If there was ever a time to upgrade the firmware on your Seagate wireless Network Attached Storage (NAS) drive, then today is the day to do it. Wireless NAS drives have become an efficient, easy and extremely convenient way for individuals to store and access a range of files, both at location and remotely. According to researchers at Tangible Security, that convenience is being compromised by a number of newly discovered vulnerabilities that leaves certain Seagate NAS drives open to attack by malicious individuals.
There’s always going to be a risk associated with connected devices that offer storage solutions. The very nature of those drives, and the fact that users often use them to store personal and sensitive data and files, means that those with malicious intent would be extremely keen to get access to the content. With that said, there’s generally an implied responsibility for the manufacturers to do all that’s within their power to secure, and prevent that kind of access. In this instance it seems that access via an undocumented Telnet feature using username “root”, and a hardcoded default password, is all that’s required to access certain drives.
The Tangible Security report also suggests that in addition to that relatively easy access method, there also exists a number of additional vulnerabilities that could potentially allow unauthorized individuals to not only browse files on the NAS drive, but also download them remotely, as well as actually upload malicious files directly to the drive from a remote location. The research into the issue has identified that Seagate Wireless Plus Mobile Storage, Seagate Wireless Mobile Storage, and LaCie FUEL drives are all affected by this hole. This is however not an exhaustive list, meaning there could be many more drives types that are exploitable.
Firmware versions 2.2.0.005 to 2.3.0014 are known to be affected by these vulnerabilities, which were originally detected back in March of this year. The good news is that Seagate has acted on the problem by issuing an updated set of firmware patches to fix the vulnerabilities, albeit only recently. The security firm behind the research has also been sure to warn consumers that due to how manufacturers package and name products, there’s a possibility that a large number of hardware could be affected:
With products from large vendors such as Seagate, there tend to be numerous product names for basically the same product under the same vendor’s name or another vendor. Tangible Security cannot enumerate all of the named products as well as Seagate. Other named products may be affected.
If you feel like you may have an affected NAS drive, or just want to get the latest firmware for your hardware, the advise is to head over to apps1.seagate.com/downloads/request get the latest patch for your drive.
(Source: Tangible Security)
You may also like to check out:
You can follow us on Twitter, add us to your circle on Google+ or like our Facebook page to keep yourself updated on all the latest from Microsoft, Google, Apple and the web.