New 'Phlashing' Attack Sabotages Hardware 242
yahoi writes "A new type of denial-of-service attack, called permanent denial-of-service (PDOS), damages a system so badly that it requires replacement or reinstallation of hardware. A researcher has discovered how to abuse firmware update mechanisms with what he calls 'phlashing' — a type of remote PDOS attack."
Pharphetched naming (Score:5, Insightful)
Re:Pharphetched naming (Score:5, Funny)
Re:Pharphetched naming (Score:5, Funny)
The European Commission has announced an agreement whereby English will be the official language of the EU, rather than German, which was the other contender. Her Majesty's Government conceded that English spelling had room for improvement and has therefore accepted a five-year phasing in of "Euro-English".
In the first year, "s" will replace the soft "c". Sertainly, this will make sivil servants jump for joy. The hard "c" will be dropped in favour of the "k", Which should klear up some konfusion and allow one key less on keyboards.
There will be growing publik enthusiasm in the sekond year, when the troublesome "ph" will be replaced with "f", making words like "fotograf" 20% shorter.
In the third year, publik akseptanse of the new spelling kan be expekted to reach the stage where more komplikated changes are possible. Governments will enkourage the removal of double letters which have always ben a deterent to akurate speling. Also, al wil agre that the horible mes of the silent "e" is disgrasful.
By the fourth yer, peopl wil be reseptiv to steps such as replasing "th" with "z" and "w" with "v".
During ze fifz yer, ze unesesary "o" kan be dropd from vords kontaining "ou" and similar changes vud of kors be aplid to ozer kombinations of leters. After zis fifz yer, ve vil hav a reli sensibl riten styl. Zer vil be no mor trubls or difikultis and everivun vil find it ezi to understand ech ozer. ZE DREM VIL FINALI COM TRU!
Herr Schmidt
Re:Pharphetched naming (Score:5, Informative)
http://www.physics.uwo.ca/~harwood/humor13.txt [physics.uwo.ca]
Re:Pharphetched naming (Score:5, Informative)
Re:Pharphetched naming (Score:5, Funny)
Sincerely yours,
*
Re:Pharphetched naming (Score:5, Funny)
Re: (Score:2, Interesting)
Each time I read this, it gets easier to read the final paragraph. However, it still has at least two issues. The first is the overloading of the v with w which have different sounds. The second is that British English has about 11 non-dipthong vowels (which is really most of the issue with spelling), and the "new spelling system" (let's call it a Rechtschreibung) doesn't really address that. This of course, can also lead to the issues of sh and ch. Although if you left sh as the s sy
Re:Pharphetched naming (Score:5, Funny)
Re: (Score:3, Insightful)
source of the name (Score:5, Interesting)
I am not making this up: less than a week ago, I woke up thinking: what to firmware, BIOS, TPM, and IPMI have in common? They'd all be great vectors for bricking a machine.
Re: (Score:3, Funny)
Yeah it's phucking stupid. The stupid phuckwits should take some time to phink of a better name.
I had no clue people still upgraded firmwares. (Score:3, Interesting)
I can't tell you the last time upgraded the bios on a motherboard. I think it was an older P3 Dell PowerEdge because I was installing Linux on it.
Re: (Score:3, Informative)
Re: (Score:3, Funny)
He would probably be outright offended if he heard about Rockbox or other projects where people are *writing* their own firmware.
Re: (Score:3, Insightful)
I can easily see this being an issue, if perhaps, someone attacked your router and destroyed it in the middle of a counter-strike match or a WoW arena matchup, for example.
Re: (Score:2)
I can easily see this being an issue, if perhaps, someone attacked your router and destroyed it in the middle of a counter-strike match or a WoW arena matchup, for example.
Umm... I'd see it as even more of an issue if you were a telecommuter and your VPN died. Corporate or government, there are many such staff.
Of course, this will be on the new list of "dog ate my homework" excuses: "Really boss, somebody bricked my router!"
Re: (Score:3)
Re: (Score:2)
Re:I had no clue people still upgraded firmwares. (Score:5, Interesting)
Business wise: I would go higher end as time==money. Better reliability can be afforded.
It does what I want it to do, and it does it well. And cheap.
