School Recognition Display ICMP Redirect Hardening Checklist
Intent: decide — A recognition display that begins routing its content management system traffic through an unexpected gateway — delivering content intermittently, freezing a hall of fame slideshow mid-ceremony, or failing to pull updated athlete statistics while IPv4 connectivity appears normal — is not malfunctioning. It is responding correctly to an ICMP Redirect message it received. ICMP Redirect (ICMPv4 Type 5) is a mechanism by which a router informs a directly connected host that a more efficient next-hop gateway exists for a specific destination. The host accepts the redirect and installs a host route in its local routing table, sending traffic for that destination directly to the suggested gateway. The problem is that ICMP Redirect messages carry no authentication. Any device on the same subnet can craft a forged redirect message that appears to originate from the legitimate router and direct the display’s CMS traffic to a rogue gateway — without triggering a link-down alert, a CMS authentication error, or any visible indicator that the display’s routing behavior has changed.
Read More
