Which technique embeds a backdoor within ICMP Echo messages to enable covert communication?

Which technique embeds a backdoor within ICMP Echo messages to enable covert communication?

• A. ACK bit
• B. ICMP protocol
• C. ICMP tunneling
• D. HTTP Tunneling

Answer: (C)

Covert channels can be created by using the network’s diagnostic messages as a hidden transport for data. ICMP tunneling specifically uses ICMP Echo messages (the ping packets) to carry payload data between a client and a controller, effectively creating a backdoor channel that blends in with normal ICMP traffic. The tunnel software on both ends encodes and decodes commands and responses inside the ICMP payload, so ordinary network monitoring may miss it because the traffic isn’t using a standard application protocol. This is why ICMP tunneling is the best fit here: it directly leverages the Echo messages to transmit hidden data, enabling covert communication. In contrast, the ACK bit is a TCP mechanism and isn’t about covert backdoors in ICMP, the ICMP protocol itself is just the protocol family and doesn’t imply tunneling, and HTTP tunneling uses HTTP traffic to carry data rather than ICMP.

Covert channels can be created by using the network’s diagnostic messages as a hidden transport for data. ICMP tunneling specifically uses ICMP Echo messages (the ping packets) to carry payload data between a client and a controller, effectively creating a backdoor channel that blends in with normal ICMP traffic. The tunnel software on both ends encodes and decodes commands and responses inside the ICMP payload, so ordinary network monitoring may miss it because the traffic isn’t using a standard application protocol.

This is why ICMP tunneling is the best fit here: it directly leverages the Echo messages to transmit hidden data, enabling covert communication. In contrast, the ACK bit is a TCP mechanism and isn’t about covert backdoors in ICMP, the ICMP protocol itself is just the protocol family and doesn’t imply tunneling, and HTTP tunneling uses HTTP traffic to carry data rather than ICMP.