Which technique allows tunneling a backdoor shell in the data portion of ICMP Echo packets?

Which technique allows tunneling a backdoor shell in the data portion of ICMP Echo packets?

• A. ACK tunneling
• B. ICMP protocol
• C. ICMP tunneling
• D. Post-Connection SYN

Answer: (C)

ICMP tunneling uses the data portion of ICMP Echo messages to carry a covert channel. ICMP Echo requests and replies have a payload field that can carry arbitrary data, so an attacker can encode commands and their outputs inside those payloads and communicate without drawing obvious attention. This makes it the right fit for tunneling a backdoor shell through ICMP Echo traffic, especially since many networks allow ICMP for basic reachability checks, making such a channel harder to spot if not monitored carefully. The other ideas don’t align with the scenario. ACK tunneling hides data in the TCP layer by abusing acknowledgments, not in ICMP Echo payloads. ICMP protocol is just the protocol itself, not a specific method for covert data transfer. Post-Connection SYN relates to the TCP three-way handshake, not to ICMP. In practice, defending against ICMP tunneling involves monitoring and filtering ICMP traffic, inspecting payloads for abnormal patterns, and applying strict egress controls or disabling unnecessary ICMP types to reduce covert channels.

ICMP tunneling uses the data portion of ICMP Echo messages to carry a covert channel. ICMP Echo requests and replies have a payload field that can carry arbitrary data, so an attacker can encode commands and their outputs inside those payloads and communicate without drawing obvious attention. This makes it the right fit for tunneling a backdoor shell through ICMP Echo traffic, especially since many networks allow ICMP for basic reachability checks, making such a channel harder to spot if not monitored carefully.

The other ideas don’t align with the scenario. ACK tunneling hides data in the TCP layer by abusing acknowledgments, not in ICMP Echo payloads. ICMP protocol is just the protocol itself, not a specific method for covert data transfer. Post-Connection SYN relates to the TCP three-way handshake, not to ICMP.

In practice, defending against ICMP tunneling involves monitoring and filtering ICMP traffic, inspecting payloads for abnormal patterns, and applying strict egress controls or disabling unnecessary ICMP types to reduce covert channels.