Re: (Score:2)
I got it before they started using that non-linux OS on it.
Re: (Score:2)
1. SIP gateway
2. Kismet node
3. SSH tunnel/TOR tunnel
4. Linux firewall (i'd rather have freebsd firewall, but oh well)
5. IPv4-IPv6 tunnel
more here [openwrt.org]. I doubt your cisco has that feature set.
Re: (Score:3, Interesting)
Not that comfortable with doing it yourself? Buy an http://www.imagestream.com/ [imagestream.com]ImageStream Envoy
Re: (Score:2, Interesting)
Re: (Score:2, Informative)
And, thanks to new exploits like this, firmware upgrades may be necessary to block exploits from sabotaging your network equipment, simply maliciously (bricking) or for profit (undetectable redirects to phishing sites, attaching your affiliate ID to all ads, catching any SSN/Credit Card Number/Login going through even if it is not a phishing site.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
iPhone
PS3
360
Wii
PSP
Read-only switch (Score:5, Interesting)
Re:Read-only switch (Score:4, Informative)
Re: (Score:2)
Re:Read-only switch (Score:4, Insightful)
Bricking (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
Re:Bricking (Score:5, Insightful)
FTFY
Re: (Score:2)
Re: (Score:3, Informative)
Re:Bricking & replacement parts (Score:4, Informative)
Truly spoken by someone who hasn't tried to buy a programmed flash part for a made in China board. Hint, the replacement board can be purchased but the replacement chip containing IP firmware is a little harder to obtain. Custom parts on the board (flash memory) are not imported in a programmed state. If you can extract the image from the executable without the aid of the boot loader, many of these blank chips and flash upgrade don't come with any way to install the initial code to load the initial firmware.
A new blank BIOS chip doesn't contain enough firmware to boot a floppy, USB memory stick, or CD ROM to flash the BIOS. You need a BIOS image and device programmer. Since neither is supplied and both are needed, your chances of obtaining a BIOS image and installing the firmware are slim to none.
A Blank clock flash memory chip from Mouser does not make a bricked board bootable enough to flash the new BIOS firmware.
If you want to try it, Pick up a blank unit here; Good luck
http://www.epn-online.com/page/new56862/mouser-stocks-silicon-laboratories-c8051f9xx-line-of-mcus.html [epn-online.com]
Re: (Score:2, Insightful)
Re: (Score:2)
thank you for another buzzword (Score:2, Insightful)
Re:thank you for another buzzword (Score:5, Funny)
Re:thank you for another buzzword (Score:5, Funny)
Re: (Score:3, Insightful)
In Italy (Score:2, Informative)
Re: (Score:2, Interesting)
And no, I'm not going to tell you who my ISP is.
Re: (Score:2)
Try to upgrade the firmware off Netgear's website, and the normal WGR614 firmware doesn't apply... the router kicks it out, saying that the firmware's for the wrong device.
P.S.: I'm doing this from memory, so I may have the wrong model number listed above. My apologies if so.
Re: (Score:2)
How is the mechanism exploited? (Score:5, Insightful)
Those two rarely go hand in hand.
However, I think we'll see a lot of trojans with firmware payloads. How many people use the WRT54G? And how many access points are unsecured with the name "linksys"? Those people probably didn't change their admin password.
Simple solution: Hardware button. You have to press it to flash the router, and you have a minute after you press it to upload the firmware. Should be an easy thing to do and provide a great amount of protection.
Re: (Score:2)
Re:How is the mechanism exploited? (Score:4, Insightful)
Re: (Score:2)
That's the best they could come up with (Score:5, Funny)
It figures that when "bricking" might be remotely appropriate, they pick something worse.
It could have been remote bricking, BOIP(brick over IP), brick-and-run, packet bricking, warbricking.
Even brick-o-gram(landshark).
Sigh...
Re:That's the best they could come up with (Score:5, Funny)
Even brick-o-gram(landshark).
Re: (Score:3, Funny)
Surely this isn't that much of a problem (Score:4, Interesting)
To me this looks like talking up a non existent problem - but I'm open to persuasion otherwise.
