Ping of Death sounds pretty scary, and it can bring down your server and keep it that way for an extended period of time using a simple tool like the ping command. But, similar to all cyber threats, the best is to be familiar with them. So, in today’s article, we will explain in detail what Ping of Death is, how it works, and ways to prevent and stop it. Without any further ado, let’s start!
What is Ping of Death (PoD)?
Ping of Death (PoD) is a popular type of DoS (Denial of Service) attack. The cybercriminal that initiates it aims to destabilize or completely crash the device, server, or service of the victim. In order to achieve that, the attacker sends malformed or oversized packets with the help of the Ping command. Unfortunately, the moment when the victim’s system processes the data packet, the system faces an error that forces it to crash.
The concept of the Ping of Death (PoD) attack is commonly compared to a mail bomb: If the recipient opens the package, a mechanism is triggered, and the target is attacked or completely destroyed.
On the other hand, the Ping command, from which the attack gets its name, is a popular tool for testing the reachability of a network. The command is designated based on the Internet Control Message Protocol (ICMP), which serves for providing status information on the Internet.
Ping of Death attacks could occur on patched and unpatched systems that have legacy weaknesses on the target systems. The cybercriminal does not even need any additional details about the target’s device or its operating system (OS). The only required information is the IP address and nothing else.
So, now that you are familiar with what a Ping of Death attack is, it is time to dive a little bit deeper and explain how it actually works.
How does it work?
To enable a Ping of Death attack, criminals use the ping command to send oversized data packets to their target to destabilize or crash it.
An Internet Control Message Protocol (ICMP) echo-reply message, also known as “ping”, is a network utility that serves for testing a network connection. It sends out pings and waits for an ICMP echo reply, which contains information about the condition and environment of a precise network. That means the connection is successful.
In order to launch a Ping of Death attack, attackers create an ICMP packet that’s larger than allowed. The packet is separated into smaller pieces for transportation. When the receiver puts them back together, the maximum allowed size is exceeded. That leads to an overflow in the memory buffer, forcing the system to crash.
To bring it all together, the maximum packet size for IPv4 is 65,535 bytes, including a total payload of 84 bytes. Thus in order to launch a PoD attack, cybercriminals send bigger than 110k ping packets to the victim’s device.
Attackers can also perform this DoS attack over the User Datagram Protocol (UDP), Internet Packet Exchange (IPX), and Transmission Control Protocol (TCP). Anything that sends an Internet Protocol datagram can be put into action.
Does the Ping of Death Still Work?
The Ping of Death (PoD) is actually quite an old attack that first occurred back in the mid-1990s. Since then, the majority of devices and computers have been protected against these types of attacks. Additionally, a lot of websites keep blocking ICMP ping messages in order to stop and avoid future variations of this DoS attack.
Yet, an organization’s defenses can weaken due to malicious content on any computer, server, or network and still be vulnerable to the threat. It is threatened by this attack if the following are unpatched:
- Vulnerable Legacy Equipment
- Kernel driver in TCPIP.sys
- Windows XP and Windows Server 2013 copies on systems already vulnerable to a weakness in OpenType fonts
Recent Ping of Death Attacks
Let’s explain a little bit more about some of the recent appearances of the Ping of Death attack.
- PoD attacks officially made their return in August 2013 by threatening the Internet Protocol version 6 (IPv6) networks. Then the attacker took advantage of a weakness in the soon-to-be discontinued Windows XP and Windows Server 2013 operating systems, more precisely in OpenType fonts. A flaw in the IPv6 implementation of ICMP allowed the attacker to send massive ping requests that smashed the victim when it reassembled the packets. This precise threat could have been avoided simply by disabling IPv6.
- Back in October 2020 was found a flaw in the Windows component TCPIP.sys, which represents a Kernel driver that would get to the core of any Windows system if used for an attacker’s advantage. The result would be a hard crash and total shutdown of the device, followed by a reboot. Yet, it was a bit complicated for cyber criminals to actually use this vulnerability. So, users started patching their devices in order to prevent the threat.
The Ping of Death seems to be a simple and small-in-scale attack, and that makes it an efficient weapon against particular machines. Yet, we should not underestimate it! If a group of devices comes together, there is a great chance a handful of these to bring down a website that does not have the suitable infrastructure to deal with this threat. These examples from the past indeed show that Ping of Death could still appear. Therefore, it is highly recommended for organizations to take the needed measures to protect themselves.
How to prevent it?
There are several ways you could prevent, stop and protect yourself from a Ping of Death (PoD) attack. Most of them are easy and simple to implement. Let’s see which are they and how they can help you avoid Ping of Death.
- Configure your firewall to block ICMP Ping Messages. This will protect your network from the PoD threat, yet it will also stop legitimate pings. Additionally, invalid packet attacks can be launched through other listening ports, such as FTP (File Transfer Protocol). So, it is not an ideal solution.
- Monitoring with ICMP Ping. If you don’t like the idea of completely blocking ICMP Ping messages, Ping monitoring which is a part of the ClouDNS Monitoring service, would be your preferred solution. It spots network problems quickly and helps you improve your overall security.
- Implement DDoS Protection. A DDoS protection service provides you with a brilliant technique for network security and protecting against DDoS attacks and Ping of Death attacks.
- Update your software regularly. When a flaw appears, commonly shortly after, the patches are released too. It is important to accept them and keep your device safe.
- Implement a buffer. Improve your capability to accept large packets with an overflow buffer.
- Filter your traffic. You can stop just fragmented pings from reaching any device in the network. That will allow you to use the ping command’s utility without being at risk of an attack.
- Enable a checker in the assembly process. If it detects large bits of data, it will stop the abnormal packets and prevent crashing.
Conclusion
You may think that Ping of Death is outdated and it does not have a chance in modern networks. The truth is that this threat should not be neglected. It may find its way and crash your system. Therefore, it is best to take all of the precious measures in order to prevent and stop such malicious attacks.
Hello! My name is Vasilena Markova. I am a Marketing Specialist at ClouDNS. I have a Bachelor’s Degree in Business Economics and am studying for my Master’s Degree in Cybersecurity Management. As a digital marketing enthusiast, I enjoy writing and expressing my interests. I am passionate about sharing knowledge, tips, and tricks to help others build a secure online presence. My absolute favorite thing to do is to travel and explore different cultures!
