Worm Illuminates Potential NAS Nightmare

A researcher at Black Hat Europe hopes to demonstrate a homegrown, self-replicating worm to illustrate major threats to popular network-attached storage systems.

A researcher who so far has discovered 30 zero-day vulnerabilities in a dozen major network-attached storage (NAS) vendor products is creating a computer worm to demonstrate just how easy it would be for cyber criminals and other hackers to exploit flaws he found in these devices.
Jacob Holcomb, a security analyst at Independent Security Evaluators, has rolled multiple exploits for vulnerabilities hes already reported to NAS vendors into a proof-of-concept, self-replicating worm. The worm scans for vulnerable services running on NAS systems -- mostly web servers -- and identifies the type of NAS device and whether it harbors the bugs. If so, the worm launches the corresponding exploit to take control of the device. Then, like any good worm, it spreads to other NAS systems.
I wanted to actually develop a POC myself and present it so people can understand the ramifications as my findings are being demonstrated and publicly disclosed, versus six months later when adversarial attackers are trying to exploit it for profit, Holcomb says.
He plans to unleash the worm in a self-contained network with no Internet access, so theres no chance of it inadvertently escaping and spreading. He hopes to demonstrate the NAS worm live next month at
Black Hat Europe in Amsterdam
, but he is currently running the plan by attorneys to determine if he can present the demo without any legal fallout.
Meanwhile, the NAS vendors whose products contain major security holes are a whos who of the storage market: Seagate, D-Link, Lenovo, Buffalo, QNAP, Western Digital, Netgear, ZyXEL, Asustor, TRENDnet, HP, and Synology. The vulnerabilities Holcomb has found over the past few months range from simple information disclosure about the device to command or code execution vulnerabilities that would allow an attacker to take control of the NAS device.
As my research started, I came to realize fast that these devices were more vulnerable than Soho routers. That was rather shocking, actually, because I had published 56 CVEs for [bugs] in routers, says Holcomb, who previously had discovered the major flaws in Soho routers. Im confident that by the time I wrap up my NAS research, it will have exceeded the number of vulnerabilities I published in routers last year.
Holcomb, who presented the first stage of his NAS research in August at Black Hat USA, says he decided to drill down on NAS security because these systems are so widely deployed in home and corporate networks. Pretty much everything we do relies on some form of backend storage for access.
Each of the storage devices he investigated is vulnerable to a command or code execution attack, which would allow a hacker to have his way with the devices. Currently, at least 50% of the devices can be taken over without authentication, meaning that an attacker can execute code on them without even having to authenticate to the device. Holcomb will reveal details on this
second phase of his NAS research at Black Hat Europe
.
An attacker with control of a NAS could then wage a man-in-the-middle attack against routers and network clients to sit in the line of all the targeted organizations network communications, he says.
That has implications for the entire public Internet infrastructure. If an attacker were to wrest control of millions of NAS, routers, and other Internet of Things things, it could cause major network outages. An adversarial attacker could cause substantial network outages by attacking Internet service providers or other core pieces of the Internet infrastructure.
NAS is a juicy target because its not only easy to access, but also typically contains valuable information. If an attacker compromises NAS, [he has] access to all of the data on the device, from something as silly as MP3 files to tax returns or other sensitive data, he says.
The devices also can be used as a springboard to other targets. Pretty much anything could happen, with an attacker gaining access to your files. These systems are used for other computers to access files, so [an attacker] could Trojanize one of the files on a storage system, and when you access it, it infects your computer, Holcomb explains. It could be used as a malware-spreading medium to attack other systems, too.
NAS systems already have begun getting attacked. Before
his August presentation at Black Hat USA in Las Vegas
, for example, some Synology NAS systems were hit with a ransomware attack, where the victims were informed they would have to pay up to get their stored files decrypted.
He plans to demonstrate new vulnerabilities he found in addition to the cross-site request forgery, buffer overflow, authentication bypass, information disclosure, backdoor, session management, and directory traversal flaws he detailed in August in some of the products.
NAS vendors so far have been lukewarm in their responses to his findings. Only a handful of manufacturers have acknowledged my report, he says. And one vendor -- D-Link -- has yet to respond to his bug reports.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Worm Illuminates Potential NAS Nightmare