Re: (Score:2)
What if one were able to upload firmware from device type A, a certain DVD-Writer, to device type B, a CD-ROM? I realize it isn't the best example, but wouldn't having the wrong firmware type (not just a different hacked version of the same type of drive) completely brick that hardware? From that standpoint, I don't think the firmware would have to be "targeted" per se.
Re: (Score:2)
As a targeted attack against a commercial venture any support team worth their salt will do patching as part of routine maintenance - don't we guys'n'gals?
The problem is that this isn't a targeted attack, it's a fuzzer.
If there are overflow issues in your code, allegedly, this will trash your firmware.
To me this looks like talking up a non existent problem - but I'm open to persuasion otherwise.
It's a problem because it goes back to the truly malicious days of the 80's and 90's where the goal wasn't to own someone's computer, just to destroy and disrupt. This could kill your graphics card, sound card, network card, bluetooth, cd/dvd drive, etc etc etc.
And it isn't a quick solve, because it will require the people writing firmwares to write (at a mini
Re: (Score:3, Informative)
To me this looks like talking up a non existent problem - but I'm open to persuasion otherwise.
If the trojan carried the payload onboard, sure, the target audience would be small. However, if the trojan read the PC
This is new? (Score:4, Insightful)
Re: (Score:2)
I didn't believe in them, though.
Re: (Score:2)
I'm pretty sure I remember stories about viruses that could destroy hardware,
I remember stories about viruses that could infect the computer human user. I didn't believe in them, though.
Sure, but these at least are believable if you don't have the spare resources to provide proper encapsulation for the interfaces to your hardware. The OS shouldn't be able to drive a bus while some other device is talking on it, but sufficiently dumb/cheap driver hardware might not prevent this.
Re: (Score:2)
It's called an e-mail chain letter or virus hoax, and infects the minds of gullible users.
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
In the good old DOS PC days when 10Mb hard disks were 'big' and 'Stoned' was probably the only wild virus ever found on the lab machines..
There was an issue wrt Stoned I think, or some other virus of the time whose name escapes me, its final action was to zap the old MFM hard disks via some low level init call, but, this wasn't fatal as we could get the info back off them with a bit of faffing, however, the first generation of those new fangled IDE disks, the same init call permanent
Nothing to see, move on folks. (Score:3, Informative)
Re: (Score:3, Interesting)
It is of interest. Think about it. If you wanted to do damage to company xyz, you social engineer the information for what PCs they are using, the CD hardware etc., routers, blah blah blah... then silently release a worm or virus that redirects them to your special webpage. brick brick brick brick until their productivity grinds to a halt.... if some get bricked for the CD, others for the motherboard, others because of routers... it matters not. What is being shown is that it is P
Rivets (Score:2)
Unfair. If the ship had been built with the rivets specified by the engineers it would not have sunk. The shipyard couldn't get rivets that met specs so management went with what they had. After all, they had a delivery date...
Proof of concept (Score:5, Funny)
I used to work with a Sys Admin like that (Score:5, Interesting)
Lets be clear about how dumb this person was, he had a BIOS that worked on his test servers and would then apply that to all the other servers INDEPENDENT OF HARDWARE OR OS. He would then start the machines (which of course wouldn't start) declare them "broken" and say the issue was with the software.
We did some low level hardware stuff in our software and it did break the boxes sometimes so it took 2 months of painful testing and debugging which found nothing, it only came about because one of the team had a heavy night and decided to "rest" in the server room and saw the moron apply the BIOS to a server that had been running and then scurry out to blame the team again.
Basic rule after then was BIOS set to read-only and locked down with a secure password, to this day my BIOS has a password thanks to the sheer physical shock of realising how dumb some people can be.
Re:I used to work with a Sys Admin like that (Score:4, Informative)
Re: (Score:2)
I always assumed that the flash updating programs would have lock outs to prevent someone from uploading an incorrect BIOS image when flashing the hardware. This would prevent people from flashing things, bricking their own hardware, and then trying to return it under warranty.
I add that feature to the embedded hardware that I design ...
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Re: (Score:2)
This is what I love about computers (Score:2)
Nothing is really new.
Bytecode [wikipedia.org], killer pokes [oldcomputers.net], the auto type [wikipedia.org], XML [wikipedia.org] ...
