One of many first low-level community instruments that any pc person learns about is the venerable ping utility.
Named after the eponymous sound impact from any and each old-school battle film scene involving submarines, the command is a metaphorical echo (see what we did there?) of the underwater model of RADAR generally known as SONAR.
You ship out a p-i-n-g (extra like a d-o-i-n-n-n-n-g noise, in actuality) into the briny depths, and by measuring how lengthy it takes for its eerie echo to come back again to you, and by estimating the velocity of sound within the surrounding ocean, you’ll be able to compute the gap to the thing that produced the echo.
Intriguingly, given that you just’ve in all probability heard the abbreviation TCP/IP used as a generic description of the protocol glue that powers the web, ping doesn’t technically use TCP/IP in any respect.
In actual fact, TCP/IP is brief for transmission management protocol over the web protocol, and refers to a reasonably high-level mechanism for sending information over the web in such a method that the community itself places in a variety of the “did that truly work correctly?” effort for you.
For instance, in TCP connections, any chunks of knowledge you ship are assured both to reach intact on the different finish or to trigger an error so you recognize they didn’t make it.
Moreover, even when totally different information chunks find yourself taking totally different routes throughout the web (for instance because of load balancing, short-term outages, or different recoverable errors), and even when some chunks take longer to reach than others, TCP information shall be appropriately buffered up and offered in the correct order on the different finish.
Ping is totally different
The ping comand, nevertheless, is often used to confirm if a pc you’re occupied with is on-line in any respect, particularly if it’s not accepting the form of high-level TCP connections you’d count on, reminiscent of receiving e-mail or permitting SSH logins.
This shortly helps you establish whether or not an outage is prone to be because of the community or the server itself taking place, or because of particular person providers operating on that server failing to begin appropriately.
In consequence, ping makes use of a a lot lower-level protocol than TCP.
Certainly, ping doesn’t even use TCP’s extra informal cousin UDP, brief for person datagram protocol, which a method of transmitting information chunks that’s quick and straightforward, however is popularly known as send-and-hope (or, in case you are a cynical kind, as spray-and-pray).
UDP itself doesn’t inform you whether or not your information obtained to the opposite finish or not, and even when it arrives intact, UDP doesn’t hold monitor of the order through which your packets had been initially despatched, so it may well’t rearrange them on the different finish in the event that they get there out of sequence.
Ping, for what it’s price, makes use of a very-low-level-indeed protocol, specifically designed for troubleshooting and community reconfiguration functions, generally known as ICMP, or web management message protocol.
Sometimes dealt with proper within the working system kernel, in order that ICMP/IP packets are virtually sure to get by way of even when no higher-level networking software program has come up appropriately, ICMP notably contains two particular message sorts:
- Sort 0x08. Formally known as
ICMP Echo, this form of packet is normally known as an Echo Request. It’s what thepingprogram sends out to be able to probe for lively computer systems on the community. - Sort 0x00. Formally known as
ICMP Echo Reply, this packet kind is precisely what it says. A pc that’s alive, on-line, and never configured to dam ICMP Echo visitors is meant ship this form of packet straight again to the pc that requested it.
Like this:
$ ping -c 3 -p 4E414B45445345435552495459 nakedsecurity.sophos.com PATTERN: 0x4e414b45445345435552495459 PING news-sophos.go-vip.internet (192.0.66.227) 56(84) bytes of knowledge. 64 bytes from 192.0.66.227 (192.0.66.227): icmp_seq=1 ttl=53 time=84.0 ms 64 bytes from 192.0.66.227 (192.0.66.227): icmp_seq=2 ttl=53 time=85.1 ms 64 bytes from 192.0.66.227 (192.0.66.227): icmp_seq=3 ttl=53 time=84.8 ms --- news-sophos.go-vip.internet ping statistics --- 3 packets transmitted, 3 acquired, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 84.025/84.644/85.062/0.446 ms
To see a ping in motion at a barely decrease degree, we’ll use the Lua code that you could find on the finish of the article to assemble an ICMP Echo packet of our personal, and to learn the reply that comes again, if any:
$ sudo luax ping.lua nakedsecurity.sophos.com Sending ICMP ECHO request to 192.0.66.227 --> 00000000 08 00 03 02 bb 5a 6f 1d 50 69 6e 67 52 65 71 75 |.....Zo.PingRequ| 00000010 65 73 74 4d 65 73 73 61 67 65 20 42 42 35 41 36 |estMessage BB5A6| 00000020 46 31 44 |F1D | Obtained back--> 00000000 45 00 00 37 f6 af 00 00 35 01 94 7f c0 00 42 e3 |E..7....5.....B.| 00000010 XX XX XX XX 00 00 0b 02 bb 5a 6f 1d 50 69 6e 67 |.........Zo.Ping| 00000020 52 65 71 75 65 73 74 4d 65 73 73 61 67 65 20 42 |RequestMessage B| 00000030 42 35 41 36 46 31 44 |B5A6F1D |
By the best way, we would have liked to make use of sudo above to run our script with superuser privileges, as a result of we created what’s generally known as a uncooked IP socket – one that may be crafted into any underlying format we like, together with TCP, UDP and, as wanted right here, ICMP.
On many Linux/Unix techniques, the ping command equipped by your distro works with out explicitly being given root privileges, normally as a result of it’s put in with particular safety capabilities, or with its setuid flag set, which means it begins off with operating beneath a distinct person account than the person who ran it.
