DDoS vs. "PDoS"
1. DDoS (for reference)
A conventional distributed denial of service attack (DDos) is a class of denial of service (DoS) attacks in which a distributed system (botnet) consisting of nodes controlled via some application (Mirai, LizardStresser, gafgyt, etc.) is used to consume the resources of the target system or systems to the point of exhaustion. A good explanation of this is given on security.SE.
An explanation of how Mirai-controlled botnets accomplish denial of service can be found in an analysis by Incapsula:
Like most malware in this category, Mirai is built for two core purposes:
- Locate and compromise IoT devices to further grow the botnet.
- Launch DDoS attacks based on instructions received from a remote C&C.
To fulfill its recruitment function, Mirai performs wide-ranging scans of IP addresses. The purpose of these scans is to locate under-secured IoT devices that could be remotely accessed via easily guessable login credentials—usually factory default usernames and passwords (e.g., admin/admin).
Mirai uses a brute force technique for guessing passwords a.k.a. dictionary attacks...
Mirai’s attack function enables it to launch HTTP floods and various network (OSI layer 3-4) DDoS attacks. When attacking HTTP floods, Mirai bots hide behind the following default user-agents...
For network layer assaults, Mirai is capable of launching GRE IP and GRE ETH floods, as well as SYN and ACK floods, STOMP (Simple Text Oriented Message Protocol) floods, DNS floods and UDP flood attacks.
These types of botnets accomplish resource exhaustion resulting in denial of service by using controlled devices to generate such large volumes of network traffic directed towards the target system that the resources provided by that system become inaccessible for the duration of the attack. Once the attack ceases, the target system no longer has its resources consumed to the point of exhaustion and can again respond to legitimate incoming client requests.
2. "PDoS"
The BrickerBot campaign is fundamentally different: instead of integrating embedded systems into a botnet which is then used to orchestrate large-scale attacks on servers, the embedded systems themselves are the target.
From Radware's post on BrickerBot “BrickerBot” Results In Permanent Denial-of-Service:
Imagine a fast moving bot attack designed to render the victim’s hardware from functioning. Called Permanent Denial-of-Service (PDoS), this form of cyber-attack is becoming increasingly popular in 2017 as more incidents involving this hardware-damaging assault occur.
Also known loosely as “phlashing” in some circles, PDoS is an attack that damages a system so badly that it requires replacement or reinstallation of hardware. By exploiting security flaws or misconfigurations, PDoS can destroy the firmware and/or basic functions of system. It is a contrast to its well-known cousin, the DDoS attack, which overloads systems with requests meant to saturate resources through unintended usage.
The embedded systems targeted for permanent incapacitation do not have some application downloaded onto them for purposes of remote control and are never part of a botnet (emphasis mine):
Compromising a Device
The Bricker Bot PDoS attack used Telnet brute force - the same exploit vector used by Mirai - to breach a victim’s devices. Bricker does not try to download a binary, so Radware does not have a complete list of credentials that were used for the brute force attempt, but were able to record that the first attempted username/password pair was consistently 'root'/'vizxv.’
Corrupting a Device
Upon successful access to the device, the PDoS bot performed a series of Linux commands that would ultimately lead to corrupted storage, followed by commands to disrupt Internet connectivity, device performance, and the wiping of all files on the device.
A third difference is that this campaign involves a small number of attacker-controlled devices, instead of many thousands or millions:
Over a four-day period, Radware’s honeypot recorded 1,895 PDoS attempts performed from several locations around the world.
The PDoS attempts originated from a limited number of IP addresses spread around the world. All devices are exposing port 22 (SSH) and running an older version of the Dropbear SSH server. Most of the devices were identified by Shodan as Ubiquiti network devices; among them are Access Points and Bridges with beam directivity.
Summary
Given the number of ways that the BrickerBot "PDoS" campaign fundamentally differs from conventional "DDoS" campaigns like Mirai, using similar-sounding terminology is likely to result in confusion.
- DDoS attacks are typically conducted by a botmaster with control over a distributed network of devices in order to prevent clients from accessing server resources for the duration of the attack, whereas "BrickerBot" is a campaign to "brick" embedded systems
- Botnet clients are controlled via an application installed on the client by the attacker. In the BrickerBot campaign, commands are remotely executed via telnet without the use of a controlling application (e.g. malware)
- DDoS attacks employ a large number (thousands, millions) of controlled devices, whereas the BrickerBot campaign uses a comparatively small number of systems to orchestrate so-called "PDoS" attacks
- the BrickerBot campaign targets embedded systems for incapacitation, whereas Mirai and the like target embedded systems in order to integrate them into a botnet
