此演講介紹一種新種類的攻擊：「永久性DOS --（Permanent Denial Of Service (PDOS)」，主要針對嵌入式系統之設備。我們將介紹一種號稱為「Phlash」之PD S攻擊手法，主要利用韌體之flashupdate機制，達成PDOS之目的。我們將針對各嵌入式系統之flashupdate機制與韌體本身的結構做深入的分析，並介紹一個通用的模糊暴力式探測平台（genericfuzzingframework）PhlashDance。PhlashDance能自動在各式各樣不同的嵌入式系統中找出PDOS漏洞.除了介紹這些技術細節以外，我們也將解釋，為何這種新型攻擊必須受到各廠商（IT，手機與行動裝置）之關心，以及避免此種攻擊之種種困難處.

This presentation intends to discuss a new class of attack termed Permanent Denial Of Service (PDOS) targeted against embedded devices. Specifically, a particular manifestation of PDOS will be discussed which targets the firmware update mechanisms of embedded devices, such abuses of flash update mechanisms to cause PDOS conditions have been named Phlash attacks (cuz every attack needs a ‘ph’ right!). Phlash attacks targeting both the flash update mechanisms of devices, and the structuring of the binary firmware’s themselves will be discussed in a generic way. The presentation will also discuss the development of a generic fuzzing framework called PhlashDance, which aims to assist in the automatic identification of PDOS vulnerabilities across an extensible range of embedded devices. Beyond the pure technicalities of how Phlash attacks may be mounted, the presentation will also discuss why such novel attack vectors will be of particular concern to technology vendors, and the difficulties being faced in responding to and mitigating such vulnerabilities.