Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

[ Create a new account ]

New 'Phlashing' Attack Sabotages Hardware

Posted by timothy on Tuesday May 20, @09:29AM
from the not-so-nice dept.
yahoi writes "A new type of denial-of-service attack, called permanent denial-of-service (PDOS), damages a system so badly that it requires replacement or reinstallation of hardware. A researcher has discovered how to abuse firmware update mechanisms with what he calls 'phlashing' — a type of remote PDOS attack."

Related Stories

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.
  • by Anonymous Coward on Tuesday May 20, @09:31AM (#23474386)
    I'm sick of this naming phad.
  • Read-only switch (Score:5, Interesting)

    by ettlz (639203) on Tuesday May 20, @09:36AM (#23474468) Homepage Journal
    ...or jumper. How much more would that cost?
  • Bricking (Score:5, Funny)

    by ThrudTheBarbarian (670936) on Tuesday May 20, @09:37AM (#23474484)
    FINALLY! *This* is bricking
      • Re:Bricking (Score:5, Insightful)

        by Linker3000 (626634) on Tuesday May 20, @10:21AM (#23475156)
        Not a very difficult fix for any tech savvy person with surface mount device reworking equipment - or a soldering iron, a steady hand and a great deal of faith in their ability (or practical experience) to rework SMDs with the wrong kit.

        FTFY
  • by Coopjust (872796) on Tuesday May 20, @09:42AM (#23474546)
    Is it possible to exploit firmware from the outside, unless the person has enabled remote management and is using the default password?

    Those two rarely go hand in hand.

    However, I think we'll see a lot of trojans with firmware payloads. How many people use the WRT54G? And how many access points are unsecured with the name "linksys"? Those people probably didn't change their admin password.

    Simple solution: Hardware button. You have to press it to flash the router, and you have a minute after you press it to upload the firmware. Should be an easy thing to do and provide a great amount of protection.
  • Phlashing? And he calls his demo code PhlashDance? Good way to make this seem completely silly. "Damn it, we've been phlashdanced!" That'll really get management to up your security budget, if they ever stop laughing.

    It figures that when "bricking" might be remotely appropriate, they pick something worse.

    It could have been remote bricking, BOIP(brick over IP), brick-and-run, packet bricking, warbricking.

    Even brick-o-gram(landshark).

    Sigh...
  • by Malevolent Tester (1201209) * on Tuesday May 20, @09:47AM (#23474626) Journal
    Dear Sir, I am the former son of the Nigerian dictator Sonni Abacha. I would like to give you several million dollars. To receive this, please add a static IP to your D-Link router and reboot it.
  • He used to be able to turn any working piece of kit into a piece of metal art in about 20 seconds, EVERYTHING was always a BIOS issue and he would NEVER check with anyone before replacing the BIOS.

    Lets be clear about how dumb this person was, he had a BIOS that worked on his test servers and would then apply that to all the other servers INDEPENDENT OF HARDWARE OR OS. He would then start the machines (which of course wouldn't start) declare them "broken" and say the issue was with the software.

    We did some low level hardware stuff in our software and it did break the boxes sometimes so it took 2 months of painful testing and debugging which found nothing, it only came about because one of the team had a heavy night and decided to "rest" in the server room and saw the moron apply the BIOS to a server that had been running and then scurry out to blame the team again.

    Basic rule after then was BIOS set to read-only and locked down with a secure password, to this day my BIOS has a password thanks to the sheer physical shock of realising how dumb some people can be.
     
  • by g051051 (71145) on Tuesday May 20, @10:09AM (#23474940)
    This isn't exactly a new problem...in the early days, you could fry a monitor by setting the video card to absurd refresh rates, and you could destroy hard disks by issuing bogus stepping commands to the heads and slamming them into the stops.
  • by garett_spencley (193892) on Tuesday May 20, @10:14AM (#23475026) Homepage
    The last time I "phlashed" someone in real-life I received a permanent injunction and restraining order from a very nice judge in court. I guess you can call that a permanent denial of service.
  • I'm sorry, but every device out there should have two factory reset switches:

    1 to reset user data, akin to a standard BIOS "reset to factory settings"
    1 to re-flash the BIOS to the factory-installed version of the BIOS, to de-brick devices.

    Furthermore, if there is anything a user can do that is designed to update the machine in a way that's irreversible without a password setting a BIOS or boot password, a hardware switch should be pressed as the information is saved. While this won't prevent social engineering, it will prevent pure software exploits from making the hardware unusable.

  • Magic Bullet (Score:5, Insightful)

    by John Hasler (414242) on Tuesday May 20, @10:40AM (#23475438)
    > "Unfortunately, there isn't a magic bullet..."

    Yes there is. It's called a write-disable switch.
    • by trongey (21550) on Tuesday May 20, @10:30AM (#23475298) Homepage

      Sometimes I wonder the mindset that even goes into creating something like this. ... I can understand if mobster types are trying to do a virtual bank robbery,...
      Close. It's called extortion. You do this to one of a site's machines. Then you send the demand for payment with a threat to do it to the rest of their machines. It's been happening to gambling and porn sites for years since law enforcement agencies don't usually get in a hurry to apprehend people who attack those sites. They have been using DDoS, so this would just be a bigger hammer.
    • Re:Hardware Virus (Score:5, Interesting)

      by Anonymous Coward on Tuesday May 20, @10:37AM (#23475388)
      I experimented with a technique (that worked) on the Commodore 64. You could address the floppy drive directly to move the drive head to the innermost position, which was on the opposite side of the "track 0" microswitch. Then you deliberately crash the CPU on the drive. When it POSTs it moves the head inward to track 0 to initialize. Since the head is on the wrong side of the switch it never gets there, makes a terrible noise, and gives up.