phlashing

Rich Smith, head of HP's Systems Security Lab, discovered the vulnerability and demonstrated the attack at the EUSecWest security conference in June 2008. In a real-world execution, an attacker could use remote firmware update paths in network hardware, which are often left unprotected, to deliver corrupted firmware and flash this to the device. As a result, the device would become unusable.

The likelihood of phlashing attacks is under some debate. Like other types of exploits, DoS has become increasingly profit-driven. Although phlashing would be cheaper to execute and more damaging than a traditional DOS attack, its potential for gain is limited because once the network hardware has been rendered useless, the victim has no incentive to pay the attacker. The attacker's only prospect for gain would be to threaten to attack and demand a payoff to refrain from doing so. However, as suggested on the Hack a Day blog, the same attack vector could be more effectively used to flash a device with malware-embedded firmware.

Read more about phlashing: - On ITKE's Security Corner blog, Ken Harthun explores the potential damage of a phlashing attack. - On ars technica, Joel Hruska explains how 'Phlashing attacks could render network hardware useless.' - According to Eliot Phillips on Hack a Day, 'outside of griefing, the PDoS attack is not a threat.'

Do you have something to add to this definition? Let us know. Send your comments to techterms@whatis.com

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Clickjacking details released after attack proof-of-concept emerges Security researchers released details of the clickjacking attacks, warning of the seriousness of the problem because they have discovered multiple... Billy Hoffman on AJAX security and browser attacks AJAX and JavaScript security expert Billy Hoffman of HP talks about the issues with Google Chrome and why JavaScript is so dangerous. Weaponizing Kaminsky's DNS discovery Even after the DNS flaw discovered by Dan Kaminsky, many organizations are still not patching their internal servers. John Strand explains why this is...

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary DNS rebinding attack  (SearchSecurity.com) DNS rebinding is an exploit in which the attacker uses JavaScript in a malicious Web page to gain control of the victim's router. The attack works... drive-by pharming  (SearchSecurity.com) Drive-by pharming is a vulnerability exploitation method in which the attacker takes advantage of an inadequately unprotected broadband router to gain...