Yes our NAS boxen have a 0day, says Seagate: we'll fix it in May Owners of some Seagate NAS boxen will be exposed to a remote execution zero day flaw until a patch drops in May unless they kill some external services. The company learned of flaw in its Business Storage 2-bay NAS products on 18 October, 2014. Australian Beyond Binary hacker OJ Reeves alleged the company failed to fix the …
You'd think that the number of zero-day exploits would be decreasing, given the focus on finding these over the last 10 years. However, I guess that bulletproof IT systems have the same delivery date as universal peace and understanding.
"You'd think that the number of zero-day exploits would be decreasing"
Only if you were an engineer focussed on delivering secure products to your customers.
Unfortunately the engineers "customers" are corporations who want the lowest cost solution to the problem of slurping their customers data, so more and more "features" rely on hidden communications channels that consumers aren't aware of but criminals (the ones that didn't sell them the flawed product) are happy to exploit.
I've no idea what a 'typical' Seagate NAS customer looks like. It may well be that some of them are home brew systems used for storing torrents of old Star Trek episodes, for which enabling remote UPnP might be sensible. But for any commercial operation to expose their NAS directly to the Internet without disabling unnecessary services and the placement of an intervening DMZ (or at least a firewall) would be a bit, well, daft. That doesn't rule out the possibility of misconfiguration, of course.
Who said anything about waiting for years (apart from you)? Accessing a reasonably configured system over the Internet is indeed 'unlikely'. In the real world, we have this thing called prioritising - look it up, you might learn something and it may prevent you from becoming 'part of the problem' (when you grow up).
Want better security? buy something with real support, nobody in their right mind should buy a NAS from a company like Seagate and expect anything great out of it.
Want better protection buy an enterprise product, they are not perfect of course but at least organizationally they are much better geared to deal with this kind of thing, I have no expectation that Seagate (or any of the 10s to maybe 100 small NAS vendors out there) to have that level of structure. I say that as someone who has worked closely with software development teams for the past 15 years now(not related to storage, more related to SaaS/online transaction type systems)
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
