4 ms·

While "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. Even if it is protected outside of

While "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. Even if it is protected outside of your local network many people have crappy IoT devices or even just laptops with malware on their network. In top of that this won't even really prevent this vulnerability as it can be triggered by a GET request. This means that if you are connected to the VPN any site you visit can trigger it. (If they can guess the hostname or IP)

Dalewyn 3y ago
>crappy IoT devices Those should all go on their own vlan, or for a more Joe Average(tm) approach the guest network. >laptops with malware on their network. At that point you've got bigger fish to fry than shitty firmware, all bets are off.
- kevincox 3y ago
  Why are all bets off if you have malware on my network. My devices are hardened with the expectation of being on hostile networks. My computers, phone and home server all assume that they are exposed to malicious actors. Of course defence in depth is also important, but there is no reason that all bets should be off if an attacker can access your device over the network.
  - Dalewyn 3y ago
    Do you consider yourself a malicious actor to yourself? Because that's what you're saying. I am assuming the hypothetical compromised laptop is your own, and thus assuming it contains credentials. What credentials? Everything. All your credentials are belong to us. At that point, the only way to defend against that is to have never trusted yourself. That's a ridiculous stance for any normal person; their home network is a trusted space. That's why I'm saying all bets are off, you have bigger fish to fry than caring about some shitass firmware written by some third rate bank clerk in Bangladesh in a plastic box made by the finest sweatshops in China.
    - kevincox 3y ago
      Why would you assume the compromised laptop is my own? What if I have roommates? Or a friend comes over for a LAN party? I want them on my real network for Steam game transfers and game traffic. Maybe I want them to pull mods off of my NAS.
      - Dalewyn 3y ago
        In that case, yes that network isn't a home network and should be untrusted as such. Personally were I in your situation, I would have individual computers for each network as needed for total and proper segregation of trust; a NAS for the home and a NAS for the public (eg: LAN party) network. I would not trust a single computer with all sorts of data to safely handle two wildly different levels of trust simultaneously like that. I consider the home network a trusted enclave. Thus, all bets are off if a compromised laptop is in the home network. I assumed the laptop was your own as a worst case scenario (Credentials! In plain arm's reach!). If an untrusted third party laptop breached or was invited into your home network, that's not immediately as bad but the bets are still off. Basically: I see worrying about shitass firmware when you haven't secured the network as pointless. The hypothetical situation presented was a compromised laptop in the network; forget the firmware, you need to deal with that laptop and then commence cleanup of the network first.
        dvdkon 3y ago
        We seem to have very different approaches to security. I'd instead say "forget about the network, you need to secure your servers". I fundamentally dislike "secure enclaves", since they amount to giving up at some point. You can instead meaningfully exercise "defence in depth" by trying to keep file servers secure against unauthenticated attackers, or even authenticated ones; by not running unneeded network services on your desktops; etc. Securing one layer perfectly might be tempting, but it's much more work than securing multiple layers "well enough". In other words, "shared WPA2 WiFi + an up-to-date TrueNAS system + multiple accounts for different users" will be much less work and more practical than any network-only solution you can suggest. A layered approach also means that you don't need to worry so much about someone else's screwups. A friend had malware on their laptop, but didn't have credentials for the NAS? Not much need to worry, maybe just change the WiFi password and you're probably fine. They had access to a limited account? Probably only the data on that account is compromised. Most times you won't even get to check logs to confirm or start some top-to-bottom "cleanup", since you'll never know this even happened.
  - fulafel 3y ago
    This is the only sane way. You are then able to reason about impact and reasonably investigate when you inevitably end up dealing with a incident. Relying on a "trusted internal network" went out of fashion a long time ago.
mtlynch 3y ago
>While "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. If we're talking about a company, I agree. For a home, I think VPN + firewall is sufficient security against insecure management software on network devices. >Even if it is protected outside of your local network many people have crappy IoT devices or even just laptops with malware on their network. If there's a malicious laptop within your network, what difference does it make if your NAS has a security vulnerability? If your laptop is compromised, it's game over anyway because the attacker can steal your cookies or install a keylogger. If it's a housemate's laptop that doesn't have access to the NAS, they can do ARP poisoning[0] and MitM your NAS to steal your credentials (unless you're also vigorous about managing your own TLS CA). >In top of that this won't even really prevent this vulnerability as it can be triggered by a GET request. This means that if you are connected to the VPN any site you visit can trigger it. (If they can guess the hostname or IP) Other websites can trigger the behavior, but they can't read any responses because of same origin policy, so they can't exploit anything.[1] Correction: I overlooked in the writeup that the GET request allows RCE. So, you're right is that malicious websites can exploit this despite SOP. Still, firewall + VPN reduces your risk by many orders of magnitude. Instead of the attacker trivially scanning for your device or looking it up on Shodan, they have to trick you into visiting a malicious site. [0] https://en.wikipedia.org/wiki/ARP_spoofing https://en.wikipedia.org/wiki/ARP_spoofing [1] https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...
- kevincox 3y ago
  > they can do ARP poisoning[0] and MitM your NAS to steal your credentials (unless you're also vigorous about managing your own TLS CA) All traffic to my NAS is secured, even over the local network. I don't trust the network and I don't think it should be game-over for my NAS because my housemate installs some malware. I use SSH with pinned keys and TLS (thanks Let's Encrypt). I think if any NAS appliance doesn't provide some basic security like this it is a failing of that vendor. Even a self-signed TLS cert to provide TOFU validation would go a long way. (And actually in many ways be more secure than a public CA issued certificate.)

