Worm Illuminates Potential NAS Nightmare

A researcher who so far has discovered 30 zero-day vulnerabilities in a dozen major network-attached storage (NAS) vendor products is creating a computer worm to demonstrate just how easy it would be for cyber criminals and other hackers to exploit flaws he found in these devices.

Jacob Holcomb, a security analyst at Independent Security Evaluators, has rolled multiple exploits for vulnerabilities he's already reported to NAS vendors into a proof-of-concept, self-replicating worm. The worm scans for vulnerable services running on NAS systems -- mostly web servers -- and identifies the type of NAS device and whether it harbors the bugs. If so, the worm launches the corresponding exploit to take control of the device. Then, like any good worm, it spreads to other NAS systems.

"I wanted to actually develop a POC myself and present it so people can understand the ramifications as my findings are being demonstrated and publicly disclosed, versus six months later when adversarial attackers are trying to exploit it for profit," Holcomb says.

He plans to unleash the worm in a self-contained network with no Internet access, so there's no chance of it inadvertently escaping and spreading. He hopes to demonstrate the NAS worm live next month at Black Hat Europe in Amsterdam, but he is currently running the plan by attorneys to determine if he can present the demo without any legal fallout.

Meanwhile, the NAS vendors whose products contain major security holes are a who's who of the storage market: Seagate, D-Link, Lenovo, Buffalo, QNAP, Western Digital, Netgear, ZyXEL, Asustor, TRENDnet, HP, and Synology. The vulnerabilities Holcomb has found over the past few months range from simple information disclosure about the device to command or code execution vulnerabilities that would allow an attacker to take control of the NAS device.

"As my research started, I came to realize fast that these devices were more vulnerable than Soho routers. That was rather shocking, actually, because I had published 56 CVEs for [bugs] in routers," says Holcomb, who previously had discovered the major flaws in Soho routers. "I'm confident that by the time I wrap up my NAS research, it will have exceeded the number of vulnerabilities I published in routers last year."

Holcomb, who presented the first stage of his NAS research in August at Black Hat USA, says he decided to drill down on NAS security because these systems are so widely deployed in home and corporate networks. "Pretty much everything we do relies on some form of backend storage for access."

Each of the storage devices he investigated is vulnerable to a command or code execution attack, which would allow a hacker to have his way with the devices. "Currently, at least 50% of the devices can be taken over without authentication," meaning that an attacker can execute code on them without even having to authenticate to the device. Holcomb will reveal details on this second phase of his NAS research at Black Hat Europe.

An attacker with control of a NAS could then wage a man-in-the-middle attack against routers and network clients to sit in the line of all the targeted organization's network communications, he says.

That has implications for the entire public Internet infrastructure. If an attacker were to wrest control of millions of NAS, routers, and other Internet of Things things, it could cause major network outages. "An adversarial attacker could cause substantial network outages by attacking Internet service providers or other core pieces of the Internet infrastructure."

NAS is a juicy target because it's not only easy to access, but also typically contains valuable information. "If an attacker compromises NAS, [he has] access to all of the data on the device, from something as silly as MP3 files to tax returns" or other sensitive data, he says.

The devices also can be used as a springboard to other targets. "Pretty much anything could happen, with an attacker gaining access to your files. These systems are used for other computers to access files, so [an attacker] could Trojanize one of the files on a storage system, and when you access it, it infects your computer," Holcomb explains. "It could be used as a malware-spreading medium to attack other systems, too."

NAS systems already have begun getting attacked. Before his August presentation at Black Hat USA in Las Vegas, for example, some Synology NAS systems were hit with a ransomware attack, where the victims were informed they would have to pay up to get their stored files decrypted.

He plans to demonstrate new vulnerabilities he found in addition to the cross-site request forgery, buffer overflow, authentication bypass, information disclosure, backdoor, session management, and directory traversal flaws he detailed in August in some of the products.

NAS vendors so far have been lukewarm in their responses to his findings. "Only a handful of manufacturers have acknowledged my report," he says. And one vendor -- D-Link -- has yet to respond to his bug reports.