Malware Infects 70% of Seagate Central NAS Drives, Earns $86,400 (softpedia.com) 98
An anonymous Slashdot reader writes: A new malware family has infected over 70% of all Seagate Central NAS devices connected to the Internet. The malware, named Miner-C or PhotoMiner, uses these hard-drives as an intermediary point to infect connected PCs and install software that mines for the Monero cryptocurrency... The crooks made over $86,000 from Monero mining so far.
The hard drives are easy to infect because Seagate does not allow users to delete or deactivate a certain "shared" folder when the device is exposed to the Internet. Over 5,000 Seagate Central NAS devices are currently infected.
Researchers estimates the malware is now responsible for 2.5% of all mining activity for the Monero cryptocurrency, according to the article. "The quandary is that Seagate Central owners have no way to protect their device. Turning off the remote access NAS feature can prevent the infection, but also means they lose the ability to access the device from a remote location, one of the reasons they purchased the hard drive in the first place."
The hard drives are easy to infect because Seagate does not allow users to delete or deactivate a certain "shared" folder when the device is exposed to the Internet. Over 5,000 Seagate Central NAS devices are currently infected.
Researchers estimates the malware is now responsible for 2.5% of all mining activity for the Monero cryptocurrency, according to the article. "The quandary is that Seagate Central owners have no way to protect their device. Turning off the remote access NAS feature can prevent the infection, but also means they lose the ability to access the device from a remote location, one of the reasons they purchased the hard drive in the first place."
Re: (Score:3, Insightful)
sed s/"IoT//g
Any device, be it IoT, a client, server, network device, or anything has this problem. In my experience, security is perceived to have no ROI, so at best it gets lip service, at worse, it is obviously ignored. I have seen "encryption" where all zeroes were used as AES keys for all operations, 4096 bit keys that were really sixty-four, 64-bit RSA keys (really giving 70 bits of security), tons of added stuff, no OS firewalling, disinterest in any updates, locking down firmware where no updates
Re: (Score:2)
back into the 1990's there was pretty much no worries about security.
And the motherboards didn't have anything baked into them because of hackers.
There were no switches. Unless you are talking about the jumpers so you should of said jumpers to actually prove what you were talking about. There were no internet based hacks that required jumper use to repair in the 1990's.
Re: (Score:2)
A jumper makes or breaks a connection. Even if you're a total aspie and don't think that makes it a switch, I have an old Asus MEW board right next to me and it's got DIPs on it so just fuck off.
P.S. s/should of/should have/
Re: (Score:1)
A jumper can make a switch, but isn't a switch, it's a jumper that connects two or more terminals together. If it was a switch, it never would of been called a jumper.
Next you'll be telling a fuse is a switch. You know, because it switches something on.
Re: (Score:1)
I love when grammar nazis are wrong.
go back to school.
Re: (Score:1)
Oh, and the MEW board? When was that introduced?
late 1999 and you tell me to fuck off ? Wow, You are a stain on slashdot. The sooner you get mod bombed the better.
Re: (Score:1)
Re: IoT (Score:1)
Just ask for your money back. These devices do not work as expected and it's definitely a manufacturing problem.
Re: (Score:2, Informative)
I like my ASRock motherboards, there is a physical switch that makes it boot up from the primary bios or the backup bios. Overwriting the Backup requires intentionally telling the Bios to overwrite the backup. You can flip the switch and make it boot from the backup and it can overrite the primary. You can't screw this up.
Also you can't flash the bios in Windows 10. You can however tell the bios to update the bios over the internet.
Now, why this is relevant. I had a Gigabyte motherboard last time around, it
Re: (Score:3)
"Because Windows has a bad habit of hiding file extensions, whenever the device owner accesses their NAS, they see this file as a folder, fooled by the fake icon." - http://news.softpedia.com/news... [softpedia.com]
So part of the problem is windows too. Hiding file extensions and allowing scripts to be run without confirmation. That's the same rubbish which made macro viruses so rampant in msoffice formats.
Silly Suits (Score:2)
Put an un-updatable OS on a harddrive, Brilliant!
Re: (Score:1)
Those drives are running Linux.
http://www.theinquirer.net/inquirer/news/2355376/seagate-rolls-out-nas-range-with-its-own-linux-based-operating-system
All NAS systems run linux except for some very expensive models designed for data centers and the FreeNAS-based systems which are only sold by iX systems and the few users who know where to find identical hardware to build their own.
Re: Silly Suits (Score:4, Informative)
There's a culture of insecurity at Seagate's NAS unit.
