Operations

10/2/2014
01:05 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Shellshock Attacks Spotted Against NAS Devices

First in-the-wild exploits found targeting QNAP network-attached storage devices.

Just a week after news of the Shellshock Bash bug went wide open, researchers believe the onslaught against the Internet of Things (IoT) has already begun. The malicious actors are starting with attacks targeting network-attached storage (NAS) devices, say researchers with FireEye, who believe these are the first in-the-wild attacks against embedded devices using the Bash remote code injection vulnerability.

According to FireEye researchers James Bennett and Josh Gomez, the attack has homed in on NAS devices made by QNAP, which is among the top manufacturers of low-cost NAS devices for consumer, SMB, and enterprise customers. These devices, along with QNAP video surveillance and network media player devices, all primarily run embedded Linux and are vulnerable to Shellshock without a patch. The way that the Bash vulnerability presents itself in these devices grants root privileges to attackers, and QNAP has warned users to completely disconnect systems from the Internet until they can patch the bug.

"We have evidence that attackers are actively exploiting the time-to-patch window and targeting embedded devices, specifically those made by QNAP, in order to append their SSH key to the authorized_keys file and install an ELF backdoor," the researchers wrote.

These attacks have so far been targeting QNAP NAS devices on networks associated with universities and research institutions in Japan and Korea, as well as an isolated case in the US. The attack attempts to instruct the target NAS to download a script that affects the device's startup environment to allow for future malicious updates, loads the malicious SSH key to allow for future password bypass, and then further cements itself with an ELF executable that gives the attacker shell access to the device and can be invoked in three different ways. FireEye warns that even if unpatched QNAP NAS devices are taken off the Internet, they could still be vulnerable to lateral attacks from inside a network.

Considering that NAS systems are used by consumers and organizations to store large amounts of data and to house databases, it is no wonder they're attracting Shellshock-armed attackers like flies to honey.

"This makes an NAS an attractive target for attackers given the broad types of data they handle," they said. "In this case, the attackers can gain full access the NAS contents as well as execute other commands."

According to  Jacob Holcomb, a researcher preparing to present at Black Hat Europe on NAS security, about half of NAS devices he's investigated can be taken over without authentication. A security analyst for Independent Security Evaluators, Holcomb recently uncovered 30 zero-day vulnerabilities in a dozen major NAS vendor products and roll them up into a proof-of-concept, self-replicating NAS worm. Holcomb believes that NAS devices can present a meaningful weakness for a number of types of attacks, including as a foothold for attackers to sprinkle infected files that could be used to send the attack to other devices on the network and as a control center for man-in-the-middle attacks against routers and network clients.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/2/2014 | 1:39:14 PM
Beyond QNAP?
NAS is a sizeable market with some well known players.  hope they are working fast and furious to close that time-to-patch window real soon.
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: In Russia, application hangs YOU!
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...
CVE-2018-16515
PUBLISHED: 2018-09-18
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
CVE-2018-16794
PUBLISHED: 2018-09-18
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.