8 ms·
Command injection and backdoor account in D-Link NAS devices
- tmoertel 3y agoAsk HN: Are there any hardware manufacturers that can be relied upon not to have big security problems?
- hwbunny 3y agoD-Link always was an almost trash kinda company.
- wepple 3y agoAmazon, Apple, Google tend to ship hardware that at least doesn’t having gaping 1997 style vulnerabilities everywhere. Cisco have had some doozies but overall aren’t terrible. Everything else is probably bad.
- jwells89 3y agoI wish Apple hadn’t dropped out of the router business. The only good replacements all seem to be considerably more involved, e.g. a full Ubiquiti setup or one of the more mainstream routers with third party firmware. AirPorts were excellent for shoving into a corner and not having to think about aside from the odd firmware update every few years.
- rfoo 3y agoWhat kind of hardware? For home networking? Ubiquiti is okay. As bugs in these enterprise/SMB networking gear worth a little $$$ so there's at least people looking for low hanging fruits. The best option however, is to find a recent MediaTek-based (because they are currently the most upstream-friendly WiFi AP SoC vendor) home router with vulnerable firmware (for easier flash lol) and replace the firmware with OpenWRT. For NAS just build your own, or buy used rack-mount servers off eBay and leave them in basement.
- candiddevmike 3y agoUse generic hardware or build your own, and install an OS you can manage yourself
- mtlynch 3y agoThese problems all go away if you don't expose crappy management software directly to the Internet. Don't allow anonymous inbound traffic on your firewall to hit your NAS (or any other interface that you're not updating and monitoring rigorously). If you need remote access to your NAS, install a VPN (e.g., Tailscale, ZeroTier) on the NAS or a different host on your internal network, and then access it remotely over an SSH tunnel. I understand that the casual home user doesn't know how to install a VPN or do SSH tunneling, so they end up exposing their NAS through the firewall, and that's why these issues are widespread. But for people who are a bit more technically savvy, you can massively reduce your attack surface by denying any inbound connections through your home firewall.
- kevincox 3y agoWhile "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. Even if it is protected outside of your local network many people have crappy IoT devices or even just laptops with malware on their network. In top of that this won't even really prevent this vulnerability as it can be triggered by a GET request. This means that if you are connected to the VPN any site you visit can trigger it. (If they can guess the hostname or IP)
- Dalewyn 3y ago>crappy IoT devices Those should all go on their own vlan, or for a more Joe Average(tm) approach the guest network. >laptops with malware on their network. At that point you've got bigger fish to fry than shitty firmware, all bets are off.
- kevincox 3y agoWhy are all bets off if you have malware on my network. My devices are hardened with the expectation of being on hostile networks. My computers, phone and home server all assume that they are exposed to malicious actors. Of course defence in depth is also important, but there is no reason that all bets should be off if an attacker can access your device over the network.
- panja 3y agoUse your own hardware and something like Unraid
- tomaskafka 3y agoMikrotik seems to be pretty regularly updated, even old devices - assuming they're not NSA frontend :)
- deleted 3y ago[deleted]
- arp242 3y agoTo the best of my knowledge there has never been a remote exploit for a Commodore 64.
- basementcat 3y agoMorning standup at a state sponsored hacking organization. Bob: I hope everyone had a good weekend. I’d like to start out by giving some kudos to Fred and Jane for the D-Link NAS back door! A round of polite clapping. Bob: Let’s start with Igor, how's it going? Igor: Bah, my target is running web server on Commodore 64 so I spend all weekend to write 6502 remote exploit for Contiki OS. Unfortunately, I found out target keeps secrets on ZX81 but I don’t know Z80 assembly. Bob: Fortunately we’re a state sponsored hacking organization so we have considerable resources. Federico, do you think you could give Igor a hand? Federico: Certamente!
- aaron695 3y ago[dead]
- deleted 3y ago[deleted]
- jqpabc123 3y agoShort answer --- no. The key term here is *hardware manufacturers*. They have no financial incentive to worry too much about software. The solution to every problem is to buy new hardware. Software bugs are just added incentive.
- GEBBL 3y agoHow did this pass code review?
- mmsc 3y agoWhat code review?
- hwbunny 3y agoExactly.
- riedel 3y agoWalter Shao [0] says lgtm... (There is simply little awareness and not even minimum standards in the industry) [0] https://forum.qnap.com/viewtopic.php?f=45&t=160849&start=450#p788325 https://forum.qnap.com/viewtopic.php?f=45&t=160849&start=450...
- steve1977 3y agoouch…
- cqqxo4zV46cp 3y agoThis is completely usual for IoT/networking devices. It’s the longstanding reality. They just come at this stuff differently.
- codedokode 3y agoAs I understand, the problem is that authentication used users from /etc/passwd and allowed to log in as any user, even as system user like "messagebus" which has no password. It is annoying that linux software uses system database for authorization, for example, Postgres and Samba do this and there is always a risk that you have some system user you don't know about which can be used to access your system.
- cqqxo4zV46cp 3y agoYeah. It’s a pretty old-hat way of thinking. The ‘unified authentication database’ ship sailed long ago, for better or worse.
