Vulnerabilities: Synology, SuperMicro Motherboards

[mubs]

Hacker infects Synology storage devices, makes off with $620,000 in Dogecoin


Exploiting bug in Supermicro hardware is as easy as connecting to port 49152

 

[Mercutio]

I don't think we should be at all surprised that a prepackaged storage solution like a Synology NAS would have swiss cheese security. I'm kind of impressed that somebody could make that much money cryptocoin mining on a bunch of Atom CPUs.

 

[LunarMist]

Is that only a problem if your NAS is on the internet?

 

[Chewy509]

Is that only a problem if your NAS is on the internet?

That was my thought in regards to both? Why does a BMC need direct access to the Internet, and the only reason I can think of giving a NAS direct access is if has FTP or web functionality tat you wanted to explicitly expose...

Yes these sorts of things shouldn't happen, but security requires layers just like a good onion...

 

[LunarMist]

I would never connect my NAS to the internet, but perhaps some buy it for that purpose.

There are slomo for the

 

[mubs]

As far as I know, Synology is more of a consumer NAS, not for heavy duty professional use. It is possible that it was connected to a switch/router for internal access, inadvertently also exposing it to the Internet without intending to do so or understanding the implications. Most everything today has a web interface for managing it, and so you have the perfect recipe for something like this to happen.

 

[ddrueding]

I'm sure everyone here knows, but I'll reiterate because it deserves it. Don't expose anything to the internet. System complexity and the number of people looking for exploits have effectively made everything vulnerable by an automated process. Have a firewall that blocks all unsolicited incoming traffic in all cases.

 

[Chewy509]

I certainly can't wait for the "Internet of things"... (Just imagine the botnet that one could create when that becomes a reality).

 

[Howell]

Many motherboards with built in BMCs tie it to the motherboard's eth0 by default. The same nic that would get plugged in at the colo.

 

[sechs]

I'm kind of impressed that somebody could make that much money cryptocoin mining on a bunch of Atom CPUs.

You make it up in volume....

 

[Mercutio]

As far as I know, Synology is more of a consumer NAS, not for heavy duty professional use. It is possible that it was connected to a switch/router for internal access...

For what it's worth, the Synology NAS does have some network-based file sharing features that become available if they're exposed directly to the internet. They can do WebDAV and FTP with relatively little configuration. It's definitely not out of the question that a small business would have one configured so users could access their data off-site. The one, two and perhaps even four-bay products are definitely geared to SOHO and consumer needs, but the bigger versions aren't really going to appeal to anyone but corporate customers.

Also, Synology's NAS has WAY more useful firmware than Drobo, which is really the other big name in small NAS products. I'd never voluntarily buy a Drobo again.

 

[sechs]

I will also mention that, in any company of size, there's consumer gear where there should be enterprise stuff, simply because it's cheaper or employees brought it in themselves, as they wouldn't get approval for something appropriate.

 

[Mercutio]

Of course, that also brings in to question the actual value of the enterprise stuff. I suspect a lot of places have $1000 Cisco APs that could do just as well with $50 Netgear models.

 

[Howell]

That's is less a reflection of the value of $1000 AP the the ability of the buyer to differentiate if they need those premium functions.