Tag Archive for: NAS

Routers, NAS and phones hacked in Pwn2Own competition

/in


Security researchers gathered in Austin, Texas, this week for yet another Pwn2Own hacking competition, racking up more than $1 million in rewards for their exploit demonstrations.

The latest edition of the iconic hacking contest has seen a specific focus on network-attached storage (NAS) boxes as well as routers, with mobile phones and printers also on the menu.

Among the more popular targets at the competition was the Cisco RV340 router, which was subjected to nine successful or “collision” attacks that used previously known flaws, with one more attempt failing to execute. Researchers were able to break into the networking appliance using both known and unknown security vulnerabilities.

Also popular with hacker contestants was the Western Digital My Cloud Pro Series PR4100 NAS box. The storage device was the subject of nine successful or collision hacks.

Topping the contest was the team from security firm Synactiv, who managed to rack up $197,500 in payouts and 20 “Master of Pwn” points.

Second in the rankings was the Devcore trio of researchers Orange Tsai, Angelboy and Meh Chang, who showed off six successful attacks and claimed a total of $180,000.

The achievement continued a busy year for Orange Tsai in particular. In late 2020, they discovered and reported the ProxyLogon flaws in Microsoft Exchange Server, which were exploited by nation-state hackers prior to being patched. In August, the researcher took to the stage at Black Hat 2021 to discuss their discovery of ProxyShell Exchange bugs, which had been disclosed and patched in April.

Printers were also targeted in the event. Ten different entries were launched against either the Canon ImageCLASS MF644Cdw or Lexmark MC3224i. The ZDI noted that when researchers from Synactiv demonstrated a heap overflow attack against the MF644Cdw, it marked the first successful printer hack in the competition’s history.

The contest ended on Friday with researchers from NullRiver successfully exploiting two flaws in the Netgear R6700v3 router. The ZDI says that it paid out $1,081,250 in rewards over the four-day competition and received 60 new zero-day vulnerabilities.

Not every device put in the crosshairs has been successfully…

Source…

Pull your Western Digital My Book Live NAS off the internet now if you value your files • The Register

/in


Western Digital has alerted customers to a critical bug on its My Book Live storage drives, warning them to disconnect the devices from the internet to protect the units from being remotely wiped.

In an advisory, the storage firm said My Book Live and My Book Live Duo devices were being “compromised through exploitation of a remote command execution vulnerability” CVE-2018-18472. The exploit is described as a root remote command execution bug which can be triggered by anyone who knows the IP address of the affected device – and is currently being “exploited in the wild in June 2021 for factory reset commands.”

Reports of the issue emerged on Thursday after owners of the NAS devices took to Western Digital’s support forums to complain.

“All my data is gone too. Message in GUI says it was ‘factory reset’ today! I am totally screwed without that data… years of it,” wrote one user.

“I kept all my documents on this drive. All files gone,” said another.

Device logs published on the Western Digital forums show the devices were remotely factory reset, although the culprits have not been found. In a statement earlier today, the company said it didn’t believe its own servers were compromised.

The Western Digital My Book Live connects to a host computer via USB, with internet access coming via an Ethernet port on the back. Remote access is obtained via Western Digital’s own cloud servers.

NAS drives have a storied history of falling victim to malicious actors. In April, Taiwanese storage giant QNAP urged customers to update their drives in the face of two specifically targeted ransomware strains, Qlocker and eCh0raix.

The previous year, authorities in the US and UK warned of a mass infection of data-stealing malware targeting QNAP drives. Dubbed Qsnatch, the attack compromised an estimated 62,000 devices. Once inside, the malware opened several backdoors – including SSH and a webshell – and resisted attempts by the…

Source…