Vulnerabilities / Threats

9/15/2014
02:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Worm Illuminates Potential NAS Nightmare

A researcher at Black Hat Europe hopes to demonstrate a homegrown, self-replicating worm to illustrate major threats to popular network-attached storage systems.

A researcher who so far has discovered 30 zero-day vulnerabilities in a dozen major network-attached storage (NAS) vendor products is creating a computer worm to demonstrate just how easy it would be for cyber criminals and other hackers to exploit flaws he found in these devices.

Jacob Holcomb, a security analyst at Independent Security Evaluators, has rolled multiple exploits for vulnerabilities he's already reported to NAS vendors into a proof-of-concept, self-replicating worm. The worm scans for vulnerable services running on NAS systems -- mostly web servers -- and identifies the type of NAS device and whether it harbors the bugs. If so, the worm launches the corresponding exploit to take control of the device. Then, like any good worm, it spreads to other NAS systems.

"I wanted to actually develop a POC myself and present it so people can understand the ramifications as my findings are being demonstrated and publicly disclosed, versus six months later when adversarial attackers are trying to exploit it for profit," Holcomb says.

He plans to unleash the worm in a self-contained network with no Internet access, so there's no chance of it inadvertently escaping and spreading. He hopes to demonstrate the NAS worm live next month at Black Hat Europe in Amsterdam, but he is currently running the plan by attorneys to determine if he can present the demo without any legal fallout.

Meanwhile, the NAS vendors whose products contain major security holes are a who's who of the storage market: Seagate, D-Link, Lenovo, Buffalo, QNAP, Western Digital, Netgear, ZyXEL, Asustor, TRENDnet, HP, and Synology. The vulnerabilities Holcomb has found over the past few months range from simple information disclosure about the device to command or code execution vulnerabilities that would allow an attacker to take control of the NAS device.

"As my research started, I came to realize fast that these devices were more vulnerable than Soho routers. That was rather shocking, actually, because I had published 56 CVEs for [bugs] in routers," says Holcomb, who previously had discovered the major flaws in Soho routers. "I'm confident that by the time I wrap up my NAS research, it will have exceeded the number of vulnerabilities I published in routers last year."

Holcomb, who presented the first stage of his NAS research in August at Black Hat USA, says he decided to drill down on NAS security because these systems are so widely deployed in home and corporate networks. "Pretty much everything we do relies on some form of backend storage for access."

Each of the storage devices he investigated is vulnerable to a command or code execution attack, which would allow a hacker to have his way with the devices. "Currently, at least 50% of the devices can be taken over without authentication," meaning that an attacker can execute code on them without even having to authenticate to the device. Holcomb will reveal details on this second phase of his NAS research at Black Hat Europe.

An attacker with control of a NAS could then wage a man-in-the-middle attack against routers and network clients to sit in the line of all the targeted organization's network communications, he says.

That has implications for the entire public Internet infrastructure. If an attacker were to wrest control of millions of NAS, routers, and other Internet of Things things, it could cause major network outages. "An adversarial attacker could cause substantial network outages by attacking Internet service providers or other core pieces of the Internet infrastructure."

NAS is a juicy target because it's not only easy to access, but also typically contains valuable information. "If an attacker compromises NAS, [he has] access to all of the data on the device, from something as silly as MP3 files to tax returns" or other sensitive data, he says.

The devices also can be used as a springboard to other targets. "Pretty much anything could happen, with an attacker gaining access to your files. These systems are used for other computers to access files, so [an attacker] could Trojanize one of the files on a storage system, and when you access it, it infects your computer," Holcomb explains. "It could be used as a malware-spreading medium to attack other systems, too."

NAS systems already have begun getting attacked. Before his August presentation at Black Hat USA in Las Vegas, for example, some Synology NAS systems were hit with a ransomware attack, where the victims were informed they would have to pay up to get their stored files decrypted.

He plans to demonstrate new vulnerabilities he found in addition to the cross-site request forgery, buffer overflow, authentication bypass, information disclosure, backdoor, session management, and directory traversal flaws he detailed in August in some of the products.

NAS vendors so far have been lukewarm in their responses to his findings. "Only a handful of manufacturers have acknowledged my report," he says. And one vendor -- D-Link -- has yet to respond to his bug reports.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/17/2014 | 10:48:46 AM
Re: NAS, SAN or DAS
It always comes back to encryption, doesn't it? If the data stored in the NAS were locked down with encryption, it would be worthless to the data thief. But unfortunately, encryption just isn't standard procedure today in many cases. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/16/2014 | 6:36:48 PM
Re: sigh ..aka researchers are creating more harm than good
I partially agree but if there is vulnerability it would be exploited at one point, it would always be better knowing about it and taking preventive actions.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/16/2014 | 6:34:54 PM
Re: NAS vulns
I would agree at the sane time if storage and router is vulnerable that simply means whole network is vulnerable. We may need to check and consider in a wider perspective.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/16/2014 | 6:32:52 PM
NAS, SAN or DAS
If they found vulnerability in NAS one should assume the sabe security flows in SAN and DAS. No system is security-proof. Unless data is encrypted at rest I would consider the storage unsecure and start from them.
Kelly Jackson Higgins
0%
100%
Kelly Jackson Higgins,
User Rank: Strategist
9/16/2014 | 9:30:55 AM
NAS vulns
Holcomb has found that NAS devices are more vulnerable than Soho routers--that should be a wakeup call since he found some 56 vulns in routers and expects to find even more in NASes. Not to mention they hold potentially valuable info.

 
geektechTX
0%
100%
geektechTX,
User Rank: Guru
9/16/2014 | 6:29:46 AM
sigh ..aka researchers are creating more harm than good
like to know who is funding these research to create viruses to attack NAS ..i am wore out as geek and tech after 15 years of cleannig machines , fake AV's and all kinds of malware peoople choose to click or install without realizing it is virus ..i almost became researcher aka virus creator and progammer i had training when i was 16-18 but i said No to recuiter and start my 2 companies didnt come back to progamming until recently ..and been dealing with anonymous members nearly taking everything i had and fighting back to regain my footing now the member was harrarssing me is scared of me ..yet Bloomberg TV/West refused my offers to expose this anon i had deal with too much losses and too many close calls with dealth at hospitals ..i am stil trying to get my story out int the public but someone keeps trying to shut me up and make my ass poor again lucky i am in politics now i got plenty of lawyer friends that will want to hear my story help me put the group into default and crying hackers because they turned on the wrong geek was prepared for war ..AIM high like Air Force ..! 
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Get Serious about IoT Security
Derek Manky, Global Security Strategist, Fortinet,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.