Some thoughts on how a hacker might defeat this; * Broadcast signals at the PFP enabled devices to cause false alarms, in order to convince the operators that

Some thoughts on how a hacker might defeat this; * Broadcast signals at the PFP enabled devices to cause false alarms, in order to convince the operators that the devices are unreliable. * Hack the system at a time where the administrators are performing an "unusual" operation (such as installing a firmware update). * Write your exploits such that they establish a minimal beachhead in the hacked daemon faster than would cause alarm (the article said it could detect malware in "milliseconds" -- you can do a lot in a millisecond), and then proceed very, very slowly. The PFP would still detect your malicious activity, but you would keep the signal/noise low enough that an alarm wouldn't be raised. * In some circumstances it may be possible to achieve exploitation while restricting yourself to "usual" activity. Turning a switch into a hub would raise alarms; enabling a disabled ethernet port probably wouldn't. Similarly, using functionality which is already included on the device (such as functions in libc) would probably go unnoticed. This is, of course, pure speculation.