One of the primary low-level community instruments that any laptop consumer learns about is the venerable ping utility.
Named after the eponymous sound impact from any and each old-school battle film scene involving submarines, the command is a metaphorical echo (see what we did there?) of the underwater model of RADAR referred to as SONAR.
You ship out a p-i-n-g (extra like a d-o-i-n-n-n-n-g noise, in actuality) into the briny depths, and by measuring how lengthy it takes for its eerie echo to return again to you, and by estimating the pace of sound within the surrounding ocean, you possibly can compute the space to the thing that produced the echo.
Intriguingly, given that you just’ve in all probability heard the abbreviation TCP/IP used as a generic description of the protocol glue that powers the web, ping doesn’t technically use TCP/IP in any respect.
In truth, TCP/IP is brief for transmission management protocol over the web protocol, and refers to a reasonably high-level mechanism for sending information over the web in such a means that the community itself places in plenty of the “did that actually work properly?” effort for you.
For instance, in TCP connections, any chunks of knowledge you ship are assured both to reach intact on the different finish or to trigger an error so they didn’t make it.
Furthermore, even when totally different information chunks find yourself taking totally different routes throughout the web (for instance attributable to load balancing, short-term outages, or different recoverable errors), and even when some chunks take longer to reach than others, TCP information will probably be appropriately buffered up and offered in the fitting order on the different finish.
Ping is totally different
The ping comand, nonetheless, is usually used to confirm if a pc you’re excited by is on-line in any respect, particularly if it’s not accepting the form of high-level TCP connections you’d count on, akin to receiving e-mail or permitting SSH logins.
This shortly helps you establish whether or not an outage is more likely to be because of the community or the server itself happening, or attributable to particular person companies operating on that server failing to start out appropriately.
As a end result, ping makes use of a a lot lower-level protocol than TCP.
Indeed, ping doesn’t even use TCP’s extra informal cousin UDP, quick for consumer datagram protocol, which a means of transmitting information chunks that’s quick and simple, however is popularly known as send-and-hope (or, if you’re a cynical type, as spray-and-pray).
UDP itself doesn’t inform you whether or not your information acquired to the opposite finish or not, and even when it arrives intact, UDP doesn’t hold observe of the order by which your packets have been initially despatched, so it will possibly’t rearrange them on the different finish in the event that they get there out of sequence.
Ping, for what it’s value, makes use of a very-low-level-indeed protocol, specifically designed for troubleshooting and community reconfiguration functions, referred to as ICMP, or web management message protocol.
Typically dealt with proper within the working system kernel, in order that ICMP/IP packets are nearly sure to get by way of even when no higher-level networking software program has come up appropriately, ICMP notably consists of two particular message sorts:
- Type 0x08. Officially referred to as
ICMP Echo, this form of packet is normally referred to as an Echo Request. It’s what thepingprogram sends out as a way to probe for energetic computer systems on the community. - Type 0x00. Officially referred to as
ICMP Echo Reply, this packet kind is precisely what it says. A pc that’s alive, on-line, and never configured to dam ICMP Echo site visitors is meant ship this form of packet straight again to the pc that requested it.
Like this:
$ ping -c 3 -p 4E414B45445345435552495459 nakedsecurity.sophos.com PATTERN: 0x4e414b45445345435552495459 PING news-sophos.go-vip.web (192.0.66.227) 56(84) bytes of knowledge. 64 bytes from 192.0.66.227 (192.0.66.227): icmp_seq=1 ttl=53 time=84.0 ms 64 bytes from 192.0.66.227 (192.0.66.227): icmp_seq=2 ttl=53 time=85.1 ms 64 bytes from 192.0.66.227 (192.0.66.227): icmp_seq=3 ttl=53 time=84.8 ms --- news-sophos.go-vip.web ping statistics --- 3 packets transmitted, 3 obtained, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 84.025/84.644/85.062/0.446 ms
To see a ping in motion at a barely decrease stage, we’ll use the Lua code that you’ll find on the finish of the article to assemble an ICMP Echo packet of our personal, and to learn the reply that comes again, if any:
$ sudo luax ping.lua nakedsecurity.sophos.com Sending ICMP ECHO request to 192.0.66.227 --> 00000000 08 00 03 02 bb 5a 6f 1d 50 69 6e 67 52 65 71 75 |.....Zo.PingRequ| 00000010 65 73 74 4d 65 73 73 61 67 65 20 42 42 35 41 36 |estMessage BB5A6| 00000020 46 31 44 |F1D | Got back--> 00000000 45 00 00 37 f6 af 00 00 35 01 94 7f c0 00 42 e3 |E..7....5.....B.| 00000010 XX XX XX XX 00 00 0b 02 bb 5a 6f 1d 50 69 6e 67 |.........Zo.Ping| 00000020 52 65 71 75 65 73 74 4d 65 73 73 61 67 65 20 42 |RequestMessage B| 00000030 42 35 41 36 46 31 44 |B5A6F1D |
By the way in which, we would have liked to make use of sudo above to run our script with superuser privileges, as a result of we created what’s referred to as a uncooked IP socket – one that may be crafted into any underlying format we like, together with TCP, UDP and, as wanted right here, ICMP.
On many Linux/Unix methods, the ping command equipped by your distro works with out explicitly being given root privileges, normally as a result of it’s put in with particular safety capabilities, or with its setuid flag set, which means it begins off with operating below a special consumer account than the consumer who ran it.
