[outleradam]

http://wireless.1saleaday.com/



It looks like it is a UPnP DLNA server. I'm thinking I'm going to buy one. The deal expires in less then 5 hours. Whacha think?

[poofyhairguy]

Thanks for the link! I am gonna get one for my mom to be a backup for her laptop computer. Since she doesn't have any HD movies 1TB will be more than enough! Heck, with a DLNA server built in this is the perfect gift for the person in your life with a PS3 that loves taking photos.

[outleradam]

Thanks for the input. I placed one on order.

[outleradam]

I just received this NAS today and have started looking at it. First, the good:
It comes with it's own dynamic DNS account for 200+ days free. That's not bad.

The bad: It has a remote administrative console which is pretty much a joke. It works with google Chromium browser, but firefox seems to have issues. I'm performing a security sweep currently and i've found over 70 security voulnerabilities on this unit. For an "Appliance", this thing is a risk to have on a network. It allows arbitrary execution of code and script redirection. It has a digital encryption signature which does not match the hardware. IOMega even signed the signature themselves, without registering the key with a Certificate Authortiy... Basically, they did it just to do it and say this has security because it can support SSL. It seems that they did not even think of security except as a trade slogan word. "Yeah, it's got SSL, it's secure". I would not even know HOW to put this many security holes on a computer, much less on a piece of firmware.

Here's a transcription of the scan
http://pastebin.com/xFxCJtVB

I'm sure if I wanted to, I could tear into this hardware across a network without even tearing open the case.

[darkscout]

Simmer there turbo.

"Microsoft Windows SMB Shares Unprivileged Access".
http://nessus.org/plugins/index.php?view...e&id=42411
It means that it's Guest Readable, this is the "fix"
"To restrict access under Windows, open Explorer, do a right click on
each share, go to the 'sharing' tab, and click on 'permissions'."

Ok. Who cares about who signed the SSL stuff? It still means your bits aren't plain text over the network. Which is the point. I run self generated SSL on almost everything I can. Stuff is encrypted between here and there.

SMB Guest Account Local User Access
http://www.nessus.org/plugins/index.php?...e&id=26919
So.... you can access it as a guest as any user. Again. If this is a network server, you should be able to do this on shared shares.

OpenSSL Detection - Yeah. It detected OpenSSL. Literally, that's the "Bug".
http://www.nessus.org/plugins/index.php?...e&id=50845

mDNS Detection - It is running mDNS. You can find out about the machine. (Meaning XBMC, which advertises stuff over mDNS is "equally" as vulnerable).
"The remote service understands the Bonjour (also known as ZeroConf or
mDNS) protocol, which allows anyone to uncover information from the
remote host such as its operating system type and exact version, its
hostname, and the list of services it is running."

Synopsis : The manufacturer can be deduced from the Ethernet OUI.
Description : Each ethernet MAC address starts with a 24-bit 'Organizationally
Unique Identifier'.
These OUI are registered by IEEE.

How would you propose the web admin work without... web. browsable. directories.. OMG. GOOGLE HAS WEB BROWSABLE DIRECTORIES TOO. THEY"VE BEEN ROOTED.
http://www.nessus.org/plugins/index.php?...e&id=40984 (It means you can use a web browser).

The remote host listens on UDP port 137 or TCP port 445 and replies to
NetBIOS nbtscan or SMB requests.
Note that this plugin gathers information to be used in other plugins
but does not itself generate a report.

Sounds pretty much like a NAS box.

Have you tried scanning your XBMC box? I'd be interested in how many it comes back with. Like those really horrible day 0-exploits that Russian crackers use like "Ping" and "Can figure out Ethernet Card OEM"

[outleradam]

Well, I couldn't stand just looking at it and I tore into the hardware....

Anyone seen this chip before?

[outleradam]

[outleradam]

Simmer there turbo.

"Microsoft Windows SMB Shares Unprivileged Access".
http://nessus.org/plugins/index.php?view...e&id=42411
It means that it's Guest Readable, this is the "fix"
"To restrict access under Windows, open Explorer, do a right click on
each share, go to the 'sharing' tab, and click on 'permissions'."

Ok. Who cares about who signed the SSL stuff? It still means your bits aren't plain text over the network. Which is the point. I run self generated SSL on almost everything I can. Stuff is encrypted between here and there.

SMB Guest Account Local User Access
http://www.nessus.org/plugins/index.php?...e&id=26919
So.... you can access it as a guest as any user. Again. If this is a network server, you should be able to do this on shared shares.

