Network Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells
summary
Independent Security Evaluators report dozens of critical bugs across Seagate, D‑Link and Netgear NAS, with 100% of devices vulnerable in preliminary testing and at least 50% exploitable without authentication; 22 CVEs are assigned so far. Findings center on command injection, directory traversal, backdoors (a Seagate account with DES hashes), poor session entropy and missing function‑level checks. Demonstrations show Nmap and Netcat reconnaissance, Burp sequencer entropy analysis, a C exploit that crafts on‑device shell scripts and a netcat reverse shell to get a root shell.
AI-written summary · about
chapters (25)
- 0:00Start
- 0:49Speaker Information
- 1:07Is this really important?
- 1:58About ISE
- 2:55Topics
- 3:35Subject Background
- 4:39Key Players
- 4:58Products Evaluated
- 5:45System Functionality
- 7:36Exploit Research and Development (time2pwn)
- 8:33Preliminary Results
- 9:36Testing Methodology
- 11:26Vulnerability Discovery
- 13:58Types of Vulnerabilities Discovered
- 16:57Backdoor User-Seagate
- 17:50Poor Session Management - ASUSTOR
- 18:43Poor Session Management Cont.
- 20:48Vulnerability Exploitation
- 22:36Command Injection Countermeasures
- 25:01Cross-Site Request Forgery Countermeasures
- 28:12Missing Function Level Access Controls Countermeasures
- 30:25Buffer Overflow Countermeasures
- 33:25Case Study - D-LINK
- 39:23Case Study - NETGEAR
- 47:22Case Study - BUFFALO
related talks
56mNetwork Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells
39mA Pain in the NAS: Exploiting Cloud Connectivity to PWN Your NAS
47mFrom WAN to NAS: A Pwn2Own Journey Through the SOHO Attack Surface
39mNight of the living vulnerabilities
51mLocknote: Conclusions and Key Takeaways
44mNight of the living vulnerabilities
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
45mOutside the box: pwning IoT devices through their applications