Well-designed ping applications, after all, will routinely discard their further privileges as soon as they’ve opened up the uncooked socket they want.
We omitted this privilege-dropping code from our pattern script for the sake of brevity. You can use the posix.unistd.setpid() perform to modify to an unprivileged account after creating the socket, however earlier than sending or receiving any information.
Examining the reply
As you may recognise within the information dump from our script above, the community socket perform we’re utilizing to learn again information from the responding server consists of not solely the ICMP Echo Reply information, but additionally the low-level IP (web protocol headers) within the underlying packet.
We haven’t tried to parse or in any other case course of this information, however the FreeBSD ping program wants to take action as a way to make sense of the reply, together with making sense of any error messages that come again.
If the ping will get rejected ultimately, the Echo Reply will usually embrace not solely its personal IP headers (as seen above) but additionally a reference copy of the IP headers and the ICMP information that appeared within the unique outbound request.
IPv4 packet headers normally look very like you see above, the place the IP headers begin with 45 00 00 37... and proceed for 20 bytes in complete, as much as and together with the bytes proven as ...XX XX XX XX, which is the IP handle of my laptop computer.
Like this:
00000000 45 00 00 37 f6 af 00 00 35 01 94 7f c0 00 42 e3 |E..7....5.....B.| 00000010 XX XX XX XX |.... | IP model and header size: 0x45 (4 = IPv4, 5 = 5 32-bit phrases, i.e. 20 bytes Service kind and congestion information: 0x00 Total size of packet: 0x0037 (decimal 55) Sequence info: F6 AF 00 00 Time-to-live (hops left): 0x35 (decimal 53) Protocol kind: 0x01 (ICMP) Checksum: 0x947F (decimal 38015) Sending laptop's IP quantity: C0 00 42 E3 (192.0.66.227 = nakedsecurity.sophos.com) Recipient's IP (my laptops: XX XX XX XX (REDACTED = my very own IP quantity)
FreeBSD’s ping programmers, it appears, assumed that headers of this type would, certainly, all the time be precisely 20 bytes lengthy, based mostly on that header-length worth within the first byte of 0x45, denoting IPv4 (0x4?) with a 5-DWORD (0x?5), or 20-byte, header.
With simply 20 bytes to fret about, the programmers allotted fixed-size buffers on the stack the place they may make a copy of the IP headers within the reply, plus any embedded IP headers from the unique request, if there was an error situation to deal with.
You can guess the place that is going.
That first byte within the IPv4 header can legally have any worth from 0x45 (the minimal header measurement of 5 DWORDs, or 20 bytes, as proven) as much as 0x4F (denoting 15 DWORDs, as a result of 0xF is decimal 15, or 60 bytes of header information in complete), thus neatly permitting for an optionally available further 40 bytes of header information.
Those uncommon, however authorized, further header bytes can be utilized for numerous funky and strange “features” with curious names akin to Selective Directed Broadcast, Experimental Flow Control and Upstream Multicast Packet – issues that we’ve heard of however by no means knowingly used, and even seen.
Beware cybercriminals who put you to the take a look at
As you possibly can think about, provided that these further fields are nearly by no means used, you may by no means see an IPv4 packet with something aside from 0x45 at the beginning, and with 20 bytes of header information in complete, except you’ve run right into a bunch of cybercriminals who’re able to put you to the take a look at.
Sadly there’s not a lot to cease an attacker from rigging up a server that guesses whether or not you’re utilizing FreeBSD, and intentionally generates outsized ICMP/IP Echo Reply packets as a way to provoke a stack buffer overflow inside your ping program.
If ever you verify to see if their server is energetic (which you may do even, or maybe particularly, if you happen to suppose it’s suspicious!), you possibly can be focused with a booby-trapped reply.
At finest, your ping program will crash; at worst, nonetheless, because the FreeBSD safety advisory generously admits, “it may be possible for a malicious host to trigger remote code execution in ping.”
Fortunately, because the FreeBSD authors additionally level out, “[t]he ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrainted in how it can interact with the rest of the system at the point where the bug can occur.”
In different phrases, you undoubtedly have to patch, however the dangers will be thought of modest.
Notably, the ping program will not be solely locked in a sandbox, however isn’t operating as root when the buggy code will get reached, as confirmed within the safety advisory: “When ping runs, it creates the raw socket needed to do its work, and then revokes its elevated privileges.”
As described above, superuser powers are required solely to amass a uncooked IP socket from the working system, to not use the sendto() and recvfrom() features on that socket afterwards.
What to do?
- If you’re a FreeBSD consumer, merely replace the affected releases (FreeBSD 12 and FreeBSD 13) to their newest variations, the place this bug is fastened.
- If you’re a community programmer, all the time guarantee that you’ve got accounted for packet headers that might point out uncommon measurement variations. The truth that you just’ve by no means seen any variation your self doesn’t cease you dealing with a packet tomorrow that’s out-of-the-ordinary but completely authorized.
- If you’re a community supervisor, take into account blocking IPv4 packets with IP headers that aren’t 20 bytes in measurement. If you genuinely appear to want to permit some software program merchandise to make use of uncommon IPv4 header choices, take into account logging these uncommon packets to study why.
Take care on the market!
EXAMPLE CODE TO DEMONSTRATE PING TRAFFIC
