Re: ICMP spoofed source tunneling
On Wednesday 22 September 2004 11:33, fenfire@xxxxxxxxxxx wrote:
> > When V receiving that packet, it sends ICMP echo-reply packet to D, AND
> > FORWARDS TO D ALL DATA IN PAYLOAD!
>
> This could also be used by peer-to-peer networks to achieve sender
> anonymity. (Of course you could also directly send UDP packets with forged
> source addresses...)
A few people started work on this. We built a crude program that would
transfer files over UDP with spoofed addresses.
http://udpp2p.sourceforge.net/ (We haven't worked on it in ages.)
Main problems? ISPs filter outbound on their routers, which can cause
problems, and the other big problem was the handshaking/acking/resending. How
can you tell the guy that you missed a packet if you have no way of
contacting him.
We used a broadcast method to perform the searches, and "ttl"s to stop it
going on for ever but we weren't sure how it would scale.
Also the ICMP is a great way of transferring data - just bounce a stream of
ICMP echo-requests off any host that returns them and has a lot of bandwidth
- google, bbc.co.uk, cisco, etc, and if you set the source address as the
target address, no-one knows who you are.
--
Random russian saying: The horse may run quickly, but it can't escape its own
tail.
pgp: http://gk.umtstrial.co.uk/~calum/keys.php
Linux 2.6.7-hardened-r7 14:42:33 up 9 days, 2:46, 1 user, load average: 2.33,
2.11, 1.94