Rich.
Hardware Virus (Score:4, Interesting)
Anyone else remember this? I had only seen it once and have never been able to find a reference to it.
This would have been in the mid '90s. I have been wracking my brain over finding it since then.
Anyone else who has heard of this, reply and let me know.
Re:Hardware Virus (Score:5, Interesting)
Re: (Score:3, Insightful)
But in the end, I think those were all just email hoaxes. Ah, those were the good ol' days, when hoax emails were pranks like those and not phishing scams. Now I'm all nostaligic.
All things considered, though, I don't believe the head would ever be able to do what you're suggesting due to the head never actually touching t
Re: (Score:2)
Ouch (Score:3, Funny)
Hardly a new phenomenon (Score:5, Informative)
Works in real life too ! (Score:5, Funny)
Re: (Score:3, Funny)
Little endian (Score:2)
Re: (Score:2)
Sometimes I wonder... (Score:2)
even if information wants to be free, wtf am I supposed to do with it?
"Fone Phreaking" I saw a benefit to, and its something that I took an interest in.
Trying to hijack computers and stuff -- why bother? Unless I'm doing it to be a dick to someone, just why? I can understand if mobster type
Re:Sometimes I wonder... (Score:5, Informative)
Re: (Score:2)
Everything should have a factory reset switch (Score:5, Insightful)
1 to reset user data, akin to a standard BIOS "reset to factory settings"
1 to re-flash the BIOS to the factory-installed version of the BIOS, to de-brick devices.
Furthermore, if there is anything a user can do that is designed to update the machine in a way that's irreversible without a password setting a BIOS or boot password, a hardware switch should be pressed as the information is saved. While this won't prevent social engineering, it will prevent pure software exploits from making the hardware unusable.
Re: (Score:3, Insightful)
I'm sorry, but every device out there should have two factory reset switches:
Things like easy accessible switches and backup copies of the flash cost money. Granted, they don't cost very much, but when you are talking about millions of units things add up. Since these features are useless (i.e will never be used) for 99.9% of the customers, the market forces will act to remove them.
Besides they are not really necessary if you simply engineer the old flash to accept only flashing with a digitally signed newer version. This takes a few KB of object code to implement, and will 100% bl
Magic Bullet (Score:5, Insightful)
Yes there is. It's called a write-disable switch.
Nothing really new... (Score:2)
I think Malicious Firmware Update is better.
M.F.U. (I am sure with those initials, we could come up with a name much more compelling and befitting the situation you'd be in if this happened to you).
Anyone who has worked with even consumer grade home computers and routers and done a firmware or BIOS flash should have been aware that this is possible, with most home routers having the ability for remote management....
Now....if we
Already done in 1998 (Score:5, Interesting)
This is not really new.. (Score:5, Interesting)
- wait for a key press
- for decreasing n
- turn on the tape cassete relay
- wait n cycles
- turn off the tape cassete relay
this would cause an increasing pitch whine, followed by a little whiff of smoke from the cassette relay.Something about the people there always saying "there's nothing you can type on the computer that will hurt it..."
But they can't patent it because there's prior art (Score:3, Interesting)
These days, though, I suppose that he'd probably be charged with something. The smart thing to do if you learn of such bugs is probably to not notify anyone, especially not the vendor or your employer. Instead, you quietly offer the information (for a price of course) to various "interested parties" for whatever use they'd like to make of it.
Another time, some students figured out a bug in Univac's tape drives. They found code that sent commands to spool forward and rewind with timing such that the drive did both - which snapped the tape. They were also not believed, so they demoed it. They submitted a job that asked for a scratch tape, wrote a few KB of data, and snapped the tape. Then it asked for another scratch tape. It didn't take too many tapes before the operators figured out that they should call in the CS people.
I'll bet that others here have a bunch of similar stories. And nonetheless, a future story will be the patenting of using such bugs for "PDOS" attacks. Probably by our favorite whipping boy, Microsoft, who will patent such attacks as a way of enforcing licensing restrictions or DRM.
Maybe the fellow the story is about can get the patent first
Re:New word overloading (Score:4, Funny)
This is why, Flash must die! [slashdot.org]