Unrestricted ICMP Access

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features

Knowledge Base Amazon Web Services Amazon EC2 Unrestricted ICMP Access

Last updated: 13 April 2018

Risk level: Medium (should be achieved)

Rule ID: EC2-044

Check your EC2 security groups for inbound rules that allow unrestricted access (i.e. 0.0.0.0/0 or ::/0) to any hosts using ICMP and restrict access to only those IP addresses that require it in order to implement the principle of least privilege and reduce the possibility of a breach. Internet Control Message Protocol (ICMP) is an error-reporting protocol that is typically used to troubleshoot TCP/IP networks by generating error messages for any issues with delivering IP packets. Even if ICMP is not a transport protocol, it can be used to exploit network vulnerabilities.

This rule can help you with the following compliance standards:

This rule can help you work with the AWS Well-Architected Framework

This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS

Security

Allowing unrestricted ICMP access can increase opportunities for malicious activity such as denial-of-service (DoS) attacks, Smurf and Fraggle attacks.

Audit

To determine if your EC2 security groups allow unrestricted ICMP access, perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the left navigation panel, under NETWORK & SECURITY section, choose Security Groups.

04 Click inside the attributes filter box located under the dashboard top menu, choose Protocol and select ICMP from the protocols list.

05 Select an EC2 security group returned as result.

06 Select the Inbound tab from the dashboard bottom panel.

07 Verify the value available in the Source column for any inbound/ingress rules with the Protocol set to ICMP or any other custom ICMP type:

If one or more rules have the source set to 0.0.0.0/0 or ::/0 (Anywhere), the selected security group allows unrestricted traffic to any hosts using ICMP, therefore the access to the associated EC2 instance(s) is not secured.

08 Repeat steps no. 5 – 7 to verify the rest of the EC2 security groups returned as result at step no. 4.

09 Change the AWS region from the navigation bar and repeat the audit process for other regions.

Using AWS CLI

01 Run describe-security-groups command (OSX/Linux/UNIX) using the necessary filters to expose the security groups that have ingress rules that allow ICMP traffic from all addresses (0.0.0.0/0 or ::/0):

aws ec2 describe-security-groups
	--region us-east-1
	--filters Name=ip-permission.protocol,Values=icmp Name=ip-permission.cidr,Values='0.0.0.0/0'
	--query 'SecurityGroups[*].{Name:GroupName}'

aws ec2 describe-security-groups
	--region us-east-1
	--filters Name=ip-permission.protocol,Values=icmp Name=ip-permission.ipv6-cidr,Values='::/0'
	--query 'SecurityGroups[*].{Name:GroupName}'

02 The command output should return an array with the requested information. If the command does not return any output, there are no EC2 security groups that allow unrestricted ICMP access, otherwise it should return the name of the security group(s) that match filter criteria, as shown in the following example:

[
    {
        "Name": "UbuntuServerSecurityGroup"
    },
    {
        "Name": "MyWebEC2SecurityGroup"
    }
]

03 Repeat step no. 1 and 2 to perform the audit process for other AWS regions.

Remediation / Resolution

To update your security groups inbound/ingress configuration in order to restrict ICMP access to specific entities (IP addresses, IP ranges and security groups), perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the navigation panel, under NETWORK & SECURITY section, choose Security Groups.

04 Select the appropriate security group (see Audit section to identify the right one(s)).

05 Select the Inbound tab from the dashboard bottom panel and click the Edit button.

06 In the Edit inbound rules dialog box, change the traffic Source for any inbound rules that allow unrestricted access using ICMP protocol by performing one of the following actions:

Select My IP from the Source dropdown list to allow inbound traffic only from your machine (from your IP address).
Select Custom from the Source dropdown list and enter one of the following options based on your access requirements:
- The static IP/Elastic IP address of the permitted host with the suffix set to /32, e.g. 53.120.56.115/32.
- The IP address range of the permitted hosts in CIDR notation, for example 53.120.56.115/24.
- The name or ID of another security group available in the same AWS region.

07 Click Save to apply the changes.

08 Repeat steps no. 4 – 7 to update other EC2 security groups that allow unrestricted ICMP access.

09 Change the AWS region from the navigation bar and repeat the process for other regions.

Using AWS CLI

01 First, run revoke-security-group-ingress command (OSX/Linux/UNIX) to remove the inbound rule(s) that allow unrestricted ICMP access, from the selected EC2 security group. The following command example removes an inbound rule that allows the ICMP message "Destination Unreachable": Fragmentation Needed and Don't Fragment was Set" (Type 3, Code 4 - check for other ICMP types at http://goo.gl/YLSxxZ). (the command does not return an output):

aws ec2 revoke-security-group-ingress
	--region us-east-1
	--group-name UbuntuServerSecurityGroup
	--ip-permissions '[{"IpProtocol": "icmp", "FromPort": 3, "ToPort": 4, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]'

02 Run authorize-security-group-ingress command (OSX/Linux/UNIX) to add the inbound rules removed at the previous step with a different set of parameters in order to restrict Internet Control Message Protocol (ICMP) access to specific entities. To add custom inbound/ingress rules to the selected security group, use one of the following options (the command does not produce an output):

Add an inbound rule that allows ICMP access to the specific static IP/Elastic IP address of the permitted host using ICMP Type 3, Code 4:

aws ec2 authorize-security-group-ingress
	--region us-east-1
	--group-name UbuntuServerSecurityGroup
	--ip-permissions '[{"IpProtocol": "icmp", "FromPort": 3, "ToPort": 4, "IpRanges": [{"CidrIp": "54.164.53.205/32"}]}]'

Add an inbound rule that allows ICMP access to the IP address range of the permitted hosts using ICMP Type 3, Code 4:

aws ec2 authorize-security-group-ingress
	--region us-east-1
	--group-name UbuntuServerSecurityGroup
	--ip-permissions '[{"IpProtocol": "icmp", "FromPort": 3, "ToPort": 4, "IpRanges": [{"CidrIp": "54.164.53.205/24"}]}]'

Change the FromPort (ICMP Type) and ToPort (ICMP Code) attributes values based on your requirements (check for the necessary ICMP types and their codes at http://goo.gl/YLSxxZ), then repeat steps a. and b. to add the required inbound rule(s) removed at step no. 1.

03 Repeat step no. 1 and 2 to update other EC2 security groups that allow unrestricted ICMP access using AWS CLI.

04 Repeat steps no. 1 - 3 to implement the entire process for other AWS regions.

References

AWS Documentation
Amazon EC2 Security Groups for Linux Instances
Security Groups for Your VPC
Authorizing Inbound Traffic for Your Linux Instances

AWS Command Line Interface (CLI) Documentation
ec2
describe-security-groups
revoke-security-group-ingress
authorize-security-group-ingress

Publication date Jun 23, 2016

Unrestricted ICMP Access

Audit

Using AWS Console

Using AWS CLI

Remediation / Resolution

Using AWS Console

Using AWS CLI

References

Related EC2 rules