Effectively-designed ping applications, in fact, will routinely discard their further privileges as soon as they’ve opened up the uncooked socket they want.
We omitted this privilege-dropping code from our pattern script for the sake of brevity. You should use the posix.unistd.setpid() perform to modify to an unprivileged account after creating the socket, however earlier than sending or receiving any information.
Analyzing the reply
As you would possibly recognise within the information dump from our script above, the community socket perform we’re utilizing to learn again information from the responding server contains not solely the ICMP Echo Reply information, but in addition the low-level IP (web protocol headers) within the underlying packet.
We haven’t tried to parse or in any other case course of this information, however the FreeBSD ping program wants to take action to be able to make sense of the reply, together with making sense of any error messages that come again.
If the ping will get rejected not directly, the Echo Reply will usually embody not solely its personal IP headers (as seen above) but in addition a reference copy of the IP headers and the ICMP information that appeared within the authentic outbound request.
IPv4 packet headers normally look very similar to you see above, the place the IP headers begin with 45 00 00 37... and proceed for 20 bytes in whole, as much as and together with the bytes proven as ...XX XX XX XX, which is the IP deal with of my laptop computer.
Like this:
00000000 45 00 00 37 f6 af 00 00 35 01 94 7f c0 00 42 e3 |E..7....5.....B.| 00000010 XX XX XX XX |.... | IP model and header size: 0x45 (4 = IPv4, 5 = 5 32-bit phrases, i.e. 20 bytes Service kind and congestion information: 0x00 Whole size of packet: 0x0037 (decimal 55) Sequence info: F6 AF 00 00 Time-to-live (hops left): 0x35 (decimal 53) Protocol kind: 0x01 (ICMP) Checksum: 0x947F (decimal 38015) Sending pc's IP quantity: C0 00 42 E3 (192.0.66.227 = nakedsecurity.sophos.com) Recipient's IP (my laptops: XX XX XX XX (REDACTED = my very own IP quantity)
FreeBSD’s ping programmers, it appears, assumed that headers of this kind would, certainly, all the time be precisely 20 bytes lengthy, primarily based on that header-length worth within the first byte of 0x45, denoting IPv4 (0x4?) with a 5-DWORD (0x?5), or 20-byte, header.
With simply 20 bytes to fret about, the programmers allotted fixed-size buffers on the stack the place they might make a copy of the IP headers within the reply, plus any embedded IP headers from the unique request, if there was an error situation to deal with.
You’ll be able to guess the place that is going.
That first byte within the IPv4 header can legally have any worth from 0x45 (the minimal header measurement of 5 DWORDs, or 20 bytes, as proven) as much as 0x4F (denoting 15 DWORDs, as a result of 0xF is decimal 15, or 60 bytes of header information in whole), thus neatly permitting for an non-compulsory further 40 bytes of header information.
These uncommon, however authorized, further header bytes can be utilized for numerous funky and weird “options” with curious names reminiscent of Selective Directed Broadcast, Experimental Circulation Management and Upstream Multicast Packet – issues that we’ve heard of however by no means knowingly used, and even seen.
Beware cybercriminals who put you to the check
As you’ll be able to think about, provided that these further fields are virtually by no means used, you would possibly by no means see an IPv4 packet with something apart from 0x45 firstly, and with 20 bytes of header information in whole, except you’ve run right into a bunch of cybercriminals who’re able to put you to the check.
Sadly there’s not a lot to cease an attacker from rigging up a server that guesses whether or not you’re utilizing FreeBSD, and intentionally generates outsized ICMP/IP Echo Reply packets to be able to provoke a stack buffer overflow inside your ping program.
If ever you verify to see if their server is lively (which you would possibly do even, or maybe particularly, should you assume it’s suspicious!), you can be focused with a booby-trapped reply.
At finest, your ping program will crash; at worst, nevertheless, because the FreeBSD safety advisory generously admits, “it might be attainable for a malicious host to set off distant code execution in ping.”
Luckily, because the FreeBSD authors additionally level out, “[t]he ping course of runs in a functionality mode sandbox on all affected variations of FreeBSD and is thus very constrainted in the way it can work together with the remainder of the system on the level the place the bug can happen.”
In different phrases, you undoubtedly must patch, however the dangers will be thought of modest.
Notably, the ping program is just not solely locked in a sandbox, however isn’t operating as root when the buggy code will get reached, as confirmed within the safety advisory: “When ping runs, it creates the uncooked socket wanted to do its work, after which revokes its elevated privileges.”
As described above, superuser powers are required solely to accumulate a uncooked IP socket from the working system, to not use the sendto() and recvfrom() features on that socket afterwards.
What to do?
- When you’re a FreeBSD person, merely replace the affected releases (FreeBSD 12 and FreeBSD 13) to their newest variations, the place this bug is fastened.
- When you’re a community programmer, all the time guarantee that you’ve got accounted for packet headers that would point out uncommon measurement variations. The truth that you’ve by no means seen any variation your self doesn’t cease you going through a packet tomorrow that’s out-of-the-ordinary but completely authorized.
- When you’re a community supervisor, think about blocking IPv4 packets with IP headers that aren’t 20 bytes in measurement. When you genuinely appear to want to permit some software program merchandise to make use of uncommon IPv4 header choices, think about logging these uncommon packets to be taught why.
Take care on the market!
EXAMPLE CODE TO DEMONSTRATE PING TRAFFIC
