研究人员在西部数据存储设备上发现硬编码后门

简介: Firmware updates released by Western Digital for its MyCloud family of devices address a series of security issues, including a hardcoded backdoor admin account.西部数据为自家MyCloud系列设备发布的固件更新爆出了一系列的安全问题,甚至包含了一个硬编码带有admin权限的后门账号。

Firmware updates released by Western Digital for its MyCloud family of devices address a series of security issues, including a hardcoded backdoor admin account.

西部数据为自家MyCloud系列设备发布的固件更新爆出了一系列的安全问题,甚至包含了一个硬编码带有admin权限的后门账号。

The vulnerabilities were found in WDMyCloud firmware prior to version 2.30.165 and are said to affect devices such as MyCloud, MyCloudMirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, and My Cloud DL4100.

WDMyCloud版本2.30.165之前的固件漏洞据说影响以下设备:

MyCloud, MyCloudMirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100 和 My Cloud DL4100。

Discovered by GulfTech security researcher James Bercegay, the security flaws could be exploited to achieve remote root code execution on the affected WD My Cloud personal cloud storage units (the device is currently the best-selling NAS (network attached storage) device on Amazon).

GulfTech安全研究员James Bercegay发现这些安全漏洞可以在西部数据My Cloud个人云存储设备(目前这个设备是亚马逊上最畅销的NAS存储产品)上被利用,以远程root权限执行指令。

One of the most important security issues the researcher found was an unrestricted file upload vulnerability created by the “misuse and misunderstanding of the PHP gethostbyaddr() function,” the researcher says.

其中一个被发现的最严重的漏洞是审核不严格的文件上传权限漏洞,是因为对PHP gethostbyaddr() 方法理解不当和滥用造成的。

不翻了,自己看吧,总归就是一句话,别买西数的产品了。

The vulnerable code in said file allows an attacker to define a remote auth server, which could be an attacker-controlled server. The result should fail if an invalid host is defined, but a series of bugs result in checks being skipped, eventually allowing an attacker to abuse the issue “to upload any file to the server that they want.”

While analyzing CGI binaries on the webserver, the security researcher discovered code where login functionality would specifically look for an admin user named “mydlinkBRionyg” and would accept the password “abc12345cba”.

The researcher then discovered that the backdoor could be turned into a root shell that would allow an attacker to execute any commands as root and gain control of the affected device. Damaging a vulnerable device would be extremely easy and would not require authentication.

“The triviality of exploiting this issues makes it very dangerous, and even wormable. Not only that, but users locked to a LAN are not safe either. An attacker could literally take over your WDMyCloud by just having you visit a website where an embedded iframe or img tag make a request to the vulnerable device using one of the many predictable default hostnames for the WDMyCloud such as "wdmycloud" and "wdmycloudmirror" etc.,” Bercegay explains.

In addition to the two critical vulnerabilities, the security researcher discovered a series of other dangerous issues as well in the WDMyCloud firmware. These bugs, however, are not deemed Critical, especially since some of them require authentication to be exploited.

The WDMyCloud web interface was found to lack an effective Cross site request forgery protection and exploitation of the issue is trivial, the researcher says. WDMyCloud is also plagued with a series of command injection issues. An attacker can abuse the language preferences functionality to cause denial of service to the web interface and can dump a list of all users, including detailed user information.

The researcher also discovered that the exact same mydlinkBRionyg backdoor account was found in the D-Link DNS-320L ShareCenter NAS device a while back, supposedly because both devices shared common firmware code. However, the issue was addressed in D-Link DNS-320L with firmware version 1.0.6, released in July 2014.

“It is interesting to think about how before D-Link updated their software two of the most popular NAS device families in the world, sold by two of the most popular tech companies in the world were both vulnerable at the same time, to the same backdoor for a while. The time frame in which both devices were vulnerable at the same time in the wild was roughly from early 2014 to later in 2014 based on comparing firmware release note dates,” Bercegay notes.

The researcher reported all these vulnerabilities to the vendor in June 2017. Firmware release 2.30.174 should address all of these issues.

RelatedMultiple Zero-days Disclosed in Western Digital NAS Storage Devices

RelatedWestern Digital Patches Vulnerabilities in "My Cloud" Products

目录
相关文章
|
监控 安全 网络协议
黑客控制肉鸡三大利剑工具一次性全部学会
黑客控制肉鸡三大利剑工具一次性全部学会
370 0
|
传感器 机器学习/深度学习 数据采集
基于3D打印机编译器的信息泄漏攻击
在网络物理增材制造系统中,侧信道攻击已被用于重建正在生产的 3D 对象的 G/M 代码(这是给制造系统的指令)。在产品大规模制造并投放市场之前的原型设计阶段,这种方法通过最意想不到的方式从组织窃取知识产权是有效的。然而,由于缺乏足够的侧信道信息泄漏,攻击者可能无法完全重建 G/M 码。在本文中提出了一种放大信息泄漏的新方法,通过暗中改变编译器来提高 G/M 代码恢复的机会。通过使用该编译器,攻击者可以轻松控制各种参数以放大 3D 打印机的信息泄漏,同时生产所需的对象并对真实用户隐藏。
99 1
|
安全 数据安全/隐私保护
|
传感器 数据采集 安全
新型僵尸网络Rakos:入侵设备后改造为C&C控制端,已感染数万台
本文讲的是新型僵尸网络Rakos:入侵设备后改造为C&C控制端,已感染数万台,Morphus Labs最近部署了不少高交互蜜罐,希望能发现一些隐藏特别深的最新恶意攻击,但是在蜜罐部署的前两天,该实验室对恶意软件的捕获都失败了,这其中就包括针对SSH端口的SPAM和XORDDoS攻击。
1947 0
|
安全 物联网 C++
记一枚可能被夸大的“数百万物联网设备远程劫持”漏洞
本文讲的是记一枚可能被夸大的“数百万物联网设备远程劫持”漏洞,安全研究人员发现,主流互联网设备制造商使用的开源组件开发库存在一个严重级别的远程命令执行漏洞(CVE-2017-9765),可使数百万物联网设备陷入危险之中,容易受到攻击。
1563 0
|
安全 算法 数据安全/隐私保护
国内研究人员发现GMR-2漏洞,可实时解密卫星电话通讯
本文讲的是国内研究人员发现GMR-2漏洞,可实时解密卫星电话通讯,近日,有报道称两名中国的安全研究人员发现GMR-2标准在具体实施中的漏洞,并且可以利用这些漏洞在几秒钟内对卫星电话通讯进行解密。
1338 0
|
安全 数据安全/隐私保护 网络架构
加密流量分析 思科全新方法对战恶意软件
本文讲的是 加密流量分析 思科全新方法对战恶意软件,6月20日,思科公司发布全新智能网络系统。通过机器学习,网络的“加密流量分析”( Encrypted Traffic Analytics )软件可梳理网络数据,查找恶意软件的警示迹象。
2100 0
|
安全 测试技术
低水平黑客也可远程攻击工业电机并造成物理破坏
本文讲的是低水平黑客也可远程攻击工业电机并造成物理破坏,造成物理破坏的黑客攻击屈指可数。臭名昭著的震网蠕虫是世上首个,它对伊朗的核离心机造成了物理破坏。
1989 0