nerdexam
GIAC

GCIH · Question #31

Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to secure access to the network of the company from all possible entry points. He segmented the network…

The correct answer is C. Block ICMP type 13 messages. Blocking ICMP type 13 (Timestamp Request) messages prevents tools like Hping2 from using ICMP timestamps as a covert channel to probe and enumerate internal network hosts.

Vulnerability Exploitation & Privilege Escalation

Question

Adam works as a Security Administrator for Umbrella Inc. A project has been assigned to him to secure access to the network of the company from all possible entry points. He segmented the network into several subnets and installed firewalls all over the network. He has placed very stringent rules on all the firewalls, blocking everything in and out except the ports that must be used. He does need to have port 80 open since his company hosts a website that must be accessed from the Internet. Adam is still worried about the programs like Hping2 that can get into a network through covert channels. Which of the following is the most effective way to protect the network of the company from an attacker using Hping2 to scan his internal network?

Options

  • ABlock all outgoing traffic on port 21
  • BBlock all outgoing traffic on port 53
  • CBlock ICMP type 13 messages
  • DBlock ICMP type 3 messages

How the community answered

(32 responses)
  • A
    16% (5)
  • B
    22% (7)
  • C
    56% (18)
  • D
    6% (2)

Why each option

Blocking ICMP type 13 (Timestamp Request) messages prevents tools like Hping2 from using ICMP timestamps as a covert channel to probe and enumerate internal network hosts.

ABlock all outgoing traffic on port 21

Blocking outgoing port 21 (FTP) restricts file transfer traffic but does not prevent Hping2 from using ICMP-based techniques to scan the network through the open port 80.

BBlock all outgoing traffic on port 53

Blocking outgoing port 53 (DNS) would break DNS resolution for internal clients and would not stop Hping2 from leveraging ICMP covert channels for reconnaissance.

CBlock ICMP type 13 messagesCorrect

Hping2 can craft ICMP Timestamp Request (type 13) packets to enumerate live hosts even when standard ICMP Echo Requests are blocked, making it an effective covert scanning channel. Blocking ICMP type 13 messages prevents internal hosts from responding to these probes, closing the covert channel without disrupting legitimate web traffic on port 80.

DBlock ICMP type 3 messages

ICMP type 3 messages are Destination Unreachable notifications required for normal TCP/IP path MTU discovery and routing; blocking them would degrade legitimate connectivity without specifically stopping Hping2 timestamp-based scanning.

Concept tested: Blocking ICMP timestamp requests to prevent covert channel scanning

Source: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml

Topics

#ICMP covert channel#Hping2#firewall rules#ICMP type 13

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice