ICMP Flood DDoS Attack

In today's world, Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks have become a major threat to present computer networks. DDoS is a kind of attack in which an attacker targets the victim's network resources such as bandwidth or memory so that the victim may stop responding to a legitimate user's request. The attackers usually try to consume computational resources, such as bandwidth, processor time, and disk space by overloading or flooding the target system so that it becomes unavailable to the authorized users, or it just crashes.

There are many techniques to overload or flood the network resources of a system and one of the methods is the ICMP Flood attack. In Internet Control Message Protocol (ICMP) Flood, an attacker overpowers the computational resource by sending many  ICMP echo requests or ping packets to take down the targeted network infrastructure so that it becomes inaccessible to normal traffic.

ICMP provides error control, as IP does not have an inbuilt mechanism for sending error and control messages. It is used for reporting errors and management queries. It is a supporting protocol and is used by network devices like routers for sending error messages and operations information.

What is an ICMP Flood DDoS Attack?

In this attack, the victim's network is flooded with ICMP request packets so that it becomes inaccessible to legitimate users while responding with an equal number of reply packets. It is also known as Ping Flood Attack. The tools like "hping" and "scapy" can be used to bring a network target with ICMP Echo Request (ping) packets. These tools put lots of stress on both the incoming and outgoing channels of the network, consuming significant bandwidth, which results the network slowdowns, disruptions, or complete unavailability or denial of service.

During the attack, an attacker might also use IP spoofing in order to mask their identity, this makes the tracing of DDoS attacks more difficult. The ICMP requests packets are sent as fast as possible without waiting for responses from the target. 

How ICMP Flood Attacks Work?

• Initiation: Firstly attackers or hacker generates the excessive ICMP Echo Requests (ping requests) so that they can flood the target with so may requests.
• Resource Consumption: After receiving the requests the target device attempts to respond all the requests with an ICMP Echo Reply which results the consuming CPU memory, and bandwidth and also use the more resources which results, device is slow down or lags.
• Denial of Service: Due to so many requests the target is unable to respond to legitimate network traffic or fail to reply every requests resulting in downtime.
• Amplification (Optional): For more advanced attackers can use botnets or spoofed IPs as well which make the detection and mitigation more difficult.

Example of ICMP (Ping) Flood:

For the practical demonstration, we are using Kali-Linux (Debian 5.10.13-1kali1) as the attacker machine and our Windows 11 as the target machine. To start the ICMP flood, we need to write the following command :

hping3 --icmp --flood <Target IP Address>

Below is the picture showing the network utilization of the system before the ICMP flood DDoS Attack.

Below is the picture showing the attacker machine running  the custom tool hping3 on the terminal :

Below is the picture showing the network utilization of the system during the ICMP flood DDoS Attack on Windows 11 :

Below is the picture showing the network activity on Windows 11 :

ICMP Flood vs. Other DDoS Attacks

DDoS (Distributed Denial-of-Service) Attacks take many forms, with each one having a different target within a network or a system. ICMP Flood attacks, for instance, focus on ICMP (Internet Control Message Protocol) Flooding, which is characterized by the pouring in of pings to the max capacity of the target system. A number of other forms of DDoS attacks coexist that are equally distinctive and diverse in their execution. An explanation of these attacks follows, starting with the definition and the comparison with other main DDoS attack methods techniques of ICMP Flood attacks.

Common Tools Used for ICMP Flood Attacks

There are various tools to launch the ICMP Flood Attacks which is used by cybercriminals and penetration testers:

1. Hping3: It is used for the sending ICMP packets at high rates to the target system.
2. Scapy: It is a Python-based tool which can able to craft and send ICMP packets for testing.
3. LOIC (Low Orbit Ion Cannon): A simple DDoS attack tool that includes ICMP flood functionality.
4. Metasploit: It contains the various exploits for network testing which includes the ICMP flood simulations.
5. Ping Command (Basic Testing): It is the basic OS tools which is used to test the network connectivity and troubleshoot issues but it can generate a flood using the command like ping -f in linux.

Real-World Examples of ICMP (Ping) Flood Attacks

1. 2018 GitHub DDoS Attack – One of the Largest ICMP Flood-Based Attacks (1.35 Tbps)

Attack Overview:

• On February 28, 2018, GitHub, a major code hosting platform is suffered one of the largest DDoS attacks ever recorded which results the peaking at 1.35 terabits per second (Tbps).
• The attacker used the ICMP floods along with other amplification reflection techniques to attack GitHub’s infrastructure.
• The attack was sourced from thousands of devices and open memcached servers that were hijacked. These servers were used effectively increasing the impact.

Impact:

• GitHub faced the drastic outages and severe network congestion.
• Within a few minutes, GitHub managed to counter the attack through a change in their traffic routing complementary to their DDoS protection Akamai Prolexic
• The attacks emphasized the evolution of DDoS platforms of high volume bandwidth that demonstrate how ECMP flooded DDoS attacks can devastate grand scale online systems.

2. 2016 Dyn DDoS Attack – ICMP Floods Used in a Massive IoT Botnet Attack

Attack Overview:

• On October 21, 2016, a massive Distributed Denial of Service Attack was focused on the servers of Dyn a leading provider in the DNS service.
• The attack was estimated to be telnet DDoS attack using the Mirai botnet infection of IoT devices network such as routers, cameras, smart devices, etc.
• This attack is combination of ICMP flood attacks, TCP SYN floods, and UDP floods, upon Dyn’s servers.
• As a result many major websites became inaccessible to the users such as Twitter, Netflix, Reddit, and PayPal, became inaccessible.

