ICMP Flood Attacks????

[LinkinForcer 1]

Hello,

So today I shut down my computer and upon turning it back on and logging in I was met with a message from ESET Smart Security Premium about a detected ICMP Flood Attack. I looked at my logs and I actually have 4 different times an ICMP Flood Attack was blocked starting on 1/5/17 at about 9:45 PM then 10:56 PM then on 1/6/17 at 10:11 PM and then on 1/7/17 at 12:01 AM. The only one I was notified about was the most recent one.

Is this a false positive?

How serious is this?

All attacks came from my router and were targeting my computer according to ESET.

I just have no idea what could be causing this. No device on my router is unknown to me. Just confused as to why the logs are actually saying my router is trying to attack my computer.

[itman 1,659]

Normally, your router should be configured to block external ICMP echo requests. You can test if that is functional by going to this web site: https://www.grc.com/shieldsup then click on the "Proceed" tab in the displayed web page. Then select the "Common Ports" scan. When it completes, note the results of the "Echo Ping" test. It should state that you passed. If you didn't pass, then your router is not properly configured to prevent ICMP Flood attacks. The router is your first line of defense against ICMP Flood attacks.

If you passed the Echo Ping test, then a number of other scenarios might be occurring. An external DDoS attack might be occurring against your router and it is overwhelming the capability of the router to block such traffic. You should examine your router's log file to determine if this is the case. If an external DDoS ICMP Flood attack is occurring, you need to create a router firewall rule, assuming your router has a configurable firewall, to block all inbound traffic for the IP addresses that are the source of the DDoS attack.

If an external DDoS attack is not the case, then it is possible that your router is "misbehaving." It is normal for some routers to issue an ICMP echo request to establish connectivity with a target device. If there is a problem with this request being acknowledged by the targeted device, it could be the router is stuck in a loop where it is repeatedly sending ICMP echo request transactions and Eset's IPS protection is interpreting this activity as an ICMP Flood attack. 

[LinkinForcer 1]

Ok thank you very much for this information.

 

i am wanting to lean more towards the fact that the router is acting up. I have AT&T U-verse and we have been experiencing problems on the internet and TV side where I've had to reset my router more than once. 

The main IP address keeps changing as well. We bounce between to normal 192.168 address to the default 169.254 address. I'm thinking the router is failing.

I'll check it out more when I get home.

im going to call AT&T and have them replace the router anyway due to the problems. Hopefully that will fix everything.

 

[itman 1,659]

It so happens I also have AT&T Uverse. My Pace 3801 HGV Gateway's firewall does indeed block incoming external ICMP echo ping requests.

3 hours ago, LinkinForcer said:

The main IP address keeps changing as well. We bounce between to normal 192.168 address to the default 169.254 address. I'm thinking the router is failing.

If your PC is falling back to APIPA addresses, it means it is having a problem establishing a DHCP connection w/AT&T servers. Are you running Eset's firewall w/default settings i.e. Automatic with Windows incoming firewall rules also included? When I was running Eset's firewall in Interactive mode, I was having issues on occasion with DHCP. However, frequent APIPA address fallback can also be due to router issues. 

[LinkinForcer 1]

Well I actually just got off the phone with AT&T and they did a reset on the router and a software update and also sending out a tech to "more than likely" replace my router.

With the router being reset by them as well as a software update I'd feel safe to say that everything is in default settings.

As for before the call. As far as I know everything was in default settings. I had just done a full reset on the router about a week ago because of connectivity issues we were having with our TV and internet.

Also I haven't touched the settings for Eset since installed or Windows since I got the computer a week ago so they are all in default settings as well.

Edited January 7, 2017 by LinkinForcer

[LinkinForcer 1]

Where are the settings in ESET for blocking ICMP? I just want to double check.

[TomFace 539]

Thanks for the link itman. I too have U-verse so I have been following this thread. Just did the common port test and it came back a perfect "TruStealth" rating. Keep us posted LinkinForcer.

Edited January 7, 2017 by TomFace

[itman 1,659]

Eset firewall has a default firewall rule that blocks inbound ICMP echo request. However for ICMPv6, it allows all inbound requests to the Trusted Zone. I never worried about that one since I have Windows firewall configured to use the Public profile. As such, no network devices are trusted.

[itman 1,659]

23 minutes ago, TomFace said:

Thanks for the link itman. I too have U-verse so I have been following this thread. Just did the common port test and it came back a perfect "TruStealth" rating. Keep us posted LinkinForcer.

