A Pain in the NAS: Exploiting Cloud Connectivity to PWN Your NAS
summary
Chain of vulnerabilities lets an attacker impersonate Synology and Western Digital NAS devices by harvesting device GUIDs from TLS certificates and CT logs, then opening cloud tunnels to receive users’ session tokens. Tools and techniques include binwalk to unpack firmware, Censys and passive DNS to harvest 1.5M and ~10k identifiers, MITM (Wireshark/tcpdump) and reverse‑engineering a Go cloud binary, then creating mount points to /tmp and exploiting a reboot binary RCE to get shells; Pwn2Own exploits worked, earning ~$40k per device and forcing vendor patches.
AI-written summary · about
chapters (10)
- 0:00NAS cloud vulnerabilities
- 3:32Western Digital PR4100 firmware
- 7:05NAS cloud connectivity
- 13:52Leaking NAS GUIDs
- 16:43Authentication bypass via GUID
- 18:08Cloud tunnel analysis
- 22:44Chaining vulnerabilities for remote code execution
- 27:45Exploit chain demo
- 29:53Synology Quick Connect
- 37:21Summary and impact
related talks
47mFrom WAN to NAS: A Pwn2Own Journey Through the SOHO Attack Surface
56mNetwork Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells
52mNetwork Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
45mOutside the box: pwning IoT devices through their applications
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
50mThe Anatomy of Cloud Attacks
39mReal-World Detection Evasion Techniques in the Cloud