研究人员在西部数据存储设备上发现硬编码后门

Firmware updates released by Western Digital for its MyCloud family of devices address a series of security issues, including a hardcoded backdoor admin account.

西部数据为自家MyCloud系列设备发布的固件更新爆出了一系列的安全问题，甚至包含了一个硬编码带有admin权限的后门账号。

The vulnerabilities were found in WDMyCloud firmware prior to version 2.30.165 and are said to affect devices such as MyCloud, MyCloudMirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, and My Cloud DL4100.

在WDMyCloud版本2.30.165之前的固件漏洞据说影响以下设备：

MyCloud, MyCloudMirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100 和 My Cloud DL4100。

Discovered by GulfTech security researcher James Bercegay, the security flaws could be exploited to achieve remote root code execution on the affected WD My Cloud personal cloud storage units (the device is currently the best-selling NAS (network attached storage) device on Amazon).

GulfTech安全研究员James Bercegay发现这些安全漏洞可以在西部数据My Cloud个人云存储设备（目前这个设备是亚马逊上最畅销的NAS存储产品）上被利用，以远程root权限执行指令。

One of the most important security issues the researcher found was an unrestricted file upload vulnerability created by the “misuse and misunderstanding of the PHP gethostbyaddr() function,” the researcher says.

其中一个被发现的最严重的漏洞是审核不严格的文件上传权限漏洞，是因为对PHPgethostbyaddr()方法理解不当和滥用造成的。

不翻了，自己看吧，总归就是一句话，别买西数的产品了。

The vulnerable code in said file allows an attacker to define a remote auth server, which could be an attacker-controlled server. The result should fail if an invalid host is defined, but a series of bugs result in checks being skipped, eventually allowing an attacker to abuse the issue “to upload any file to the server that they want.”

While analyzing CGI binaries on the webserver, the security researcher discovered code where login functionality would specifically look for an admin user named “mydlinkBRionyg” and would accept the password “abc12345cba”.

The researcher then discovered that the backdoor could be turned into a root shell that would allow an attacker to execute any commands as root and gain control of the affected device. Damaging a vulnerable device would be extremely easy and would not require authentication.

“The triviality of exploiting this issues makes it very dangerous, and even wormable. Not only that, but users locked to a LAN are not safe either. An attacker could literally take over your WDMyCloud by just having you visit a website where an embedded iframe or img tag make a request to the vulnerable device using one of the many predictable default hostnames for the WDMyCloud such as "wdmycloud" and "wdmycloudmirror" etc.,” Bercegay explains.

In addition to the two critical vulnerabilities, the security researcher discovered a series of other dangerous issues as well in the WDMyCloud firmware. These bugs, however, are not deemed Critical, especially since some of them require authentication to be exploited.

The WDMyCloud web interface was found to lack an effective Cross site request forgery protection and exploitation of the issue is trivial, the researcher says. WDMyCloud is also plagued with a series of command injection issues. An attacker can abuse the language preferences functionality to cause denial of service to the web interface and can dump a list of all users, including detailed user information.

The researcher also discovered that the exact same mydlinkBRionyg backdoor account was found in the D-Link DNS-320L ShareCenter NAS device a while back, supposedly because both devices shared common firmware code. However, the issue was addressed in D-Link DNS-320L with firmware version 1.0.6, released in July 2014.

“It is interesting to think about how before D-Link updated their software two of the most popular NAS device families in the world, sold by two of the most popular tech companies in the world were both vulnerable at the same time, to the same backdoor for a while. The time frame in which both devices were vulnerable at the same time in the wild was roughly from early 2014 to later in 2014 based on comparing firmware release note dates,” Bercegay notes.

The researcher reported all these vulnerabilities to the vendor in June 2017. Firmware release 2.30.174 should address all of these issues.

Related: Multiple Zero-days Disclosed in Western Digital NAS Storage Devices

研究人员在西部数据存储设备上发现硬编码后门相关推荐

老旧漏洞不修复，西部数据存储设备数据遭擦除
聚焦源代码安全,网罗国内外最新资讯! 编译:奇安信代码卫士 My Book Live 和 My Book Live Duo 网络存储器 (NAS) 的很多所有人称自己的文件遭擦除,似乎是由某老旧漏洞 ...
复杂存储过程学习_AI数据存储设备选型的6个关键要素
人工智能(AI)和机器学习将成为帮助企业利用其核心数字资产创造竞争优势的最重要工具之一.但在选购AI数据存储设备之前,企业必须考虑机器学习平台在获取.处理和保留数据时的一系列需求. 我们首先需要研究一 ...
常用计算机的储存设备有哪些,【好物榜单】常用数据存储设备推荐
[好物榜单]常用数据存储设备推荐 2018-09-04 12:21:57 2点赞 6收藏 0评论现在的网盘越来越不靠谱了,倒闭的倒闭,收费的收费,而且即使你是会员,上传的影片也有可能还是会被替换成几 ...
西部数据NAS设备网络攻击通告
报告编号:B6-2021-062805 报告来源:360CERT 报告作者:360CERT 更新日期:2021-06-28 0x01 事件描述 2021年06月28日,360CERT监测发现Weste ...
数据存储设备的发展历史
2.3.1 数据存储设备的发展历史 <海量数据存储>第2章数据存储的基本原理,本章从数据存储的基本原理入手,介绍数据存储的实现.数据的写入与读出.数据存储设备与系统以及多级存储技术等.本节 ...
【Error】西部数据磁盘插上不显示盘符
问题描述: 去年(2017)购买了一块2TB的西部数据硬盘,放了一部分虚拟机和源码,结果今年4月份的时候插入磁盘突然显示不了了.具体症状表现为: 笔记本电脑开机后,插入电脑有很小的概率可以识别盘符,后 ...
转：西部数据NAS设备hack
通过该文学习一下常见硬件web漏洞.重点关注一下几个方面: 1.登录验证代码: 2.文件上传代码: 3.system/exec/popen等是否存在注入可能: 4.调用二进制文件: 5.未登陆可以访问 ...
MySQL存储用户点赞的信息_点赞数据存储方法及设备与流程
本申请涉及互联网技术领域,尤其涉及一种点赞数据存储方法及设备. 背景技术: 为了增加用户的互动性,许多社交平台为用户提供了投票/点赞,或反对/踩的功能.例如,在网络直播平台上,为了使用户和主播具有良性 ...
多家大厂的存储设备受第三方加密软件缺陷影响
聚焦源代码安全,网罗国内外最新资讯! 编译:代码卫士多家大型厂商的存储设备受第三方加密软件中的多个缺陷影响. 本月初,西部数据更新 SanDisk SecureAccess 产品,修复可导致通过暴 ...

研究人员在西部数据存储设备上发现硬编码后门

研究人员在西部数据存储设备上发现硬编码后门相关推荐

最新文章

热门文章