Slashdot Mirror
Intel-Powered Broadband Modems Highly Vulnerable To DoS Attack (dslreports.com)
"It's being reported by users from the DSLReports forum that the Puma 6 Intel cable modem variants are highly susceptible to a very low-bandwidth denial-of-service attack," writes Slashdot reader Idisagree. The Register reports:
Effectively, if there's someone you don't like, and they are one of thousands upon thousands of people using a Puma 6-powered home gateway, and you know their public IP address, you can kick them off the internet, we're told... According to one engineer...the flaw would be "trivial" to exploit in the wild, and would effectively render a targeted box useless for the duration of the attack... "It can be exploited remotely, and there is no way to mitigate the issue."
This is particularly frustrating for Puma 6 modem owners because the boxes are pitched as gigabit broadband gateways: the devices can be potentially choked and knocked out simply by receiving traffic that's a fraction of the bandwidth their owners are paying for... The Puma 6 chipset is used in a number of ISP-branded cable modems, including some Xfinity boxes supplied by Comcast in the US and the latest Virgin Media hubs in the UK.
The original submission also notes there's already a class action lawsuit over the performance of cable modems with Intel's Puma 6 chipset, and adds "It would appear the Atom chip was never going to live up to the task it was designed for."
This is particularly frustrating for Puma 6 modem owners because the boxes are pitched as gigabit broadband gateways: the devices can be potentially choked and knocked out simply by receiving traffic that's a fraction of the bandwidth their owners are paying for... The Puma 6 chipset is used in a number of ISP-branded cable modems, including some Xfinity boxes supplied by Comcast in the US and the latest Virgin Media hubs in the UK.
The original submission also notes there's already a class action lawsuit over the performance of cable modems with Intel's Puma 6 chipset, and adds "It would appear the Atom chip was never going to live up to the task it was designed for."
Given that my Atom server has no problem saturating both gigabit network ports at the same time somehow I doubt the problem is the performance of the Atom chip referenced as being beefed up in the summary and more due to a crappy implementation of Puma 6 itself.
Since your analogy has nothing to do with the linked class action lawsuit I'm guessing you didn't read the article. It pertains to latency issues under typical use that prevent normal function. Third party criminal actions aren't relevant.
Inheritance is the sincerest form of nepotism.
The class action lawsuit is not because the chipset is easily subject to DoS attacks. The lawsuit is because the chipset is unsuitable for the purpose for which it was sold and marketed. Any modem based on the chipset may suffer latency of 200ms or more and lose roughly 6% of all the data that is supposed to pass through it.
The fact that the chipset is subject to a DoS attack that uses a (relatively) trivial amount of bandwidth is just another reason to avoid modems that use it.
I take it this stupid article refers to NAT routers, and not cable modems at all.
Anyone with the slightest bit of savvy runs a straight cable modem connected to a completely separate router. And, having suffered with various commodity routers such as Netgear, they all suck donkey balls. Do what I did. Break down and get a real Sonicwall TZ-170 (used/surplus of course).
Got scared there for a second then I remembered we can't get gigabit here.
Minimum threshold fixed. Thanks!
It's not the bandwidth, it's the packets per second.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Why not? It's supposed to be reasonable secure against such actions. Would you also consider it unreasonable to sue the makers of a "high security lock" that would unlock if you jiggled the door knob?
There is apparently a packet spray pattern that causes the CableModem (CM) portion of the Puma 6 to reboot. (likely segfault) The CM on a puma 6 is run by an ARM Cpu (not the x86 atom), the problem is with broken hardware optimization -- specifically the overflow handling on a fairly small table (2032 entry) likely built of CAM (content addressable memory) intended to accelerate external/internal mappings. That table has entries inserted when any packet arrives with a new address. Spew enough packets from enough different addresses and the table overflows -- that overflow requires (slow) processing to handle.
Disabling the accelerator caps bandwidth to ~60Mbps, and the DoS attack is mitigated.
But the fact that there is a pattern of (external) packets that *crashes* the CM indicates a potential vulnerability in the CM firmware that would allow a complete takeover of the CM OS.
That would be a global disaster.
One proposed mitigation is to use software mapping for packets from external sources and only add mappings to that small table for packets from the LAN side (not the WAN). This would probably have minimal impact for most -- capping speeds to 60Mbps on connections until a packet originating from the LAN side of things has gone through the device.
But a hostile (and clever enough) hacker may still be able to trick the device into crashing and exposing it to takeover if they can run software on both sides of the device (LAN and WAN) attacking it from both simultaneously.
The Puma 6 is a bit of a debacle -- it may very well have to be recalled.
Ian Ameline
The SPS is tied directly to the PPS, thus the PPS is at fault. If you bothered looking at the dozens of test screencaps in the thread, you'd know this.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Would you also consider it unreasonable to sue the makers of a "high security lock" that would unlock if you jiggled the door knob?
It works the other way around. There's a guy with a YouTube channel about lock picking who says the Big Name in "secure" padlocks has sued him over some of his videos showing how easy they are to defeat.
Courts are empirically rigged in favor of the corporate interests, against the People, so this isn't terribly surprising.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
That's a great example of why I think a judge should review any lawsuit before the defendant is even bothered with it. It should be shot down immediately.
Yes, again, if that packet for the same state is not received within a certain timeframe, that entry in the table gets locked up and doesn't clear.
That implies directly packets per second.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Nonetheless, why's that built into the hardware? Given that NAT implementations in IPv4 are NOT standardized, so if something uses a different NATing mechanism, all that silicon is wasted.
Anyway, all the more reason to move to IPv6
Yes. The thing is, the judge would be charged only with voiding lawsuits that could not win on their face. That is, if everything the plaintiff says is assumed to be true, would it win anything? If the answer is no, the suit goes away. That prevents crap like when someone claimed to be God and that David Copperfield was usurping his divine powers in performance of his tricks. The courts have no jurisdiction over divinity, so the suit goes away. Joe Blow wore a red shirt, so I want $1999! Wearing a red shirt is not a tort, so suit goes away.
OTOH, badco dumped rat poison in the river and my family got sick? Well, it may or may not be true but if shown in court it would result in damages awarded, so it may proceed.