If you have a Seagate Wireless NAS drive, I’d strongly suggest updating your firmware right away. As in drop everything that you’re doing and do it now. Why do I sound so melodramatic? Here’s why via Betanews:
An undocumented Telnet feature could be used to gain control of the device by using the username ‘root’ and the hardcoded default password. There are also other vulnerabilities that allow for unauthorized browsing and downloading of files, as well as permitting malicious files to be uploaded. Tangible Security says that Seagate Wireless Plus Mobile Storage, Seagate Wireless Mobile Storage, and LaCie FUEL drives are affected, but there may also be others.
The security issues are confirmed to exist with firmware versions 2.2.0.005 to 2.3.0.014. The problems were discovered way back in March, but a patch has only recently been published, along with an advisory notice from US CERT.
That’s an epic fail on a variety of levels. Anyone with an affected device is advised to update to firmware version 3.4.1.105 which addresses the issue.But I have to ask, who wrote the code for this? What explanation do they have for inserting such features in a supposedly secure storage device? It may have been left in for debugging purposes, which would imply that Seagate’s QA department who would be responsible for catching this really dropped the ball. Thus it would be incompetence at work. However, in the age of Edward Snowden, you cannot help thinking if there is something sinister at work. Either way, Seagate has some explaining to do so that they can regain the trust of their user base.
Seagate QUIETLY Patches Security Flaw In Their Personal Cloud NAS Devices
Posted in Commentary with tags Seagate on January 18, 2018 by itnerdIf you have a Seagate Personal Cloud NAS device, I’d advise you to check for a firmware update because according to a security researcher, there was a nasty bug that Seagate apparently quietly patched after not acknowledging that the flaw even existed:
The vulnerability affects Media Server, a web application that runs on the NAS and allows users to interact with the data stored on the device via a network connection.
And:
The flaw —named an unauthenticated command injection— allows attackers to run commands on the device’s underlying firmware from its web management interface.
Koster put together proof-of-concept code that would use the flaw to enable remote SSH access on the Seagate NAS and then change its root password.
One note is that you have to be on the local network to pull that off. But there’s lots of malware that are capable of getting onto a local network and potentially exploiting something like this. Thus this isn’t trivial.
Here’s the the key point to all of this:
[Security researcher named Yorick] Koster has reached out to Beyond Security’s SecuriTeam managed vulnerability program to inform Seagate of the issue he discovered. Beyond Security, on behalf of Koster, has reached out to Seagate.
“Seagate was informed of the vulnerability on October 16, but while acknowledging the receipt of the vulnerability information, refused to respond to the technical claims, to give a fix timeline or coordinate an advisory,” Beyond Security wrote.
But Koster has told Bleeping Computer that while ignoring the vulnerability report, Seagate has quietly patched the flaws he reported.
“I can confirm it is fixed on my NAS,” Koster told Bleeping Computer, pointing us to the Seagate Personal Cloud changelog for version 4.3.18.0.
That’s really craptastic handling of this issue by Seagate. The fact that they didn’t respond to this, nor did they wrap any timelines around a fix isn’t cool. The only good news is it looks like they fixed this within the 90 day window that the responsible disclosure protocol demands. But clearly their communication needs to be better. In any case, if you have one of these devices, you need to patch it ASAP.
Leave a comment »