Some years ago, we (not a security or IT firm) reported some issues with their web interface. Basically there was a public (no authentication needed) PHP script in the directory used to serve the web admin interface which ran arbitrary commands from the URI as wheel. That could be used to reset the admin password, load and run arbitrary code, load an entire hostile OS for the NAS, etc.
Support didn't understand the issue, and security ignored it as being too difficult to exploit in practice. We soon pointed out to Seagate and some friendly media that there were hundreds of these exploitable Seagate NAS boxes indexed on Google, including Organizations working in charitable and vulnerable sectors, and that we would be contacting Seagate's customers about the issue.
They still didn't admit that there was an issue, but their next 'firmware' update addresses the issue by requiring a password to run arbitraty commands from the URI. The passwors was the same for all devices and was stored in a plaintext file in the same publicly accessible directory.
We stopped using Seagate products altogether after that experience.
Re:Really? (Score:5, Informative)
Once again, exposing various things directly to the Internet is a Bad Thing.
Indeed it is, but it likely isn't really exposed "directly to the Internet". More likely it runs some service through a Seagate server that makes it available (likely by default, no less). After all, this is designed for home users and how many home users even would know how to modify their router's default rules to expose a specific port on a specific system to the internet?
claiming device owners "have no way to protect their device" is bullshit.
Well, if the first thing it does out of the box is call home to Seagate to give owners remote access to their files through the magical Seagate cloud, then the statement might be pretty darned accurate. These drives most likely default to getting addresses by DHCP on the user's network, and the user most likely gets their outside address by DHCP from their ISP. These hackers likely aren't finding these drives to be exposed directly, but rather to be exposed via Seagate. And considering the (lack of) quality that is Seagate these days, the drives probably have some terrible default password as well that makes it trivially easy for a hacker to get in.
Re: Really? (Score:5, Interesting)
This.
I have one of these devices. The first thing that must be done is to create an account on thw Seagate server. All account creation and password changes go through their server.
The devicw itself is utter crap. Linux OS with an NTFS formatted. The transfer speed using ethernet is comparable to dialup.
Stay away from anything Seagate / NAS. Waste of money.
Re: (Score:2)
Stay away from anything Seagate / NAS. Waste of money.
I bought a Dockstar once... that's a pogoplug :)
Actually a decent little box for Debian, although you really want the Pogoplug V4.
Re: (Score:2)
I have one of these devices. [...]
Linux OS with an NTFS formatted.
The Seagate BlackArmor NAS I have uses ext3, not NTFS.
The transfer speed using ethernet is comparable to dialup.
Two gigE ports, which even allow for bonding. The speed issue isn't with the transfer speed, but using software RAID without enough memory to cache anything.
Re: (Score:1)
Indeed it is, but it likely isn't really exposed "directly to the Internet". More likely it runs some service through a Seagate server that makes it available (likely by default, no less). After all, this is designed for home users and how many home users even would know how to modify their router's default rules to expose a specific port on a specific system to the internet?
You're incorrect. You may wish to read the technical report [sophos.com] covering this issue. -PCP
Re: (Score:3)
Claiming they lose the ability to access the device from a remote location if they turn off the remote access feature is also bullshit. Just VPN in, or enable read-only FTP, or any of a number of other different options.
Re: (Score:3, Informative)
The criminals are in shady and desperate corners of the world and it's unlikely we can do much about them. Control what you can control; though, and don't do known risky things.
Re:Funny how Slashdot users are okay with criminal (Score:5, Interesting)
The criminals are virtually untouchable:
1: They are likely in countries of the world that have zero interest in turning them over for justice. In fact, they may be regarded as folk heroes or equivalents of Robin Hood, taking money from corporations or countries and bringing it to the region.
2: They are likely using employees to do the dirty work, with plenty of anonymity between them and the higher ups.
3: Malware can be traced, and a lot of people suggest origin, but code can be edited and spread anywhere in the world, so code that originally came from Latveria can be used and abused by people from Lower Elbonia, and if distribution is done, the whitehats may never know the real origin.
4: Compromising an endpoint isn't too difficult these days. If someone hacks a wi-fi router and compromises a home computer, all it takes is deleting the offending stuff securely, and that becomes a dead end.
5: For every one criminal, there are others behind them.
6: LEOs have many cases on their hands. It might be doubtful they may have the resources to handle anything but the big names, so chasing after every bad guy would be about as fruitful as chasing every pot smoker in the US.
Going after criminals is nice, but that is a game of whack-a-mole. Unfortunately, computer security is a defensive war, but there are useful tools on the whitehat end which can help mitigate attacks.
