I've read recently about "phlashing" attacks. Are theoretical attacks like phlashing effective ways to attack an organization, should we be prepared for them, and are they a serious threat to network hardware?

    Requires Free Membership to View

Phlashing attacks target network devices and other hardware systems that rely upon firmware to contain their operating systems. In this type of attack, the hacker uploads, or "flashes," non-authentic firmware to the device under the guise of a legitimate firmware update. However, the hacker's firmware contains malicious code that provides a back door into a network or permanently disables, or "bricks," the device. This use of phlashing has earned the technique the alternative moniker of permanent denial-of-service (PDoS) attack.

Phlashing is more than theoretical: it's been demonstrated at conferences, like London's EUSecWest security conference in May 2008. You're correct to point out that there hasn't been a widespread outbreak in the wild. Nevertheless, enterprises should fortify devices to protect against this type of attack.

The best advice I can give you is to never connect the management interface of a device to a public network. Doing so invites trouble by making it possible for an attacker to upload non-authentic firmware. Ideally, such devices belong on their own private control network, accessible only to administrators with a legitimate need to configure the devices.

More information:

  • Learn more about how phlashing attacks can damage systems beyond repair.
  • Get the latest news and expert advice on denial-of-service prevention.
  • This was first published in December 2008

    There are Comments. Add yours.

     
    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: