Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

10/2/2014
01:05 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Shellshock Attacks Spotted Against NAS Devices

First in-the-wild exploits found targeting QNAP network-attached storage devices.

Just a week after news of the Shellshock Bash bug went wide open, researchers believe the onslaught against the Internet of Things (IoT) has already begun. The malicious actors are starting with attacks targeting network-attached storage (NAS) devices, say researchers with FireEye, who believe these are the first in-the-wild attacks against embedded devices using the Bash remote code injection vulnerability.

According to FireEye researchers James Bennett and Josh Gomez, the attack has homed in on NAS devices made by QNAP, which is among the top manufacturers of low-cost NAS devices for consumer, SMB, and enterprise customers. These devices, along with QNAP video surveillance and network media player devices, all primarily run embedded Linux and are vulnerable to Shellshock without a patch. The way that the Bash vulnerability presents itself in these devices grants root privileges to attackers, and QNAP has warned users to completely disconnect systems from the Internet until they can patch the bug.

"We have evidence that attackers are actively exploiting the time-to-patch window and targeting embedded devices, specifically those made by QNAP, in order to append their SSH key to the authorized_keys file and install an ELF backdoor," the researchers wrote.

These attacks have so far been targeting QNAP NAS devices on networks associated with universities and research institutions in Japan and Korea, as well as an isolated case in the US. The attack attempts to instruct the target NAS to download a script that affects the device's startup environment to allow for future malicious updates, loads the malicious SSH key to allow for future password bypass, and then further cements itself with an ELF executable that gives the attacker shell access to the device and can be invoked in three different ways. FireEye warns that even if unpatched QNAP NAS devices are taken off the Internet, they could still be vulnerable to lateral attacks from inside a network.

Considering that NAS systems are used by consumers and organizations to store large amounts of data and to house databases, it is no wonder they're attracting Shellshock-armed attackers like flies to honey.

"This makes an NAS an attractive target for attackers given the broad types of data they handle," they said. "In this case, the attackers can gain full access the NAS contents as well as execute other commands."

According to  Jacob Holcomb, a researcher preparing to present at Black Hat Europe on NAS security, about half of NAS devices he's investigated can be taken over without authentication. A security analyst for Independent Security Evaluators, Holcomb recently uncovered 30 zero-day vulnerabilities in a dozen major NAS vendor products and roll them up into a proof-of-concept, self-replicating NAS worm. Holcomb believes that NAS devices can present a meaningful weakness for a number of types of attacks, including as a foothold for attackers to sprinkle infected files that could be used to send the attack to other devices on the network and as a control center for man-in-the-middle attacks against routers and network clients.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/2/2014 | 1:39:14 PM
Beyond QNAP?
NAS is a sizeable market with some well known players.  hope they are working fast and furious to close that time-to-patch window real soon.
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24259
PUBLISHED: 2021-05-05
The “Elementor Addon Elements� WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24260
PUBLISHED: 2021-05-05
The “Livemesh Addons for Elementor� WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24261
PUBLISHED: 2021-05-05
The “HT Mega – Absolute Addons for Elementor Page Builder� WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by ...
CVE-2021-24262
PUBLISHED: 2021-05-05
The “WooLentor – WooCommerce Elementor Addons + Builder� WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-priv...
CVE-2021-24263
PUBLISHED: 2021-05-05
The “Elementor Addons – PowerPack Addons for Elementor� WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scriptin...