That's interesting .......... On my Pace gateway, port 443 is open on the WAN side since it is used by desktop TV boxes. I love how AT&T chose port 443 to do so. Port 443 is locked down on the LAN side of the gateway but still something I don't especially like.

Do you also have U-Verse TV?

[LinkinForcer 1]

See I ran a scan of the router last night in ESET and port 443 triggered a threat alert. I knew it was there because of my wireless TV DVR so I wasn't really worried. 

Now after having the reset and software update done that port is no longer there. I scanned the network again and no threats were triggered.

As far as Windows Firewall goes that's all being managed by ESET.

[LinkinForcer 1]

Also since this whole ICMP thing has come about I went and turned on Covert data in ICMP protocol detection in ESET as it is disabled by default.

[TomFace 539]

2 hours ago, itman said:

That's interesting .......... On my Pace gateway, port 443 is open on the WAN side since it is used by desktop TV boxes. I love how AT&T chose port 443 to do so. Port 443 is locked down on the LAN side of the gateway but still something I don't especially like.

Do you also have U-Verse TV?

Yes I have u-Verse TV as well. Funny you should mention port 443...I did a scan using the ESS router scan and if kept showing a vulnerability on port 443. Let me say that I am not the brightest bulb in the marque when it comes to ports and the like. I was nosing around online in my router settings>firewall and found a hosted application entry  under NAT/Gaming for "Act of War-Direct Action" needed by device "Cisco_AP_ATT" using port TCP:443 (service: connectToCiscoAP).

 

I am not a gamer and have not added anything for gaming, so I was puzzled and deleted it. I have had no ill effects and now my ESS Router scams are clean. I run my internet settings in public mode as I do not require sharing.  Also let me say I have NOT received any notification of any flood attacks.

Edited January 8, 2017 by TomFace

[LinkinForcer 1]

Yep that's where it is. But like it says it's using the "little router" for the wireless DVR. That's why I never touched it. But now after the reset it's gone for me.

[TomFace 539]

1 hour ago, LinkinForcer said:

Also since this whole ICMP thing has come about I went and turned on Covert data in ICMP protocol detection in ESET as it is disabled by default.

What benefit will doing that add?

[LinkinForcer 1]

If it's an actual attack it will block any attempts that the hacker would do "behind the mask" of the attack. Basically if they used the ICMP as a decoy to try and do real harm it will block it.

At least that's what I gathered from what I read.

[itman 1,659]

Eset has two ICMP packet inspection settings within IDS settings:

• ICMP protocol message checking – Prevents attacks that exploit the weaknesses of the ICMP protocol, which could lead to computer unresponsiveness - also see DoS (Denial of service attacks).

• Covert data in ICMP protocol detection – Checks to see if the ICMP protocol is used for data transfer. Many malicious techniques use the ICMP protocol to bypass the Personal firewall.

I believe both of these are set on by default.

Another factor in play here is the network connection in regards to U-Verse. My DVR recorder is connected via Ethernet from the gateway. However, all my other computer based connections including Smart phones are all wireless connections via the AT&T provided WAP. My primary reason for using the Public firewall profile is to prevent these devices especially the crap-ola android devices in my household from interacting with my PC.

 

[LinkinForcer 1]

The second option is off by default but I turned it on. 

I had my connection set to public but when I trusted my network on Windows 10 it switched to private, or home and work connection.

[Marcos 5,074]

You can enable advanced firewall logging in the advanced setup -> Tools -> Diagnostics, restart the computer and reproduce the alert. Then disable logging and navigate to the C:\ProgramData\ESET\%ProgramName%\Diagnostics folder. Compress the file EpfwLog.pcapng and send it to me as an attachment via PM. Also include ELC logs (see my signature for instructions).

[LinkinForcer 1]

I'm fine right now. If it happens again I'll do that but as of right now everything is good on my end. AT&T has already reset the router and updated the software on it.

[LinkinForcer 1]

Hey guys,

So I have my new router. This one defenatly has Flood protection.

It was by default unchecked but I have checked it. Everything should be good now!

[LinkinForcer 1]

Also I was able to turn on Excessive Session Detection with the router as well!

[itman 1,659]

I will also add that unless you're a gamer, use certain Internet phone service, or the like, your AT&T gateway firewall and for that matter any router w/firewall setting should be set to block "unsolicited inbound traffic" as noted by the below screen shot. This feature is technically noted as statefull packet inspection(SPI). When you shop for a router, this a must have feature along with network address translation(NAT).

Also, you should make it a habit to occasionally review your router/gateway firewall logs. For example, mine shows persistent probing of port 23 and lesser to port 22. These are used by the file transfer protocol for bulk file transfers and are often allowed by third party software firewalls.