OpenSSL Detection - Yeah. It detected OpenSSL. Literally, that's the "Bug".
http://www.nessus.org/plugins/index.php?...e&id=50845

mDNS Detection - It is running mDNS. You can find out about the machine. (Meaning XBMC, which advertises stuff over mDNS is "equally" as vulnerable).
"The remote service understands the Bonjour (also known as ZeroConf or
mDNS) protocol, which allows anyone to uncover information from the
remote host such as its operating system type and exact version, its
hostname, and the list of services it is running."

Synopsis : The manufacturer can be deduced from the Ethernet OUI.
Description : Each ethernet MAC address starts with a 24-bit 'Organizationally
Unique Identifier'.
These OUI are registered by IEEE.

How would you propose the web admin work without... web. browsable. directories.. OMG. GOOGLE HAS WEB BROWSABLE DIRECTORIES TOO. THEY"VE BEEN ROOTED.
http://www.nessus.org/plugins/index.php?...e&id=40984 (It means you can use a web browser).

The remote host listens on UDP port 137 or TCP port 445 and replies to
NetBIOS nbtscan or SMB requests.
Note that this plugin gathers information to be used in other plugins
but does not itself generate a report.

Sounds pretty much like a NAS box.

Have you tried scanning your XBMC box? I'd be interested in how many it comes back with. Like those really horrible day 0-exploits that Russian crackers use like "Ping" and "Can figure out Ethernet Card OEM"

Information is a vulnerability. Those are some of the lower priority things. They're not necessarily issues, however, when a server responds to a query with information about version or type of service without authentication it should be considered insecure as that can be exploited. This thing automatically hooks up to the internet by sliding a button and typing a new password.

I'm not calling these 0-day exploits. I'm calling it what it is. You call a shovel a shovel. I call these security vulnerabilities. I mentioned the higher level ones and my take on them. I didn't even mention that it has a guest account which is enabled by default....

As for self-signing... Why even bother? Just so they can say it's got security? They own the keys and I can't find any sort of privacy statement. Who knows where my data goes when I'm asleep.

[darkscout]

Information is a vulnerability. Those are some of the lower priority things. They're not necessarily issues, however, when a server responds to a query with information about version or type of service without authentication it should be considered insecure as that can be exploited. This thing automatically hooks up to the internet by sliding a button and typing a new password.

I'm not calling these 0-day exploits. I'm calling it what it is. You call a shovel a shovel. I call these security vulnerabilities. I mentioned the higher level ones and my take on them. I didn't even mention that it has a guest account which is enabled by default....

As for self-signing... Why even bother? Just so they can say it's got security? They own the keys and I can't find any sort of privacy statement. Who knows where my data goes when I'm asleep.

What in gods name are you on about with "self signing" and "why even bother" Do you know what SSL is? Do you know what it is used for? How would a 'non-self signed' do anything different? All it does is throw up a warning in every web browser.

Maybe I glanced over it, but which exploit was the allows 'execution of code'?

Lets see: Cater to the tin foilists who don't want ANYTHING to be enabled by default or cater to the crowd that wants a media server when they come home and plug it in it's on their network. Magically shows up (mDNS) and just works (guest access). Can the guest account be turned off? Yes? Then it's not a 'vulnerability'.

Please take the time to scan your XBMC box. Turn on SABnzbd and enable SSL for that too. See what 'vulnerabilities' turn up.

For Pete Sake. It's (#*@ MEDIA SERVER. Put movies on it. Plug it in. Enjoy.

[outleradam]

I want to know what this thing is doing... Its not open source like XBMC. I feel secure in knowing that my XBMC behind a firewall will not allow external connections. This is going to be hooked to every computer in the house. This thing is Swiss cheese compared to XBMC which I have already scanned and made appropriate changes. For christ sake, its beyond me what the 4 http ports are doing. I think this device deserves a hardware firewall.

As for the execution of code, do a search for java in that pastebin from earlier.

[darkscout]

I want to know what this thing is doing... Its not open source like XBMC. I feel secure in knowing that my XBMC behind a firewall will not allow external connections. This is going to be hooked to every computer in the house. This thing is Swiss cheese compared to XBMC which I have already scanned and made appropriate changes. For christ sake, its beyond me what the 4 http ports are doing. I think this device deserves a hardware firewall.

As for the execution of code, do a search for java in that pastebin from earlier.

Just. Wow.
If you're that paranoid. Put it on a separate NIC and pass everything through wireshark. That'll sure make it stream fast Media.

And I did a full search for "Java". Closest Thing I could find was referencing Javascript.

"The remote host is running a web server that fails to adequately
sanitize request strings of malicious JavaScript. By leveraging this
issue, an attacker may be able to cause arbitrary HTML and script code
to be executed in a user's browser within the security context of the
affected site."