- candiddevmike 3y agoUnraveling this and dumping NSS would probably have a measurable increase in security and isolation. A backdoor xz thing in libnss would be catastrophic.
- duskwuff 3y agoYou're probably thinking of PAM (passwords and authentication), not NSS (hostname lookup). Both are direly in need of modernization, though.
- segfaultbuserr 3y ago"No password = locked account" is today's default policy on most systems, for a reason.
- jesprenj 3y agoNot really. To be really sure, set ! as a password in /etc/shadow. That's what most distributions do. PAM has another security measure, if user's shell is not in /etc/shells, it's also considered a locked account and will not allow login.
- segfaultbuserr 3y ago
- jcpham2 3y agoWhen my bosses want to know why a quote for a device like a NAS is thousands and thousands of dollars instead of hundreds of dollars I use examples like this. Running consumer gear, especially public facing internet consumer gear is just asking for trouble. TrueNAS/FreeNAS whatever it’s called these days - a real OS with real vendor and community support keeping the project alive and up to date is just necessary. Buying these consumer devices that are set and forget with limited or zero firmware updates is BAD. Not to mention the code quality and unknown closed source backdoors
- lyu07282 3y ago> TrueNAS/FreeNAS whatever it’s called these days - a real OS with real vendor and community support keeping the project alive and up to date is just necessary. and for routers there is OpenWRT. For example Turris is built on that and provides automatic firmware updates, that's a huge security benefit for those devices: https://www.turris.com/en/ https://www.turris.com/en/
- jcpham2 3y agoHuge OpenWRT fan I’d almost even be tempted to deploy an OpenWRT device somehow as a NAS over any prebuilt consumer device. It’s build it yourself (and get what you pay for) or buy junk and similarly roll the dice. It’s not a terrible difficult value proposition to explain but there’s always the person in the room that knows just enough to not know this is something you do not introduce on your corporate network; you leave it home tucked away behind a firewall
- yjftsjthsd-h 3y ago> I’d almost even be tempted to deploy an OpenWRT device somehow as a NAS over any prebuilt consumer device. No ZFS, but it appears to support mdadm and btrfs so that could work if you can get good hardware for it.
- cqqxo4zV46cp 3y agoHave I woken up in some universe where the word “backdoor” doesn’t mean what it used to? I am used to backdoor implying malicious intent on the part of the vendor / author, or something left by an attacker. I’m just not seeing that here. This just looks like utterly unsurprising incompetence on the part of a consumer networking / IoT gear manufacturer. Yes, I know what a literal ‘back door’ is, and yes, I know that “make it look like incompetence” could be a strategy. I’d partially blame people being all hot and bothered about xz, but I can see that these files were committed two weeks ago.
- rfoo 3y ago> This just looks like utterly unsurprising incompetence on the part of a consumer networking / IoT gear manufacturer. Then how about Xiongmai NVRs [1]? Can I say it's just an incompetently implemented debug feature left enabled in production? [1] https://habr.com/en/articles/486856/ https://habr.com/en/articles/486856/
- II2II 3y agoI also get the impression that the definition has shifted, though I don't recall malicious intent from the vendor/author being a part of it. Classical backdoors include things like service accounts that were intended for the vendor, which were genuinely intended for service. Granted, those passwords were intended to be changed. (Also, that's not really appropriate for consumer grade gear though, since consumers have not received that level of support in decades and were not connected to networks when that level of service actually existed.) Either way though, I do seem to recall intention being part of the definition. Ah well. It's just a new meaning to get used to!
- BobbyTables2 3y agoThey knowingly created a password less account because of their authentication system! If it isn’t a true backdoor, then it is utter stupidity and negligence! When it comes to security, why is EOL allowed by society? We don’t give 5 or 10 yr old cars a free pass to blow up or stop working without a manufacturer recall. Software is even easier to fix!
- NKosmatos 3y agoThe thing of interest is that although the DNS-320L, and the other D-Link NASes, is EOL (End Of Life), there are more than 90,000 devices still operating out there! The bad thing here is that many manufacturers, even big ones, tend to forget “old” products and drop support for them. Usually it’s a market/business decision, but this is what happens with closed systems :-( Quoting from https://www.dlink.com/uk/en/products/dns-320l-sharecenter-2-bay-cloud-storage-enclosure#support https://www.dlink.com/uk/en/products/dns-320l-sharecenter-2-... : >> This product was phased out on: 13/11/2017 >> This product's last date of support is on: 13/11/2019 Being an owner of 320L, I don’t expect D-Link to offer us an updated firmware any time soon.
- captn3m0 3y agoIs there a better way to track D-Link EOLs? Would be nice to have this up at the endoflife.date.
- pierrec 3y ago>I don’t expect D-Link to offer us an updated firmware any time soon Don't worry, some botnet will infect all of these and fix the vulnerability in order to prevent competing malware from gaining access. This fix will deploy within an impressively tight timeline.
