Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

02:45 PM
Connect Directly

Worm Illuminates Potential NAS Nightmare

A researcher at Black Hat Europe hopes to demonstrate a homegrown, self-replicating worm to illustrate major threats to popular network-attached storage systems.

A researcher who so far has discovered 30 zero-day vulnerabilities in a dozen major network-attached storage (NAS) vendor products is creating a computer worm to demonstrate just how easy it would be for cyber criminals and other hackers to exploit flaws he found in these devices.

Jacob Holcomb, a security analyst at Independent Security Evaluators, has rolled multiple exploits for vulnerabilities he's already reported to NAS vendors into a proof-of-concept, self-replicating worm. The worm scans for vulnerable services running on NAS systems -- mostly web servers -- and identifies the type of NAS device and whether it harbors the bugs. If so, the worm launches the corresponding exploit to take control of the device. Then, like any good worm, it spreads to other NAS systems.

"I wanted to actually develop a POC myself and present it so people can understand the ramifications as my findings are being demonstrated and publicly disclosed, versus six months later when adversarial attackers are trying to exploit it for profit," Holcomb says.

He plans to unleash the worm in a self-contained network with no Internet access, so there's no chance of it inadvertently escaping and spreading. He hopes to demonstrate the NAS worm live next month at Black Hat Europe in Amsterdam, but he is currently running the plan by attorneys to determine if he can present the demo without any legal fallout.

Meanwhile, the NAS vendors whose products contain major security holes are a who's who of the storage market: Seagate, D-Link, Lenovo, Buffalo, QNAP, Western Digital, Netgear, ZyXEL, Asustor, TRENDnet, HP, and Synology. The vulnerabilities Holcomb has found over the past few months range from simple information disclosure about the device to command or code execution vulnerabilities that would allow an attacker to take control of the NAS device.

"As my research started, I came to realize fast that these devices were more vulnerable than Soho routers. That was rather shocking, actually, because I had published 56 CVEs for [bugs] in routers," says Holcomb, who previously had discovered the major flaws in Soho routers. "I'm confident that by the time I wrap up my NAS research, it will have exceeded the number of vulnerabilities I published in routers last year."

Holcomb, who presented the first stage of his NAS research in August at Black Hat USA, says he decided to drill down on NAS security because these systems are so widely deployed in home and corporate networks. "Pretty much everything we do relies on some form of backend storage for access."

Each of the storage devices he investigated is vulnerable to a command or code execution attack, which would allow a hacker to have his way with the devices. "Currently, at least 50% of the devices can be taken over without authentication," meaning that an attacker can execute code on them without even having to authenticate to the device. Holcomb will reveal details on this second phase of his NAS research at Black Hat Europe.

An attacker with control of a NAS could then wage a man-in-the-middle attack against routers and network clients to sit in the line of all the targeted organization's network communications, he says.

That has implications for the entire public Internet infrastructure. If an attacker were to wrest control of millions of NAS, routers, and other Internet of Things things, it could cause major network outages. "An adversarial attacker could cause substantial network outages by attacking Internet service providers or other core pieces of the Internet infrastructure."

NAS is a juicy target because it's not only easy to access, but also typically contains valuable information. "If an attacker compromises NAS, [he has] access to all of the data on the device, from something as silly as MP3 files to tax returns" or other sensitive data, he says.

The devices also can be used as a springboard to other targets. "Pretty much anything could happen, with an attacker gaining access to your files. These systems are used for other computers to access files, so [an attacker] could Trojanize one of the files on a storage system, and when you access it, it infects your computer," Holcomb explains. "It could be used as a malware-spreading medium to attack other systems, too."

NAS systems already have begun getting attacked. Before his August presentation at Black Hat USA in Las Vegas, for example, some Synology NAS systems were hit with a ransomware attack, where the victims were informed they would have to pay up to get their stored files decrypted.

He plans to demonstrate new vulnerabilities he found in addition to the cross-site request forgery, buffer overflow, authentication bypass, information disclosure, backdoor, session management, and directory traversal flaws he detailed in August in some of the products.

NAS vendors so far have been lukewarm in their responses to his findings. "Only a handful of manufacturers have acknowledged my report," he says. And one vendor -- D-Link -- has yet to respond to his bug reports.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/17/2014 | 10:48:46 AM
It always comes back to encryption, doesn't it? If the data stored in the NAS were locked down with encryption, it would be worthless to the data thief. But unfortunately, encryption just isn't standard procedure today in many cases. 
User Rank: Ninja
9/16/2014 | 6:36:48 PM
Re: sigh ..aka researchers are creating more harm than good
I partially agree but if there is vulnerability it would be exploited at one point, it would always be better knowing about it and taking preventive actions.
User Rank: Ninja
9/16/2014 | 6:34:54 PM
Re: NAS vulns
I would agree at the sane time if storage and router is vulnerable that simply means whole network is vulnerable. We may need to check and consider in a wider perspective.
User Rank: Ninja
9/16/2014 | 6:32:52 PM
If they found vulnerability in NAS one should assume the sabe security flows in SAN and DAS. No system is security-proof. Unless data is encrypted at rest I would consider the storage unsecure and start from them.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/16/2014 | 9:30:55 AM
NAS vulns
Holcomb has found that NAS devices are more vulnerable than Soho routers--that should be a wakeup call since he found some 56 vulns in routers and expects to find even more in NASes. Not to mention they hold potentially valuable info.

User Rank: Guru
9/16/2014 | 6:29:46 AM
sigh ..aka researchers are creating more harm than good
like to know who is funding these research to create viruses to attack NAS ..i am wore out as geek and tech after 15 years of cleannig machines , fake AV's and all kinds of malware peoople choose to click or install without realizing it is virus ..i almost became researcher aka virus creator and progammer i had training when i was 16-18 but i said No to recuiter and start my 2 companies didnt come back to progamming until recently ..and been dealing with anonymous members nearly taking everything i had and fighting back to regain my footing now the member was harrarssing me is scared of me ..yet Bloomberg TV/West refused my offers to expose this anon i had deal with too much losses and too many close calls with dealth at hospitals ..i am stil trying to get my story out int the public but someone keeps trying to shut me up and make my ass poor again lucky i am in politics now i got plenty of lawyer friends that will want to hear my story help me put the group into default and crying hackers because they turned on the wrong geek was prepared for war ..AIM high like Air Force ..! 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-21
Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page.
PUBLISHED: 2020-09-21
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
PUBLISHED: 2020-09-21
Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
PUBLISHED: 2020-09-21
Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
PUBLISHED: 2020-09-21
Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.