Network Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells

### Overview In this presentation, Jacob Holcomb, a security analyst at Independent Security Evaluators (ISE), shares his vulnerability research into Network Attached Storage (NAS) devices. Holcomb highlights that 100% of the 10 NAS devices he evaluated—spanning consumer-level $200 models up to enterprise units costing thousands of dollars—were vulnerable to exploitation resulting in full root compromise. Furthermore, at least 50% could be exploited without authentication. Because NAS vendors frequently reuse the same core operating system across entire product families, a single vulnerability found on an entry-level unit often impacts an entire catalog up to high-end enterprise systems. To demonstrate the severity of these flaws, Holcomb showcases the weaponization of these vulnerabilities into a self-replicating proof-of-concept worm dubbed the "nasty worm."

### Key Topics - **Embedded Systems Security Posture**: Embedded devices like NAS platforms and SOHO routers rely heavily on legacy chip manufacturer codebases from the late 1980s and early 1990s. NAS devices run unnecessary background network services (telnet, FTP, web servers, PHP, WordPress) and cloud remote access features that expose them to attacks. - **Methodology & Vulnerability Research**: Holcomb describes his audit workflow using default out-of-the-box configurations, scanning and port enumeration (Nmap, Netcat), static code analysis on open-source/GPL packages, and dynamic analysis/fuzzing. His focus remained strictly on high-impact flaws that grant code execution rather than lower-severity web bugs. - **Weaponization and Self-Replication**: Consolidating individual exploits into a self-propagating worm that scans local subnets, fingerprints HTTP services on TCP port 80, executes command injection flaws to spawn root shells, downloads a binary copy of itself, and repeats propagation across the network. - **Wider Embedded Device Insecurity**: Embedded electronics suffer from systemic neglect, lacking memory protections (ASLR, non-executable stacks, stack cookies/canaries) and antivirus tools, making them premier footholds for building large-scale botnets.

### Technical Details - **Backdoors and Cryptographic Flaws**: On a Seagate device, Holcomb uncovered an undocumented backdoor account in `/etc/shadow` utilizing an easily cracked DES crypt hash, granting web and telnet access. On an Acer NAS running PHP, session cookie generation relied on `gettimeofday` with seconds since the epoch as the seed. Burp Suite analysis revealed an effective entropy pool of roughly two bits (featuring static high-order bytes like `0x53DF`), enabling deterministic cookie prediction and account takeover. - **Authorization and Access Control**: On a Buffalo device, an unauthenticated or low-privilege guest account with a fixed session ID (`SID`) was able to invoke JSON-RPC API methods (`user.edit` and `apply_settings`) intended exclusively for administrators. By modifying the admin password and logging in, the speaker executed commands via command substitution in an IP address field. - **The Nasty Worm Implementation**: The self-propagating worm targeted three hardware devices: - *D-Link DNS-345*: Exploited via command injection with an authentication bypass. Lacking an interactive shell, the payload constructed a pseudo-shell script byte-by-byte in an infinite loop listening for input, subsequently spawning an unauthenticated telnet daemon. - *TRENDnet TN-2000*: Limited buffer space in an IP field allowed only a couple bytes per injection. Holcomb overcame this by sending approximately 100 requests, echoing two bytes at a time into a shell script file before executing it. - *Western Digital My Cloud EX4*: Exploited via an exposed, unauthenticated PHP script executing system commands directly. - **Router Buffer Overflow**: Holcomb also demonstrated an authenticated stack-based buffer overflow in an ASUS RT-N56U router running Asuswrt firmware (MIPS architecture). The vulnerability stemmed from an `sprintf` call copying parameters (`apps_name`/`apps_flag`) into a 128-byte buffer. Exploitation required a multi-stage ROP chain, stack pivot, and MIPS little-endian reverse shellcode connecting back on port 31337.

### Takeaways Holcomb cautions that intrusion detection/prevention systems (IDS/IPS) are primarily signature-based fallacies that attackers can evade via encryption, polymorphic modifications, or altered network behavior. Remediation fundamentally relies on embedded device vendors adopting secure development lifecycles, rigorous QA, white-list input sanitization instead of blacklists, dropping root privileges for network daemons, and providing transparent, automated patch management systems.