Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

02:45 PM
Connect Directly

Worm Illuminates Potential NAS Nightmare

A researcher at Black Hat Europe hopes to demonstrate a homegrown, self-replicating worm to illustrate major threats to popular network-attached storage systems.

A researcher who so far has discovered 30 zero-day vulnerabilities in a dozen major network-attached storage (NAS) vendor products is creating a computer worm to demonstrate just how easy it would be for cyber criminals and other hackers to exploit flaws he found in these devices.

Jacob Holcomb, a security analyst at Independent Security Evaluators, has rolled multiple exploits for vulnerabilities he's already reported to NAS vendors into a proof-of-concept, self-replicating worm. The worm scans for vulnerable services running on NAS systems -- mostly web servers -- and identifies the type of NAS device and whether it harbors the bugs. If so, the worm launches the corresponding exploit to take control of the device. Then, like any good worm, it spreads to other NAS systems.

"I wanted to actually develop a POC myself and present it so people can understand the ramifications as my findings are being demonstrated and publicly disclosed, versus six months later when adversarial attackers are trying to exploit it for profit," Holcomb says.

He plans to unleash the worm in a self-contained network with no Internet access, so there's no chance of it inadvertently escaping and spreading. He hopes to demonstrate the NAS worm live next month at Black Hat Europe in Amsterdam, but he is currently running the plan by attorneys to determine if he can present the demo without any legal fallout.

Meanwhile, the NAS vendors whose products contain major security holes are a who's who of the storage market: Seagate, D-Link, Lenovo, Buffalo, QNAP, Western Digital, Netgear, ZyXEL, Asustor, TRENDnet, HP, and Synology. The vulnerabilities Holcomb has found over the past few months range from simple information disclosure about the device to command or code execution vulnerabilities that would allow an attacker to take control of the NAS device.

"As my research started, I came to realize fast that these devices were more vulnerable than Soho routers. That was rather shocking, actually, because I had published 56 CVEs for [bugs] in routers," says Holcomb, who previously had discovered the major flaws in Soho routers. "I'm confident that by the time I wrap up my NAS research, it will have exceeded the number of vulnerabilities I published in routers last year."

Holcomb, who presented the first stage of his NAS research in August at Black Hat USA, says he decided to drill down on NAS security because these systems are so widely deployed in home and corporate networks. "Pretty much everything we do relies on some form of backend storage for access."

Each of the storage devices he investigated is vulnerable to a command or code execution attack, which would allow a hacker to have his way with the devices. "Currently, at least 50% of the devices can be taken over without authentication," meaning that an attacker can execute code on them without even having to authenticate to the device. Holcomb will reveal details on this second phase of his NAS research at Black Hat Europe.

An attacker with control of a NAS could then wage a man-in-the-middle attack against routers and network clients to sit in the line of all the targeted organization's network communications, he says.

That has implications for the entire public Internet infrastructure. If an attacker were to wrest control of millions of NAS, routers, and other Internet of Things things, it could cause major network outages. "An adversarial attacker could cause substantial network outages by attacking Internet service providers or other core pieces of the Internet infrastructure."

NAS is a juicy target because it's not only easy to access, but also typically contains valuable information. "If an attacker compromises NAS, [he has] access to all of the data on the device, from something as silly as MP3 files to tax returns" or other sensitive data, he says.

The devices also can be used as a springboard to other targets. "Pretty much anything could happen, with an attacker gaining access to your files. These systems are used for other computers to access files, so [an attacker] could Trojanize one of the files on a storage system, and when you access it, it infects your computer," Holcomb explains. "It could be used as a malware-spreading medium to attack other systems, too."

NAS systems already have begun getting attacked. Before his August presentation at Black Hat USA in Las Vegas, for example, some Synology NAS systems were hit with a ransomware attack, where the victims were informed they would have to pay up to get their stored files decrypted.

He plans to demonstrate new vulnerabilities he found in addition to the cross-site request forgery, buffer overflow, authentication bypass, information disclosure, backdoor, session management, and directory traversal flaws he detailed in August in some of the products.

NAS vendors so far have been lukewarm in their responses to his findings. "Only a handful of manufacturers have acknowledged my report," he says. And one vendor -- D-Link -- has yet to respond to his bug reports.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/17/2014 | 10:48:46 AM
It always comes back to encryption, doesn't it? If the data stored in the NAS were locked down with encryption, it would be worthless to the data thief. But unfortunately, encryption just isn't standard procedure today in many cases. 
User Rank: Ninja
9/16/2014 | 6:36:48 PM
Re: sigh ..aka researchers are creating more harm than good
I partially agree but if there is vulnerability it would be exploited at one point, it would always be better knowing about it and taking preventive actions.
User Rank: Ninja
9/16/2014 | 6:34:54 PM
Re: NAS vulns
I would agree at the sane time if storage and router is vulnerable that simply means whole network is vulnerable. We may need to check and consider in a wider perspective.
User Rank: Ninja
9/16/2014 | 6:32:52 PM
If they found vulnerability in NAS one should assume the sabe security flows in SAN and DAS. No system is security-proof. Unless data is encrypted at rest I would consider the storage unsecure and start from them.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/16/2014 | 9:30:55 AM
NAS vulns
Holcomb has found that NAS devices are more vulnerable than Soho routers--that should be a wakeup call since he found some 56 vulns in routers and expects to find even more in NASes. Not to mention they hold potentially valuable info.

User Rank: Guru
9/16/2014 | 6:29:46 AM
sigh ..aka researchers are creating more harm than good
like to know who is funding these research to create viruses to attack NAS ..i am wore out as geek and tech after 15 years of cleannig machines , fake AV's and all kinds of malware peoople choose to click or install without realizing it is virus ..i almost became researcher aka virus creator and progammer i had training when i was 16-18 but i said No to recuiter and start my 2 companies didnt come back to progamming until recently ..and been dealing with anonymous members nearly taking everything i had and fighting back to regain my footing now the member was harrarssing me is scared of me ..yet Bloomberg TV/West refused my offers to expose this anon i had deal with too much losses and too many close calls with dealth at hospitals ..i am stil trying to get my story out int the public but someone keeps trying to shut me up and make my ass poor again lucky i am in politics now i got plenty of lawyer friends that will want to hear my story help me put the group into default and crying hackers because they turned on the wrong geek was prepared for war ..AIM high like Air Force ..! 
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-20
** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access ...
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.