Slashdot Mirror

← Back to Stories (view on slashdot.org)

Arkeia Network Backup Agent Remote Access

Posted by timothy on from the security-is-for-dead-people dept.

hdm writes "The Metasploit Project has published a security analysis of the Arkeia Network Backup Client. Anyone able to connect to TCP port 617 can gain read/write access to the filesystem of any host running the Arkeia agent software. This appears to be an intentional design decision on the part of the Arkeia developers. A long-winded description of this issue, complete with screen shots, demonstration code, and packet captures can be found in the research article. Arkeia has been credited with being the first commercial backup product for the Linux platform."

7 of 168 comments (clear)

  1. Not a bug; it's a feature? by physicsphairy · · Score: 4, Funny
    "This appears to be an intentional design decision on the part of the Arkeia developers."

    Does this mean that, possibly, they were anticipating people *not* being able to access TCP port 617? I.e. "we trust you know how to properly configure your firewall."

    So far, I can narrow down to either that, them being drunk when they coded this, or this being a case of the improper usage of the word "intentional."

    --
    When things get complex, multiply by the complex conjugate.
  2. from the arkeia site by Dr.Opveter · · Score: 5, Funny
    Arkeia.com

    I was looking for a Client-Server backup system that could offer me the possibility of backing up Unix/Linux and NT Servers on a single tape system.
    After long research my choice went to the Arkeia solution, because it has all the benefits I needed. Since then, it runs like a black box, without any need of additional Service.

    Tom Weber, IT Manager
    RTL TV (Europe)

    The backup system running like a black box might not be a good thing here eh?

    --
    Sample this!
  3. It may have been said before... by caluml · · Score: 5, Funny

    Well, let me be the first to say that I for one welcome our new nmap -sS -PS617 -iR 0 -p 617 -ing overlords.

    --
    Get your own free personal location tracker
  4. Only wimps use tape backup... by ttys00 · · Score: 2, Funny

    ...real men just install Arkeia for their important stuff, and let the rest of the world mirror it :)

  5. Re:Somebody has to say it by Eric+Giguere · · Score: 4, Funny

    if Arkeia Network Backup had been open source software

    Well, it kind of is open source software... install it and it opens up your source (and pretty much anything stored on your computer) to anyone who wants it!

    Eric
    See what headers your browser is sending
  6. Addendum : by da5idnetlimit.com · · Score: 2, Funny

    "Said Linus Torvald, 10 Minutes before a HDD crash made him lose most personal notes, emails, docs and latest kernel modification his cron job didn't get a chance to duplicate..."

    Check it up...

    --
    It takes 40+ muscles to frown, but only four to extend your arm and bitchslap the motherfucker
  7. Re:Somebody has to say it by Epsillon · · Score: 2, Funny

    Well, it kind of is open source software... install it and it opens up your source (and pretty much anything stored on your computer) to anyone who wants it!

    Looks like someone took Linus' quote and ran with it:

    "Only wimps use tape backup. Real men let everyone else mirror their data!"

    --
    Resistance is futile. Reactance buggers it up.