Dalewyn 3y ago

>crappy IoT devices Those should all go on their own vlan, or for a more Joe Average(tm) approach the guest network. >laptops with malware on their network. At that point you've got bigger fish to fry than shitty firmware, all bets are off.

kevincox 3y ago
Why are all bets off if you have malware on my network. My devices are hardened with the expectation of being on hostile networks. My computers, phone and home server all assume that they are exposed to malicious actors. Of course defence in depth is also important, but there is no reason that all bets should be off if an attacker can access your device over the network.
- Dalewyn 3y ago
  Do you consider yourself a malicious actor to yourself? Because that's what you're saying. I am assuming the hypothetical compromised laptop is your own, and thus assuming it contains credentials. What credentials? Everything. All your credentials are belong to us. At that point, the only way to defend against that is to have never trusted yourself. That's a ridiculous stance for any normal person; their home network is a trusted space. That's why I'm saying all bets are off, you have bigger fish to fry than caring about some shitass firmware written by some third rate bank clerk in Bangladesh in a plastic box made by the finest sweatshops in China.
  - kevincox 3y ago
    Why would you assume the compromised laptop is my own? What if I have roommates? Or a friend comes over for a LAN party? I want them on my real network for Steam game transfers and game traffic. Maybe I want them to pull mods off of my NAS.
    - Dalewyn 3y ago
      In that case, yes that network isn't a home network and should be untrusted as such. Personally were I in your situation, I would have individual computers for each network as needed for total and proper segregation of trust; a NAS for the home and a NAS for the public (eg: LAN party) network. I would not trust a single computer with all sorts of data to safely handle two wildly different levels of trust simultaneously like that. I consider the home network a trusted enclave. Thus, all bets are off if a compromised laptop is in the home network. I assumed the laptop was your own as a worst case scenario (Credentials! In plain arm's reach!). If an untrusted third party laptop breached or was invited into your home network, that's not immediately as bad but the bets are still off. Basically: I see worrying about shitass firmware when you haven't secured the network as pointless. The hypothetical situation presented was a compromised laptop in the network; forget the firmware, you need to deal with that laptop and then commence cleanup of the network first.
      - dvdkon 3y ago
        We seem to have very different approaches to security. I'd instead say "forget about the network, you need to secure your servers". I fundamentally dislike "secure enclaves", since they amount to giving up at some point. You can instead meaningfully exercise "defence in depth" by trying to keep file servers secure against unauthenticated attackers, or even authenticated ones; by not running unneeded network services on your desktops; etc. Securing one layer perfectly might be tempting, but it's much more work than securing multiple layers "well enough". In other words, "shared WPA2 WiFi + an up-to-date TrueNAS system + multiple accounts for different users" will be much less work and more practical than any network-only solution you can suggest. A layered approach also means that you don't need to worry so much about someone else's screwups. A friend had malware on their laptop, but didn't have credentials for the NAS? Not much need to worry, maybe just change the WiFi password and you're probably fine. They had access to a limited account? Probably only the data on that account is compromised. Most times you won't even get to check logs to confirm or start some top-to-bottom "cleanup", since you'll never know this even happened.
- fulafel 3y ago
  This is the only sane way. You are then able to reason about impact and reasonably investigate when you inevitably end up dealing with a incident. Relying on a "trusted internal network" went out of fashion a long time ago.

mtlynch 3y ago

>While "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. If we're talking about a company, I agree. For a home, I think VPN + firewall is sufficient security against insecure management software on network devices. >Even if it is protected outside of your local network many people have crappy IoT devices or even just laptops with malware on their network. If there's a malicious laptop within your network, what difference does it make if your NAS has a security vulnerability? If your laptop is compromised, it's game over anyway because the attacker can steal your cookies or install a keylogger. If it's a housemate's laptop that doesn't have access to the NAS, they can do ARP poisoning[0] and MitM your NAS to steal your credentials (unless you're also vigorous about managing your own TLS CA). >In top of that this won't even really prevent this vulnerability as it can be triggered by a GET request. This means that if you are connected to the VPN any site you visit can trigger it. (If they can guess the hostname or IP) Other websites can trigger the behavior, but they can't read any responses because of same origin policy, so they can't exploit anything.[1] Correction: I overlooked in the writeup that the GET request allows RCE. So, you're right is that malicious websites can exploit this despite SOP. Still, firewall + VPN reduces your risk by many orders of magnitude. Instead of the attacker trivially scanning for your device or looking it up on Shodan, they have to trick you into visiting a malicious site. [0] https://en.wikipedia.org/wiki/ARP_spoofing https://en.wikipedia.org/wiki/ARP_spoofing [1] https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...

kevincox 3y ago
> they can do ARP poisoning[0] and MitM your NAS to steal your credentials (unless you're also vigorous about managing your own TLS CA) All traffic to my NAS is secured, even over the local network. I don't trust the network and I don't think it should be game-over for my NAS because my housemate installs some malware. I use SSH with pinned keys and TLS (thanks Let's Encrypt). I think if any NAS appliance doesn't provide some basic security like this it is a failing of that vendor. Even a self-signed TLS cert to provide TOFU validation would go a long way. (And actually in many ways be more secure than a public CA issued certificate.)