Problem solve Get help with specific problems with your technologies, process and projects.

What are 'phlashing' attacks?

Phlashing attacks target network devices and other hardware systems that rely upon firmware to contain their operating systems. Network security expert Mike Chapple explains why the threat is more than theoretical.

I've read recently about "phlashing" attacks. Are theoretical attacks like phlashing effective ways to attack an organization, should we be prepared for them, and are they a serious threat to network hardware?
Phlashing attacks target network devices and other hardware systems that rely upon firmware to contain their operating systems. In this type of attack, the hacker uploads, or "flashes," non-authentic firmware to the device under the guise of a legitimate firmware update. However, the hacker's firmware contains malicious code that provides a back door into a network or permanently disables, or "bricks," the device. This use of phlashing has earned the technique the alternative moniker of permanent denial-of-service (PDoS) attack.

Phlashing is more than theoretical: it's been demonstrated at conferences, like London's EUSecWest security conference...

in May 2008. You're correct to point out that there hasn't been a widespread outbreak in the wild. Nevertheless, enterprises should fortify devices to protect against this type of attack.

The best advice I can give you is to never connect the management interface of a device to a public network. Doing so invites trouble by making it possible for an attacker to upload non-authentic firmware. Ideally, such devices belong on their own private control network, accessible only to administrators with a legitimate need to configure the devices.

More information:

  • Learn more about how phlashing attacks can damage systems beyond repair.
  • Get the latest news and expert advice on denial-of-service prevention.
  • This was last published in December 2008

    Dig Deeper on DDoS attack detection and prevention

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    Start the conversation

    Send me notifications when other members comment.

    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

    Please create a username to comment.