some interesting things with the type and code fields
to encode further information.  

- Bryan
- bwatson@xxxxxxxxxxxxxx

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html