- bchanudet 3y agoSometime ago I found an alternative "OS" for my DNS-320L called Alt-f [0]. Granted its UI is very old-school but it has worked flawlessly. There has been no release since 2022 but at least it's more recent than the last official firmware (and I assume is not impacted by the vulnerability). IIRC I didn't even had to format or move the data I had on it before installing. [0] https://sourceforge.net/projects/alt-f/ https://sourceforge.net/projects/alt-f/
- IYasha 3y agoYeah it's not even surprising - does ANYONE in their right mind go through all their gadgets/home appliances to check their EOL status?? The whole reason for buying a completely set up and ready to go device that you don't configure yourself is to "put it and forget it". And that is the part when manufacturers screw you. (I myself am running 10+yo hardware and pretty happy about it.)
- speedylight 3y agoI see IoT devices are still the weakest link in any network.
- TacticalCoder 3y ago> I see IoT devices are still the weakest link in any network. That's why IoT stood for, since the very beginning, for "Internet of shitty insecure Things" : )
- IYasha 3y agoOr just "Insecurity of Things" )
- fx1994 3y agoI bought used DNS-320L and first thing is to load it with ALT-F alternative firmware. Worked great but device was too slow for my needs.
- starky 3y agoI'd assume that every consumer NAS device is insecure these days. I had a Terramaster NAS and was hit with a ransomware attack because of the poor security of their OS through a feature I had turned off. It caused me to look into it more and realized that all of the consumer NAS devices have had similar security issues. You are far better off getting cheap hardware and running TrueNAS or Unraid on it as they actually get regular software updates and don't have a history of major security issues.
- 0x073 3y agoTerramaster is a cheap young Chinese nas brand. Never had issues with Synology.
- starky 3y agoAs I said, while that was the brand I had, brands like QNAP and Asustor have also had the exact same issues. These devices are all just examples of poorly supported hardware, where a solution where you control the hardware and software installed on it is far more likely to be supported going forward.
- syntaxing 3y agoQNAP is known to have garbage security though. I personally have a Synology NAS with no internet access (blocked using my firewall)
- ajross 3y ago> You are far better off getting cheap hardware and running TrueNAS or Unraid on it as they actually get regular software updates and don't have a history of major security issues. Unpopular opinion: really you'd be "far better off" using Dropbox or Drive or whatever. By demanding to store your junk yourself you've already walked away from the clearly most robust solution. Obviously this will engender the standard HN freakout about privacy and Big Tech and whatever, and I won't engage. But at the narrow level of robustness and security, the cloud experts are going to do this objectively better than anything under your personal control, probably by more than an order of magnitude.
- eigenvalue 3y agoI’m surprised that there aren’t projects that aggregate a bunch of these known exploits together with these security search engines to find vulnerable devices and use them to create a TOR-like network of proxy server nodes. Presumably most of these vulnerable devices are running in homes of consumers with residential internet, making the traffic hard to identify as being from a VPN service. Not that I’m suggesting anyone actually do this since it would be highly illegal…
- tadfisher 3y agoWhy do that for free? Folks are perfectly happy to pay to be part of NordVPN's proxy network.
- smashed 3y agoI've seen compromised iot devices used to run proxy servers. They are mostly resold on black market as residential IPs for web scrapping and such. Since there is a black market for it they mostly get resold, instead of put to use on the free TOR network I guess. Residential ISPs usually monitor the blacklisting of their IP addresses and will contact/suspend the customer once the IPs get listed on public black lists.
- galangalalgol 3y agoHow unlikely is it that some major iot device manufacturers outsource the firmware to someone who puts botnets in to start with? Who writes fridge firmware? Does ge or Samsung do that in house? Ovens? Definitely some liability there, but I'm not sure which way that drives it, out or in.
- srgseg 3y agoThis is why I always use an encrypted file system, where the encryption keys are only known to the client (and not the NAS or other storage provider).
- prmoustache 3y agoI just use an old computer full of drives on which I ssh mount. I don't even care setting up samba these days. Even NAS distros/OSes are usually overkill for home and less than 5 different users. In a typical family context you usually only need one filesystem for each user + 1 shared fs with same RW for everyone.
- srgseg 3y agoExactly - just a Linux box, mounted with SSHFS. To be fair, I have spent some time over the years writing my own scripts for SMART alerts, but the end result is better monitoring and alerting than a NAS would provide.
- aborsy 3y agoSynology DSM and apps are closed source. It’s a Taiwanese company, and I wonder to what extent it can be trusted? Anyone has information on the security of DSM? Like, is it compliant for use in sensitive departments?
- bonzini 3y agoI honestly don't know, but the fact that they give updates for 10 years is impressive compared to everyone else. I bought one in fall 2012 and it got the DSM 7.0 update on 2022 or 2023; even though the UI is really really slow, it gives me a lot of confidence that they know what they're doing.
- wolverine876 3y agoRemember the recent stories about how FOSS is inherently less secure than proprietary systems - and because of the xz exploit, which was infinitely more complex? I'm trying to remember a FOSS system with a hardcoded, passwordless backdoor - it's a big world; there must be some. I almost expect a backdoor (though with a password!) in a consumer NAS. I don't knee-jerk reject proprietary solutions. And they might have an advantage if there was liability for this sort of thing. D-Link should be paying hefty fines for selling this obviously substandard, unprofessional crap to the public.