Not Sanitizing Javascript is absolutely nowhere even remotely close to "remote execution of code". I suggest you read up on Cross Site Scripting and what it does and does not do. If it's behind a firewall. Like everything should be, you'll have absolutely no problem with it.

And I can't imagine how you even got XBMC to run. It must have taken you hundreds of hours to audit all of the code by yourself and then compile it by hand using your own compiler. I mean. You wouldn't trust pre-compiled binaries. Never know what's in them. Same goes for a precompiled compiler.

Open Source does not magically make things secure. Especially if you're running binaries compiled by someone else.

[stoli]

Edit - removed as post was before coffee and sounded a little too harsh.

[outleradam]

Just. Wow.
If you're that paranoid. Put it on a separate NIC and pass everything through wireshark. That'll sure make it stream fast Media.

And I did a full search for "Java". Closest Thing I could find was referencing Javascript.

"The remote host is running a web server that fails to adequately
sanitize request strings of malicious JavaScript. By leveraging this
issue, an attacker may be able to cause arbitrary HTML and script code
to be executed in a user's browser within the security context of the
affected site."

Not Sanitizing Javascript is absolutely nowhere even remotely close to "remote execution of code". I suggest you read up on Cross Site Scripting and what it does and does not do. If it's behind a firewall. Like everything should be, you'll have absolutely no problem with it.

And I can't imagine how you even got XBMC to run. It must have taken you hundreds of hours to audit all of the code by yourself and then compile it by hand using your own compiler. I mean. You wouldn't trust pre-compiled binaries. Never know what's in them. Same goes for a precompiled compiler.

Open Source does not magically make things secure. Especially if you're running binaries compiled by someone else.

You act like you think I'm stupid or something. I'm really not.

I didn't say remote execution of code. I said "arbitrary execution of code".

This thing comes out of the box insecure and hooks up to the internet and sets up it's own web server online with DNS. It has guest account enabled by default and it has a ton of security vulnerabilities. It took me an hour to figure out how to disable the guest account.

My Cisco/Linksys WRT160NL Router came with a NAS. You hook up the USB hard disk and you can set up accounts. It does not allow guest account access unless you specify it. You set up individual accounts. It comes with a Twonkie media server as well. Basically, most of what does, but with some actual security out of the box..

I'm replacing a 1TB USB NAS with a 1TB Ethernet NAS.

There is no reason to have 0 security out of box AND set up a DNS server with the flick of a switch. That's rediculously insecure.

Here's how it should be.. Log-in first time as guest, it asks you to put in a username and password, then if you want the guest account enabled, then if you want it to set up a web server. That's a standard setup protocol for a network device. You don't just put 0 security on something and make the user enable everything. That's why Microsoft Windows got a bad name.

[outleradam]

I would like to say that I was wrong. It is open source.

While there is no way to disable the guest account, I found a way to lock down the storage to require a username and password. However, it was reported by my scans that there is a backdoor username.

After playing with this for a bit, in leiu of it's security holes, I've grown to really like it.

1. YouTube uploads by dragging and dropping
2. Facebook uploads by dragging and dropping
3. Flicker uploads by dragging and dropping
4. Drag-n-drop picture resize
5. automatic watermarking with user defined image

Now, it would seem that because of the lack of security, users can have full permissions over all of the above functions, or no permissions. This is a problem because, say, for example, say I get into an argument with the wife and she decides to upload a nastygram under my name instead of hers...

I like the unit, but it seems it is either 0 security or only 1 user can securely use it. There is no real granular control over it.

FTP/SFTP is only available from 1 folder on the drive, not the entire drive. I would prefer to interact with it over SFTP as it is a better match for my all-Linux network then Samba.

I'm going to remove the drive from it's housing this weekend and see if I can somehow modify folder permissions and/or create separate active folders manually. I believe it's running Linux so there is no "guest" account per-say, but it is using Samba so there may be a way to specify authentication is manditory.

Overall, I'd recommend this to anyone who has just a single computer on the network, however, I cannot recommend this for mulit-user capabilities. It only really supports 1 user or no security.

[outleradam]

I've taken the unit apart and plugged the hard disk into my computer. It would appear that the software is not good at cleaning up residual dirs. When you delete something from the web interface, it only deletes the web interface options, the folders stay.

here is the output of ls -l http://pastebin.com/Rhj1CUbG
I touched it up to remove some of my files.

BTW.. this is the unit I'm working with. http://go.iomega.com/en-us/products/netw...rtner=4760