Long term, it may not be something is wanted in any shape or form, but I think what may end up happening is that countries themselves will demand control of the routers that go from one nation to another and enforce rules there. China has that, Iran is building it, and other countries are looking into blocking at their virtual borders, just like physical borders. It might be a token thing now, but as time goes on and money is put into it, it may become something all countries have in place, just so another country that has IP ranges that are hotspots for attack are blocked there, so every single Internet entity in the nation wouldn't have to deal with them.
Re: (Score:2)
If we had better encryption, networking tool, smarter academics in the private sector, computer experts working on networking issues like this then we could all sit back, buy with confidence from any big brand.
With better standards the internet community can restore storage options to been useful again and not an open door for any gov or malware attempt.
Re: (Score:2)
Who would you blame if auto manufacturers didn't offer door locks on your car and someone took all your stuff? Or they did put locks on but the key would open all the doors of each model, or even made it where attempting to open the door actually unlocked the door.
I'm sorry, but the manufacturers (not the vendors, Best Buy is a vendor, Seagate is a manufacturer) are responsible for poor/no security on their devices, and until we start holding them legally and financially responsible, breaches like this wo
That's not even the worst part (Score:4, Interesting)
Re: (Score:3, Interesting)
An improved turd is still a turd. Not trusting Seagate... they once had a good reputation, then they bought Maxtor and apparently ditched all the Seagate side of the drive engineering and manufacturing in favor of Maxtor, because that was the exact moment their products went to complete shit.
I have purchased quite a few Seagate drives in the past 6 years, and all of them are now dead - most before they were online for 3 years. The first couple I figured were flukes... and there were always decent deals on S
Comment removed (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
Wrong.
Seagate has dramatically improved the reliability of their drives.
http://arstechnica.com/information-technology/2016/02/hgst-hard-disks-still-super-reliable-seagates-have-greatly-improved/ [arstechnica.com]
Too bad they didn't put that same level of effort into their security model when disallowing the end user to secure a NAS device properly.
Tends to highlight the best practice of inviting Common F. Sense to your design meetings.
Re: (Score:1)
... the HDD is made by Seagate and won't last more than 13 months regardless
I have a Seagate 250GB PATA drive in my MythTV system for the OS and recordings. It was installed in 2007 and has been running 24x7 w/o any issues.
Re: (Score:2)
It is 2016. Who uses mechanical disks anymore?
I own a Seagate drive which still works. Reason being is it is for storage and not booting or running apps. I read files every once and a while for linked folders for my Vm's which never stresses it that keeps it alive.
The only people who use mechanical disks or for storage. Not running apps or booting here in 2016 so I think they are irrelevant
Re: (Score:3)
I've actually been steering people away from WD drives lately. They've started adding very aggressive head parking timeouts to their firmware. So far, I know all their laptop drives and their 3.5" green drives are affected. I'm starting to suspect their 3.5" blue drives are as well. The drive's built-in firmware will park the heads after about 10
BUILD your own NAS (Score:5, Informative)
It is not difficult to setup http://www.freenas.org/ [freenas.org] on a small server machine, and benefit from FreeBSD security with no (known) backdoor accounts. If you're really serious get a proper NAS motherboard with ECC RAM (if you're not using ECC RAM, then it means you're not very serious with your data anyways), which won't cost you more than $500 with the case and the PSU.
Of course if you're unable or unwilling to secure your box, accept that anything on the Internet is wide open, and buy (rent) online storage from Amazon, Box, or somewhere similar. Amazon gives free unlimited backup account with prime (which is around $99)
Re: (Score:2)
SynoLocker.
NAS systems should generally be behind a NAT firewall unless attached to a hardened server, and hardened servers in the DMZ should be kept up to date religiously. If you want to use a NAS remotely, you should VPN into your network.
Re: (Score:2)
SynoLocker is an old issue, with DSM 5.x and 6.x patching it, and future items get autopatched if one turns that on during initial setup (the default is to auto install security patches). It also is wise to not have your internal NAS devices on the Internet (mine have a firewall script that allow incoming from the local segment, outgoing to Synology's patching sites, and blocking all other traffic.) It also is wise to use the Hyper Backup utility to back data up to somewhere (external HDD, cloud provider,
Re: (Score:2)
I agree with you. I have had very good luck with the apps Synology has. The Git app, though bare-bones, is useful. The Hyper Backup function works with many sources (especially with something like Amazon Cloud Drive that provides unlimited storage), the device easily supports 2FA (I just copy my google-authenticator file to /usr/syno/etc/preferences/, and the web server will ask for the Google Authenticator ID. SSH can be locked down as well.)
