Web Application Security
Re: Should or shouldn't block public ping to a website Sep 09 2011 10:46AM
Sandeep Cheema (51l3n7 live in) (1 replies)
Why are you not allowing ICMP? Is the server itself exposed or behind a netscaler or some routing device? Even if it's not covered behind, you can allow ping. The only exploit with ping is the ping of death, which is obsolete now. Use a software IDS\IPS?

Regards, Sandeep

Sent from BlackBerry® on Airtel

-----Original Message-----
From: ShiYih Lye <shiyih.lye (at) my.offgamers (dot) com [email concealed]>
Date: Mon, 5 Sep 2011 06:03:57
To: <webappsec (at) securityfocus (dot) com [email concealed]>; <pen-test (at) securityfocus (dot) com [email concealed]>
Subject: Should or shouldn't block public ping to a website

Hi,

All this while I'm not allowing any public ping to the website I'm
maintaining, but it's making me tougher to troubleshoot should any
user from the globe having trouble to access our website, as I can't
make them to send a proper traceroute report.

To your opinion, is it necessary to block public ping to a public
website ? Is this security practice still relevant in today exploit
technology ?

And if you think it's still necessary, how do I make sure my user's
traceroute still work when all ICMP is dropped from public ?

Thanks for any input, appreciated that.

Regards,
Lye

This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------

This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------

[ reply ]
Re: Should or shouldn't block public ping to a website Sep 11 2011 10:39PM
Clement Dupuis (clement dupuis gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus