I've read recently about "phlashing" attacks. Are theoretical attacks like phlashing effective ways to attack an organization, should we be prepared for them, and are they a serious threat to network hardware?
Security expert Mike Chapple:
Phlashing attacks target network devices and other hardware systems that rely upon firmware to contain their operating systems. In this type of attack, the hacker uploads, or "flashes," non-authentic firmware to the device under the guise of a legitimate firmware update. However, the hacker's firmware contains malicious code that provides a back door into a network or permanently disables, or "bricks," the device. This use of phlashing has earned the technique the alternative moniker of permanent denial-of-service (PDoS) attack.
Phlashing is more than theoretical: it's been demonstrated at conferences, like London's EUSecWest security conference in May 2008. You're correct to point out that there hasn't been a widespread outbreak in the wild. Nevertheless, enterprises should fortify devices to protect against this type of attack.
The best advice I can give you is to never connect the management interface of a device to a public network. Doing so invites trouble by making it possible for an attacker to upload non-authentic firmware. Ideally, such devices belong on their own private control network, accessible only to administrators with a legitimate need to configure the devices.
