[ISN] TV-based botnets? DoS attacks on your fridge? More plausible than you think

http://arstechnica.com/business/news/2012/04/tv-based-botnets-ddos-attacks-on-your-fridge-more-plausible-than-you-think.ars

By Dan Goodin
ars technica
April 22, 2012

It's still premature to say you need firewall or antivirus protection 
for your television set, but a duo of recently diagnosed firmware 
vulnerabilities in widely used TV models made by two leading 
manufacturers suggests the notion isn't as far-fetched as many may 
think.

The most recent bug, found in a wide range of high-definition TVs from 
Samsung, was disclosed on Thursday by Luigi Auriemma, an Italy-based 
researcher who regularly finds security flaws in Microsoft Windows, 
video games, and even the industrial-strength systems used to control 
dams, gas refineries, and other critical infrastructure. While poking 
around a Samsung D6000 model belonging to his brother, he inadvertently 
discovered a way to remotely send the TV into an endless restart mode 
that persists even after unplugging the device and turning it back on.

"It wasn't even planned," Auriemma told Ars, referring to the most 
damaging of his two attacks, which rendered the device useless for three 
days, until he finally found a way to restore it to normal operation. "I 
wanted only to show a message on the TV when my brother was watching it. 
He selected the 'deny' choice and boom."

The TV was connected by ethernet cable to a home network, so Auriemma 
thought it would be funny to use a computer connected to the same 
network to send it a message that contained a series of custom headers. 
Without warning, the TV spiraled into an endless loop of restarts. For 
about five seconds, the device would appear to work correctly, but then 
would stop responding to commands entered by remote control or through 
the panel. A few seconds later, the TV would restart and repeat the 
process. Unplugging the power cord or ethernet cable did nothing. 
Auriemma had just stumbled upon a crippling denial-of-service attack.

Auriemma said he sees no reason the attack couldn't be carried out over 
the Internet if the TV had a public IP address and used no filters.

[...]


_______________________________________________
LayerOne Security Conference
May 26-27, Clarion Hotel, Anaheim, CA
http://www.layerone.org