Operations
10/2/2014
01:05 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Shellshock Attacks Spotted Against NAS Devices

First in-the-wild exploits found targeting QNAP network-attached storage devices.

Just a week after news of the Shellshock Bash bug went wide open, researchers believe the onslaught against the Internet of Things (IoT) has already begun. The malicious actors are starting with attacks targeting network-attached storage (NAS) devices, say researchers with FireEye, who believe these are the first in-the-wild attacks against embedded devices using the Bash remote code injection vulnerability.

According to FireEye researchers James Bennett and Josh Gomez, the attack has homed in on NAS devices made by QNAP, which is among the top manufacturers of low-cost NAS devices for consumer, SMB, and enterprise customers. These devices, along with QNAP video surveillance and network media player devices, all primarily run embedded Linux and are vulnerable to Shellshock without a patch. The way that the Bash vulnerability presents itself in these devices grants root privileges to attackers, and QNAP has warned users to completely disconnect systems from the Internet until they can patch the bug.

"We have evidence that attackers are actively exploiting the time-to-patch window and targeting embedded devices, specifically those made by QNAP, in order to append their SSH key to the authorized_keys file and install an ELF backdoor," the researchers wrote.

These attacks have so far been targeting QNAP NAS devices on networks associated with universities and research institutions in Japan and Korea, as well as an isolated case in the US. The attack attempts to instruct the target NAS to download a script that affects the device's startup environment to allow for future malicious updates, loads the malicious SSH key to allow for future password bypass, and then further cements itself with an ELF executable that gives the attacker shell access to the device and can be invoked in three different ways. FireEye warns that even if unpatched QNAP NAS devices are taken off the Internet, they could still be vulnerable to lateral attacks from inside a network.

Considering that NAS systems are used by consumers and organizations to store large amounts of data and to house databases, it is no wonder they're attracting Shellshock-armed attackers like flies to honey.

"This makes an NAS an attractive target for attackers given the broad types of data they handle," they said. "In this case, the attackers can gain full access the NAS contents as well as execute other commands."

According to  Jacob Holcomb, a researcher preparing to present at Black Hat Europe on NAS security, about half of NAS devices he's investigated can be taken over without authentication. A security analyst for Independent Security Evaluators, Holcomb recently uncovered 30 zero-day vulnerabilities in a dozen major NAS vendor products and roll them up into a proof-of-concept, self-replicating NAS worm. Holcomb believes that NAS devices can present a meaningful weakness for a number of types of attacks, including as a foothold for attackers to sprinkle infected files that could be used to send the attack to other devices on the network and as a control center for man-in-the-middle attacks against routers and network clients.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/2/2014 | 1:39:14 PM
Beyond QNAP?
NAS is a sizeable market with some well known players.  hope they are working fast and furious to close that time-to-patch window real soon.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.