ISC2 SSCP Exam - Topic 6 Question 68 Discussion

Echo replies outbound should be dropped, not allowed. There is no reason for any internet users to send ICMP ECHO Request to your interal hosts from the internet. If they wish to find out if a service is available, they can use a browser to connect to your web server or simply send an email if they wish to test your mail service.

Echo replies outbound could be used as part of the SMURF amplification attack where someone will send ICMP echo requests to gateways broadcast addresses in order to amplify the request by X number of users sitting behind the gateway.

By allowing inbound echo requests and outbound echo replies, it makes it easier for attackers to learn about the internal network as well by performing a simply ping sweep. ICMP can also be used to find out which host has been up and running the longest which would indicates which patches are missing on the host if a critical patch required a reboot.

ICMP can also be use for DDoS attacks, so you should strictly limit what type of ICMP traffic would be allowed to flow through your firewall.

On top of all this, tools such as LOKI could be use as a client-server application to transfer files back and forward between the internat and some of your internal hosts. LOKI is a client/server program published in the online publication Phrack . This program is a working proof-of-concept to demonstrate that data can be transmitted somewhat secretly across a network by hiding it in traffic that normally does not contain payloads. The example code can tunnel the equivalent of a Unix RCMD/RSH session in either ICMP echo request (ping) packets or UDP traffic to the DNS port. This is used as a back door into a Unix system after root access has been compromised. Presence of LOKI on a system is evidence that the system has been compromised in the past.

The outbound echo request and inbound echo reply allow internal users to verify connectivity with external hosts.

The following answers are incorrect:

Allow echo request outbound The outbound echo request and inbound echo reply allow internal users to verify connectivity with external hosts.

Drop echo request inbound There is no need for anyone on the internet to attempt pinging your internal hosts.

Allow echo reply inbound The outbound echo request and inbound echo reply allow internal users to verify connectivity with external hosts.

Reference(s) used for this question:

http:// www.phrack.org/issues.html?issue=49&id=6

http:// www.phrack.org/issues.html?issue=49&id=6

STREBE, Matthew and PERKINS, Charles, Firewalls 24seven, Sybex 2000, Chapter 10: The Perfect Firewall.