Loki

A common covert channel in use today is the Loki attack. This attack uses the ICMP
protocol for communications purposes. This protocol was not developed to be used in
this manner; it is only supposed to send status and error messages. But someone developed
a tool (Loki) that allows an attacker to write data right behind the ICMP header.

 

This allows the attacker to communicate with another system through a covert channel.
It is usually very successful because most firewalls are configured to allow ICMP traffic
in and out of their environments. This channel is covert because it uses something for
communication purposes that was not developed for this type of communication functionality.
More information on this type of attack can be found at [url]http://xforce.iss.net/[/url]
xforce/xfdb/1452.

本文出自 “木鸟” 博客，谢绝转载！