<story><title>The Pumpkin Eclipse</title><url>https://blog.lumen.com/the-pumpkin-eclipse/</url></story><parent_chain><item><author>not2b</author><text>It&amp;#x27;s a no-win situation. Sure, disabling firmware updates would have prevented this attack, but it would also prevent security fixes that keep the routers from being turned into a botnet.&lt;p&gt;But what I don&amp;#x27;t get in this case is why it was not possible to reset the device to its original state. It seems like a misdesign if it&amp;#x27;s possible to destroy all of the firmware, including the backup.</text></item><item><author>Scoundreller</author><text>&amp;gt; These reports led us to believe the problem was likely a firmware issue, as most other issues could be resolved through a factory reset.&lt;p&gt;My dream is to intercept the write-enable lines on the flash chips holding these firmwares so I can lock out updates. And schedule a daily reboot for any memory-resident-only crap.&lt;p&gt;That’s what we used to do on, ahem, satellite receivers, 20 years ago and maybe we all need to treat every device attached to the internet as having a similar susceptibility to “electronic counter-measures”.&lt;p&gt;Or at least monitor them for updates and light up a light when an update happens if it was my own equipment and I’d know if it should go off or not.</text></item></parent_chain><comment><author>kbenson</author><text>You could but a base level firmware on ROM, with a hardware trigger, and all that does on boot is listen and receive a signed firmware to write to the system. It needs a way to be triggered through hardware examining traffic and that also needs to require the seen command be signed. That recovery boot system needs to be as simple and minimal as possibly so you can have good assurance that there aren&amp;#x27;t problems with it, and should be written in the safest language you can get away with.  Guard that signing key with your life, and lock it away for a rainy day, only to be used if much of your fleet of devices is hosed entirely.  It should not be the same as a firmware signing key which needs to be pulled out and used sometimes.&lt;p&gt;I think that could work, to a degree.  There&amp;#x27;s always the risk that your recovery mechanism itself it exploited, so you need to make it as small and hardened a target as possible and reduce its complexity to the bare minimum. That doesn&amp;#x27;t solve the problem, which might be inherently unsolvable, but it may reduce that likelihood of it to levels where it&amp;#x27;s not a problem until long past the lifecycle of the devices.</text></comment>
<story><title>The Pumpkin Eclipse</title><url>https://blog.lumen.com/the-pumpkin-eclipse/</url></story><parent_chain><item><author>not2b</author><text>It&amp;#x27;s a no-win situation. Sure, disabling firmware updates would have prevented this attack, but it would also prevent security fixes that keep the routers from being turned into a botnet.&lt;p&gt;But what I don&amp;#x27;t get in this case is why it was not possible to reset the device to its original state. It seems like a misdesign if it&amp;#x27;s possible to destroy all of the firmware, including the backup.</text></item><item><author>Scoundreller</author><text>&amp;gt; These reports led us to believe the problem was likely a firmware issue, as most other issues could be resolved through a factory reset.&lt;p&gt;My dream is to intercept the write-enable lines on the flash chips holding these firmwares so I can lock out updates. And schedule a daily reboot for any memory-resident-only crap.&lt;p&gt;That’s what we used to do on, ahem, satellite receivers, 20 years ago and maybe we all need to treat every device attached to the internet as having a similar susceptibility to “electronic counter-measures”.&lt;p&gt;Or at least monitor them for updates and light up a light when an update happens if it was my own equipment and I’d know if it should go off or not.</text></item></parent_chain><comment><author>sounds</author><text>It&amp;#x27;s an interesting challenge because the device is nominally &amp;quot;under ISP control&amp;quot; but any device located in a customer&amp;#x27;s home is under the physical control of the customer. The mistrust between the ISP and the customer leads to &amp;quot;trusted&amp;quot; devices where the firmware, including the backup, can be overwritten by the ISP, but then cannot recover if it gets corrupted. And believe me, the corrupt firmware scenario happens a lot due to incompetence.&lt;p&gt;This is getting attention because it wasn&amp;#x27;t incompetence this time.&lt;p&gt;But how does blank, unprovisioned equipment discover a path to its provisioning server? Especially in light of the new &amp;quot;trusted&amp;quot; push, this is an arms race in a market segment such as routers where there isn&amp;#x27;t any money for high end solutions - only the cheapest option is even considered.&lt;p&gt;tl;dr: a social and economic problem, likely can&amp;#x27;t be fixed with a purely technical solution</text></comment>