I have always stated that your router/gateway firewall is your primary and first line of Internet defense and any Windows based firewall is secondary to it.

 

   

Edited January 9, 2017 by itman

[LinkinForcer 1]

As far as I could tell I'm at maximum protection. We have different routers so our options are different but under the Blocked Attacks section I've got everything checked off. 

Every attack that that router is configured to recognize it will block it now.

[scgt1 1]

On 1/7/2017 at 9:27 AM, itman said:

Normally, your router should be configured to block external ICMP echo requests. You can test if that is functional by going to this web site: https://www.grc.com/shieldsup then click on the "Proceed" tab in the displayed web page. Then select the "Common Ports" scan. When it completes, note the results of the "Echo Ping" test. It should state that you passed. If you didn't pass, then your router is not properly configured to prevent ICMP Flood attacks. The router is your first line of defense against ICMP Flood attacks.

If you passed the Echo Ping test, then a number of other scenarios might be occurring. An external DDoS attack might be occurring against your router and it is overwhelming the capability of the router to block such traffic. You should examine your router's log file to determine if this is the case. If an external DDoS ICMP Flood attack is occurring, you need to create a router firewall rule, assuming your router has a configurable firewall, to block all inbound traffic for the IP addresses that are the source of the DDoS attack.

If an external DDoS attack is not the case, then it is possible that your router is "misbehaving." It is normal for some routers to issue an ICMP echo request to establish connectivity with a target device. If there is a problem with this request being acknowledged by the targeted device, it could be the router is stuck in a loop where it is repeatedly sending ICMP echo request transactions and Eset's IPS protection is interpreting this activity as an ICMP Flood attack. 

I have recently been getting this notice while my computer is connecting to AirVPN after reboot. (The VPN service has it's own tunneling adapter which bypasses the windows network from my understanding. Running the link above I yield the following results:

Solicited TCP Packets: PASSED — No TCP packets were received from your system as a direct result of our attempts to elicit some response from any of the ports listed below — they are all either fully stealthed or blocked by your ISP. However . . . Unsolicited Packets: PASSED — No Internet packets of any sort were received from your system as a side-effect of our attempts to elicit some response from any of the ports listed above. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system remained wisely silent. (Except for the fact that not all of its ports are completely stealthed as shown below.) Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

I will add that with using AirVPN I'm claimed to be actually invisible. My IP that comes up is the one from AirVPN and not my actual IP address nor my routers.

While running the other test (upnp) from that page I got these results:

 

THE EQUIPMENT AT THE TARGET IP ADDRESS
DID NOT RESPOND TO OUR UPnP PROBES!

File Sharing test:

Attempting connection to your computer. . . Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet!

Your Internet port 139 does not appear to exist! One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion.

Unable to connect with NetBIOS to your computer. All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet.

 

 

 

Service port check yielded the following:

0

31

32

63

64

95

96

127

128

159

160

191

192

223

224

255

256

287

288

319

320

351

352

383

384

415

416

447

448

479

480

511

512

543

544

575

576

607

608

639

640

671

672

703

704

735

736

767

768

799

800

831

832

863

864

895

896

927

928

959

960

991

992

1023

1024

1055

Solicited TCP Packets: RECEIVED (FAILED) — As detailed in the port report below, one or more of your system's ports actively responded to our deliberate attempts to establish a connection. It is generally possible to increase your system's security by hiding it from the probes of potentially hostile hackers. Please see the details presented by the specific port links below, as well as the various resources on this site, and in our extremely helpful and active user community. Unsolicited Packets: PASSED — No Internet packets of any sort were received from your system as a side-effect of our attempts to elicit some response from any of the ports listed above. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system remained wisely silent. (Except for the fact that not all of its ports are completely stealthed as shown below.) Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

Alot of network stuff is always way over my head but it seems I have two ports open from the above check and that could be where this icmp bit is coming from?

Edited May 31, 2017 by scgt1

[itman 1,659]

Port 88 is used by Xbox Live 360.

Port 89 only use I know of is:

port 89 is a dedicated services port used as a Telnet Gateway between Mass Institue of Technology (MIT) and ___ University (SU)

Note that if you are using a router, the GRC test is reflecting the inbound port status of the router.

Your Flood attacks are most likely due to this:

Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation.

Again, this can be controlled via router firewall settings. However with some ISP provided routers, ICMP Echo Reply requests are allowed since the ISP uses such to ensure connectivity exists.

Edited May 31, 2017 by itman