Network Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells
summary
Ten evaluated NAS models from vendors like Seagate, D‑Link, Netgear and Western Digital are 100% vulnerable to code execution or admin compromise, with at least half exploitable without authentication; attacks include command injection, auth/authorization bypass, backdoor accounts, weak session cookies seeded by time (≈2 bits entropy), and memory corruptions that yield root shells. A modular self-propagating worm demonstrates scanning TCP/80, fingerprinting targets (D‑Link DNS‑345, Trendnet, WD MyCloud), exploiting them, dropping a pseudo‑shell and replicating. Research yields about 22 CVEs so far.
AI-written summary · about
chapters (15)
- 0:00Start
- 5:08System Functionality
- 6:54Preliminary Results
- 7:55Testing Methodology
- 8:46Vulnerability Discovery
- 14:44Vulnerability Exploitation
- 16:10Command Injection Countermeasures
- 20:09Mass Exploitation
- 21:04Worm Operation
- 21:53D-LINK Exploit
- 22:54TRENDnet Exploit
- 23:53Western Digital Exploit
- 31:56Case Study - BUFFALO
- 38:59Vulnerable Code
- 45:07Remediation
related talks
52mNetwork Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells
39mA Pain in the NAS: Exploiting Cloud Connectivity to PWN Your NAS
47mFrom WAN to NAS: A Pwn2Own Journey Through the SOHO Attack Surface
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
40mAll Your LAN are Belong to Us. Managing the Real Threats to Remote Workers.
39mNight of the living vulnerabilities
45mOutside the box: pwning IoT devices through their applications
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions