Slashdot Mirror
Intel-Powered Broadband Modems Highly Vulnerable To DoS Attack (dslreports.com)
"It's being reported by users from the DSLReports forum that the Puma 6 Intel cable modem variants are highly susceptible to a very low-bandwidth denial-of-service attack," writes Slashdot reader Idisagree. The Register reports:
Effectively, if there's someone you don't like, and they are one of thousands upon thousands of people using a Puma 6-powered home gateway, and you know their public IP address, you can kick them off the internet, we're told... According to one engineer...the flaw would be "trivial" to exploit in the wild, and would effectively render a targeted box useless for the duration of the attack... "It can be exploited remotely, and there is no way to mitigate the issue."
This is particularly frustrating for Puma 6 modem owners because the boxes are pitched as gigabit broadband gateways: the devices can be potentially choked and knocked out simply by receiving traffic that's a fraction of the bandwidth their owners are paying for... The Puma 6 chipset is used in a number of ISP-branded cable modems, including some Xfinity boxes supplied by Comcast in the US and the latest Virgin Media hubs in the UK.
The original submission also notes there's already a class action lawsuit over the performance of cable modems with Intel's Puma 6 chipset, and adds "It would appear the Atom chip was never going to live up to the task it was designed for."
This is particularly frustrating for Puma 6 modem owners because the boxes are pitched as gigabit broadband gateways: the devices can be potentially choked and knocked out simply by receiving traffic that's a fraction of the bandwidth their owners are paying for... The Puma 6 chipset is used in a number of ISP-branded cable modems, including some Xfinity boxes supplied by Comcast in the US and the latest Virgin Media hubs in the UK.
The original submission also notes there's already a class action lawsuit over the performance of cable modems with Intel's Puma 6 chipset, and adds "It would appear the Atom chip was never going to live up to the task it was designed for."
It's not the Atom cores, it's the bolted on NAT accelerator with 2048 max entries + 30s timeout for UDP "connections" + firmware too stupid to fall back to software NAT when the hardware table is full.
So you just spoof 2048 UDP packets every 30s and they can't send a single packet? That IS trivial.
Cwm, fjord-bank glyphs vext quiz
Actually this is a pure cable modem issue. http://www.dslreports.com/tool... is a test that can be used to see if your modem is affected. https://www.dslreports.com/tes... lists some of the affected modems. The ARRIS SB6190 is one of the more popular modems on the list that is affected.
Intel has acknowledged the bug, caused by missing entries in the lookup table used by the NAT circuitry, but claims that the typical user would only experience it once every 27,000 years so they have no plans to fix it. However, the upcoming Puma 6.9999999975 chipset will contain a fix.
Got scared there for a second then I remembered we can't get gigabit here.
Minimum threshold fixed. Thanks!
Why not? It's supposed to be reasonable secure against such actions. Would you also consider it unreasonable to sue the makers of a "high security lock" that would unlock if you jiggled the door knob?
There is apparently a packet spray pattern that causes the CableModem (CM) portion of the Puma 6 to reboot. (likely segfault) The CM on a puma 6 is run by an ARM Cpu (not the x86 atom), the problem is with broken hardware optimization -- specifically the overflow handling on a fairly small table (2032 entry) likely built of CAM (content addressable memory) intended to accelerate external/internal mappings. That table has entries inserted when any packet arrives with a new address. Spew enough packets from enough different addresses and the table overflows -- that overflow requires (slow) processing to handle.
Disabling the accelerator caps bandwidth to ~60Mbps, and the DoS attack is mitigated.
But the fact that there is a pattern of (external) packets that *crashes* the CM indicates a potential vulnerability in the CM firmware that would allow a complete takeover of the CM OS.
That would be a global disaster.
One proposed mitigation is to use software mapping for packets from external sources and only add mappings to that small table for packets from the LAN side (not the WAN). This would probably have minimal impact for most -- capping speeds to 60Mbps on connections until a packet originating from the LAN side of things has gone through the device.
But a hostile (and clever enough) hacker may still be able to trick the device into crashing and exposing it to takeover if they can run software on both sides of the device (LAN and WAN) attacking it from both simultaneously.
The Puma 6 is a bit of a debacle -- it may very well have to be recalled.
Ian Ameline
I have access to a Puma6-based device and sure, the dual-core Atom is fast enough to do a lot of stuff, but the single ARM-core is excruciatingly slow. And guess what? All the cable-management stuff is relegated to the ARM-core, the web-UI runs on the ARM-core, nearly everything runs on it and the x86-cores, in the meantime, just sit idle -- they are only used for NAS-functionality, streaming DVB-C content and Google Music. It's ridiculous how stupid the whole thing is. The box is also ridiculously easy to cause to crash, it's really easy to break into, even without physical access to the device in the first place and so on.
Would you also consider it unreasonable to sue the makers of a "high security lock" that would unlock if you jiggled the door knob?
It works the other way around. There's a guy with a YouTube channel about lock picking who says the Big Name in "secure" padlocks has sued him over some of his videos showing how easy they are to defeat.
Courts are empirically rigged in favor of the corporate interests, against the People, so this isn't terribly surprising.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)