Impact:

• It affects the businesses and users worldwide and also disrupted the 40% of global internet services,.
• Dyn struggled to handle large-scale ICMP flood attacks, proving the effectiveness of IoT-based DDoS campaigns.
• This attack cost businesses millions of dollars in lost transactions, downtime, and security investments.

3. Smurf Attacks on ISPs & Financial Institutions – Repeated ICMP Flood-Based Attacks

Attack Overview:

• Smurf attack is a specific version of ICMP flood attacks that is commonly used against ISPs and financial institutions..
• In this the attackers send an ICMP Echo Requests to a  broadcast address’s network to get all the devices to reply to a victim’s spoofed IP address.
• The result is congested networks and overburdened financial systems.

Impact:

• Banks and ISPs experienced downtime, degradation of services, and acute financial losses.
• IP Spoofing made the attacks challenging as the attackers disguised their address.
• Some financial institutions were forced to suspend some online services to manage overcrowding of the intended audience.

ICMP Flood Attack Detection Techniques

It is important to detect an ICMP Flood DDoS attack to be able to diffuse the situation. Some methods include:

• Anomaly Detection: Track the network traffic for increases in ICMP requests.
• Firewall Logs: Look into firewall logs to see if there are high volumes of ICMP requests.
• Intrusion Detection Systems (IDS): Snort and similar tools can observe and detect high volumes of ICMP traffic.
• Packet Inspection: Use Wireshark to filter ICMP headers and capture abnormal ICMP requests.
• Rate Limiting Alerts: Set alerts when a certain volume of ICMP requests per second is reached.

How to Configure Firewalls to Block ICMP Flood?

ICMP(PING) flood attack can consumes the bandwidth and server resources due to the massive ping requests on the servers or on the devices which can disrupted the networks. So we can configure the firewalls, implements the rate limiting, and also enable the DDoS protection services to filter malicious traffic effectively so that we can prevent ICMP Flood DDoS attacks.

1. Disable ICMP on External Networks (Blocking Ping Requests)

In this we blocking all the ICMP traffic so that we can prevent attacks, but it may also disable diagnostic tools like ping and traceroute. Use this method only for external networks to protect against ICMP-based DDoS attacks.

For Linux (iptables)

iptables -A INPUT -p icmp --icmp-type echo-request -j DROP            # This command prevents attackers from overwhelming your system with ping requests.

To disable ICMP traffic on Windows:

netsh advfirewall firewall add rule name="Block ICMP" protocol=ICMPv4 dir=in action=block

2. Rate Limiting ICMP Requests (Prevent Excessive Ping Flooding)

We can also apply the rate limit ICMP Echo Requests instead of completely blocking ICMP by applying this features we can allow only a specific number of pings per second while blocking excessive traffic.

For Linux (iptables - Limit ICMP to 1 per second)

iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

How it Works:

• It limits the ICMP Echo Requests to 1 per second
• It can prevents from the ping flood attacks by dropping the excessive ICMP packets

3. Configure Intrusion Prevention Systems (IPS) for ICMP Flood Detection

Intrusion Prevention Systems (IPS) can detect and block ICMP Flood attacks in real-time. Steps to Enable ICMP Flood Detection in Security Devices

• FortiGate (Fortinet Firewall): Enable IPS signatures for ICMP Flood in FortiGate settings
• Cisco ASA Firewall: Configure Adaptive Security Appliance (ASA) to limit ICMP traffic.Use the below command:

access-list outside_access_in deny icmp any any

• Snort (IDS/IPS for ICMP Flood Detection): Add this rule to detect high ICMP packet rates:

alert icmp any any -> any any (msg:"Possible ICMP Flood Attack"; dsize: >800; threshold: type threshold, track by_src, count 20, seconds 10; sid:1000001;)

4. Firewall Rules to Block ICMP Flood Based on Traffic Thresholds

If you suspect an ICMP Flood DDoS Attack, you can apply threshold-based filtering to limit abnormal ICMP traffic.

For pfSense (ICMP Flood Rate Limiting)

• Navigate to Firewall > Rules > WAN
• Add a New Rule:
  • Protocol: ICMP
  • Action: Block
  • Advanced Options: Limit to 10 requests per second

For Cisco Firewalls (Block Large ICMP Packets)

access-list 101 deny icmp any any gt 1000        # This blocks ICMP packets larger than 1000 bytes, often used in ICMP amplification attacks.

Prevention of ICMP Flood Attacks :

• By disabling the ICMP functionality of the target system, we can prevent this attack. However, doing this will disable all activities that use ICMP like ping requests, traceroute requests, and other network activities. 
• It can also be prevented by reconfiguring the firewall to disallow pings. However, the attacks from within the network cannot be mitigated.
• By limiting the processing rate of incoming ICMP packets, alternatively limiting the allowed size of the ICMP requests.

Also Read:

• DDoS Attacks in Blockchain
• Difference between DOS and DDOS attack
• Denial of Service and Prevention

Conclusion

ICMP Flood Attacks comprise a notable DDoS risk because these attacks can paralyze networks, reduce efficiency, and lead to losses. The process of detection and prevention require firewall rules, IDS/IPS deployment, rates of ICMP traffic, and security services utilizing the cloud. Continuous traffic observation, system defense updates, and the testing of the networks resilience against these threats is mandated from an organization to overshadow the hackers.