For a NAS, it is surprising how much stuff the Synology (and
Re:BUILD your own NAS (Score:4, Informative)
Amazon gives free unlimited backup account with prime (which is around $99)
I checked on this because I it sounded too good. Here's what I found.
Your Amazon Prime membership comes with Amazon Prime Photos, unlimited photo storage and 5 GB for videos, music, and other files.
Unlimited backup of any files is $60 a year.
Re: (Score:2)
That depends, there's an incredibly large amount of media that will tolerate a flipped bit. There are a large amount of solutions out there to checksum and recover corrupted data. The odds of an ECC error causing disk corruption are quite low. To be honest there's a lot of things I would look at before thorough out everything just to get some ECC RAM.
Speaking of throwing everything out, no need to go balls out with freenas and dedicated machines. Installing Seattle or owncloud would be a good stop gap for p
Re: (Score:2)
This article [zdnet.com] suggests that ECC should be used more than it is. Since yes, a single bit error won't matter at all to an MP3 or a moviefile, single bit errors can ruin JPEG files pretty easily, or corrupt a Word document. The point is you don't get to choose where the error will occur, so you have to assume it will happen in the worst possible place. There is a reason ZFS systems should have ECC memory [freenas.org].
Re: (Score:2)
The reality is ECC vs non ECC is basically a speed and price point issue for most people. If you're doing something that's absolutely critical and you can't afford the possibility of any type of RAM corruption screwing things over for you, then ECC is the way to go. Anything else? You're looking at easily 1/3 or 1/8th the price(depending on where you live) for non-ECC vs ECC and more capacity. On top of that with speed? Parity checksums within current ram configurations are good enough whether it be fo
Re: (Score:2)
You're looking at easily 1/3 or 1/8th the price(depending on where you live) for non-ECC vs ECC and more capacity.
Where I live ECC costs about 30% more than non-ECC, and with RAM prices being so low these days, this is more than affordable for the extra safety ECC brings.
The bigger issue is with the cost of motherboards and CPUs which support ECC.
Re: (Score:2)
The bigger issue is with the cost of motherboards and CPUs which support ECC.
Not bad on the prices, better then around here. Sad I can remember when ECC support on motherboards and CPU's was pretty much standard. But if you're looking Intel, anything higher then the Haswell architecture supports it and on the AMD side all AM2 and AM3 processors except APU's support it(if I'm remembering right).
Re: (Score:2)
The reasons ZFS should have ECC memory is the same reason as your former line that you "assume the worst". ZFS does not need ECC memory any more than any other file system. The point is that ZFS with it's ultimate of data integrity can only ensure this integrity 100% if you use ECC. This is similar to a swiss cheese model used in industry to prevent an undesirable event. Each is a new mitigation. Only with every mitigation in place do you have perfect coverage, that does not mean that every single person ne
Re: (Score:2)
"won't cost you more than $500 with the case and the PSU."
If drives and your time are free.
"Amazon gives free unlimited backup account with prime (which is around $99)"
If all you have to back up are pictures.
Re: (Score:2)
It's a distro where you pretty well just tick boxes you want and get something that works out the other end. No mucking about with driver disks so in a lot of cases much easier than installing MS Windows.
Other people already put in the time and drives are a lot closer to free than they used to be.
Re: (Score:2)
Not even so much. I think the cost of the last one I build was $50, because I needed a powersupply. Everything else was from componenets which were sitting around, old intel e5300 for the CPU. Free ECC ram from a company going out of business. Bunch of 1T-2TB drives leftover from upgrades, old case laying around. Motherboard had onboard video but it was flaky, so I slapped in an old PCI videocard 20 minutes to setup. Got ambitious a few years ago and picked up a couple of PCI SATA drive controllers th
Re: (Score:2)
Oh, so that's what it means. I thought it meant Internet of Twits.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The currency needs to be viable only for the 5 minutes between mining it and exchanging it. Or, for darknet purchases, for the few minutes between buying it for real money, and buying drugs with it. This is just criminal activity we're talking about - no one cares if the currency will even exist a week from now. If it meets their needs this hour, it's fine. Easier to use online than Tide, after all.
Re: (Score:1)
Yeah because we all know how secure the Cloud is...
Laws (Score:2)
Are there no laws to force electronic manufacturers to fix these devices, in the same way that other manufacturers are forced to fix faults? Cyber security is supposed to be really important now with important people forming important committees and yet insecure devices are being sold, not fixed and not recalled even after manufacturers have been informed of their failings.
It seems rather lopsided when a hacker is sent to jail for poking holes in an insecure voting website but Seagate can just throw their
Reminds me of (Score:1)
TL;DR: jump to Chapter IV
Is it worth of it ?!? (Score:3)