Slashdot Mirror
Intel-Powered Broadband Modems Highly Vulnerable To DoS Attack (dslreports.com)
"It's being reported by users from the DSLReports forum that the Puma 6 Intel cable modem variants are highly susceptible to a very low-bandwidth denial-of-service attack," writes Slashdot reader Idisagree. The Register reports:
Effectively, if there's someone you don't like, and they are one of thousands upon thousands of people using a Puma 6-powered home gateway, and you know their public IP address, you can kick them off the internet, we're told... According to one engineer...the flaw would be "trivial" to exploit in the wild, and would effectively render a targeted box useless for the duration of the attack... "It can be exploited remotely, and there is no way to mitigate the issue."
This is particularly frustrating for Puma 6 modem owners because the boxes are pitched as gigabit broadband gateways: the devices can be potentially choked and knocked out simply by receiving traffic that's a fraction of the bandwidth their owners are paying for... The Puma 6 chipset is used in a number of ISP-branded cable modems, including some Xfinity boxes supplied by Comcast in the US and the latest Virgin Media hubs in the UK.
The original submission also notes there's already a class action lawsuit over the performance of cable modems with Intel's Puma 6 chipset, and adds "It would appear the Atom chip was never going to live up to the task it was designed for."
This is particularly frustrating for Puma 6 modem owners because the boxes are pitched as gigabit broadband gateways: the devices can be potentially choked and knocked out simply by receiving traffic that's a fraction of the bandwidth their owners are paying for... The Puma 6 chipset is used in a number of ISP-branded cable modems, including some Xfinity boxes supplied by Comcast in the US and the latest Virgin Media hubs in the UK.
The original submission also notes there's already a class action lawsuit over the performance of cable modems with Intel's Puma 6 chipset, and adds "It would appear the Atom chip was never going to live up to the task it was designed for."
A class action lawsuit that is suing the developer for making a device that is vulnerable to the criminal actions of a third party? Does that mean we can get a class action lawsuit going for all bicycle manufacturers over the number of their bikes that are stolen? How about door manufacturers for all the people that break into houses?
Good luck with that.
Given that my Atom server has no problem saturating both gigabit network ports at the same time somehow I doubt the problem is the performance of the Atom chip referenced as being beefed up in the summary and more due to a crappy implementation of Puma 6 itself.
Does PPPoE bridge mode work as a workaround to this problem? or does the modem still play up?
not only insecure and backdoored by default, they're also very easy to knock out. Yet one more reason to stick to European and Asian products in this segment.
the devices can be potentially choked and knocked out simply by receiving traffic that's a fraction of the bandwidth
Fraction is an understatement, More like a fraction of a percent. The device is pretty much useless after 3Mbps.
I take it this stupid article refers to NAT routers, and not cable modems at all.
Anyone with the slightest bit of savvy runs a straight cable modem connected to a completely separate router. And, having suffered with various commodity routers such as Netgear, they all suck donkey balls. Do what I did. Break down and get a real Sonicwall TZ-170 (used/surplus of course).
so that is to be expected.
Makes as much sense as the last sentence in the summary. The Atom (named was changed to protect the innocent) is plenty of pussy for a cable modem/router/Wi-Fi AP.
Got scared there for a second then I remembered we can't get gigabit here.
Minimum threshold fixed. Thanks!
There is apparently a packet spray pattern that causes the CableModem (CM) portion of the Puma 6 to reboot. (likely segfault) The CM on a puma 6 is run by an ARM Cpu (not the x86 atom), the problem is with broken hardware optimization -- specifically the overflow handling on a fairly small table (2032 entry) likely built of CAM (content addressable memory) intended to accelerate external/internal mappings. That table has entries inserted when any packet arrives with a new address. Spew enough packets from enough different addresses and the table overflows -- that overflow requires (slow) processing to handle.
Disabling the accelerator caps bandwidth to ~60Mbps, and the DoS attack is mitigated.
But the fact that there is a pattern of (external) packets that *crashes* the CM indicates a potential vulnerability in the CM firmware that would allow a complete takeover of the CM OS.
That would be a global disaster.
One proposed mitigation is to use software mapping for packets from external sources and only add mappings to that small table for packets from the LAN side (not the WAN). This would probably have minimal impact for most -- capping speeds to 60Mbps on connections until a packet originating from the LAN side of things has gone through the device.
But a hostile (and clever enough) hacker may still be able to trick the device into crashing and exposing it to takeover if they can run software on both sides of the device (LAN and WAN) attacking it from both simultaneously.
The Puma 6 is a bit of a debacle -- it may very well have to be recalled.
Ian Ameline
Nonetheless, why's that built into the hardware? Given that NAT implementations in IPv4 are NOT standardized, so if something uses a different NATing mechanism, all that silicon is wasted.
Anyway, all the more reason to move to IPv6