Operations

10/2/2014
01:05 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Shellshock Attacks Spotted Against NAS Devices

First in-the-wild exploits found targeting QNAP network-attached storage devices.

Just a week after news of the Shellshock Bash bug went wide open, researchers believe the onslaught against the Internet of Things (IoT) has already begun. The malicious actors are starting with attacks targeting network-attached storage (NAS) devices, say researchers with FireEye, who believe these are the first in-the-wild attacks against embedded devices using the Bash remote code injection vulnerability.

According to FireEye researchers James Bennett and Josh Gomez, the attack has homed in on NAS devices made by QNAP, which is among the top manufacturers of low-cost NAS devices for consumer, SMB, and enterprise customers. These devices, along with QNAP video surveillance and network media player devices, all primarily run embedded Linux and are vulnerable to Shellshock without a patch. The way that the Bash vulnerability presents itself in these devices grants root privileges to attackers, and QNAP has warned users to completely disconnect systems from the Internet until they can patch the bug.

"We have evidence that attackers are actively exploiting the time-to-patch window and targeting embedded devices, specifically those made by QNAP, in order to append their SSH key to the authorized_keys file and install an ELF backdoor," the researchers wrote.

These attacks have so far been targeting QNAP NAS devices on networks associated with universities and research institutions in Japan and Korea, as well as an isolated case in the US. The attack attempts to instruct the target NAS to download a script that affects the device's startup environment to allow for future malicious updates, loads the malicious SSH key to allow for future password bypass, and then further cements itself with an ELF executable that gives the attacker shell access to the device and can be invoked in three different ways. FireEye warns that even if unpatched QNAP NAS devices are taken off the Internet, they could still be vulnerable to lateral attacks from inside a network.

Considering that NAS systems are used by consumers and organizations to store large amounts of data and to house databases, it is no wonder they're attracting Shellshock-armed attackers like flies to honey.

"This makes an NAS an attractive target for attackers given the broad types of data they handle," they said. "In this case, the attackers can gain full access the NAS contents as well as execute other commands."

According to  Jacob Holcomb, a researcher preparing to present at Black Hat Europe on NAS security, about half of NAS devices he's investigated can be taken over without authentication. A security analyst for Independent Security Evaluators, Holcomb recently uncovered 30 zero-day vulnerabilities in a dozen major NAS vendor products and roll them up into a proof-of-concept, self-replicating NAS worm. Holcomb believes that NAS devices can present a meaningful weakness for a number of types of attacks, including as a foothold for attackers to sprinkle infected files that could be used to send the attack to other devices on the network and as a control center for man-in-the-middle attacks against routers and network clients.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/2/2014 | 1:39:14 PM
Beyond QNAP?
NAS is a sizeable market with some well known players.  hope they are working fast and furious to close that time-to-patch window real soon.
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The State of IT and Cybersecurity
The State of IT and Cybersecurity
IT and security are often viewed as different disciplines - and different departments. Find out what our survey data revealed, read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-7682
PUBLISHED: 2018-06-22
Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains.
CVE-2018-12689
PUBLISHED: 2018-06-22
phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login panel.
CVE-2018-12538
PUBLISHED: 2018-06-22
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage...
CVE-2018-12684
PUBLISHED: 2018-06-22
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
CVE-2018-12687
PUBLISHED: 2018-06-22
tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.