I bought an ASRock C2750D4I motherboard for my NAS in October 2014. In March 2017, my board was struck by a firmware bug that involves the BMC flash storage being worn out too quickly because of a bug in the watchdog. This is a well-known issue.

Since my board died after more than two years, I was worried whether I could still get it RMA’ed. The shop where I bought the board stated I only had two years warranty.

Luckily, the folks at ASRock were very helpful. I discovered that (also) in The Netherlands you have three years warranty on the C2750D4I.

I received a replacement board from ASRock quickly. As of now, half a year later, the new board is still operating perfectly. I can only say that my RMA experience with ASRock has been positive.

Update 2022: my board died again, this time because of the C2000 bug. ASRock was very considerate in sending me a new board, this many years after I bought it.

The MITRE ATT&CK framework is a great tool for blue teams.

As an exercise, I tried mapping the Stuxnet attack onto the ATT&CK framework. As a source, I used the excellent Symantec Stuxnet paper.

CC-BY-SA.

• I tried cramming it all into one slide, sorry for that. Defense evasion is indeed that big.
• There are multiple ways to do the mapping. There could also be mistakes (caveat emptor). I welcome any bugfixes.
• The credential access row is empty, since from what I read it used the user’s credential token not their actual passwords. The exfiltration row is empty because the paper shows that this instance was primarily meant for infecting the SCADA systems. Of course, the malware was able (via its C&C connection) to have exfiltration modules, but these were not discussed.

PDF version: ATT&CK – Stuxnet.