Slashdot Mirror
Malware Infects 70% of Seagate Central NAS Drives, Earns $86,400 (softpedia.com)
An anonymous Slashdot reader writes: A new malware family has infected over 70% of all Seagate Central NAS devices connected to the Internet. The malware, named Miner-C or PhotoMiner, uses these hard-drives as an intermediary point to infect connected PCs and install software that mines for the Monero cryptocurrency... The crooks made over $86,000 from Monero mining so far.
The hard drives are easy to infect because Seagate does not allow users to delete or deactivate a certain "shared" folder when the device is exposed to the Internet. Over 5,000 Seagate Central NAS devices are currently infected.
Researchers estimates the malware is now responsible for 2.5% of all mining activity for the Monero cryptocurrency, according to the article. "The quandary is that Seagate Central owners have no way to protect their device. Turning off the remote access NAS feature can prevent the infection, but also means they lose the ability to access the device from a remote location, one of the reasons they purchased the hard drive in the first place."
The hard drives are easy to infect because Seagate does not allow users to delete or deactivate a certain "shared" folder when the device is exposed to the Internet. Over 5,000 Seagate Central NAS devices are currently infected.
Researchers estimates the malware is now responsible for 2.5% of all mining activity for the Monero cryptocurrency, according to the article. "The quandary is that Seagate Central owners have no way to protect their device. Turning off the remote access NAS feature can prevent the infection, but also means they lose the ability to access the device from a remote location, one of the reasons they purchased the hard drive in the first place."
Do not expose IoT devices to the wide and whooly internet. After the init sale most companies do not care.
IoT could be cool but it never will be because of this exact reason. No support after the sale.
Put an un-updatable OS on a harddrive, Brilliant!
Table-ized A.I.
Quoting the summary:
Turning off the remote access NAS feature can prevent the infection, but also means they lose the ability to access the device from a remote location, one of the reasons they purchased the hard drive in the first place.
Once again, exposing various things directly to the Internet is a Bad Thing. Putting such devices into isolated environments and strictly limiting network access to authorized, whitelisted sources is really not that difficult. The device in question is clearly suffering from serious design flaws, but claiming device owners "have no way to protect their device" is bullshit. -PCP
The worst part of the story is that the HDD is made by Seagate and won't last more than 13 months regardless. The users think they bought a good network drive, until they go to retrieve their files and discover the drive has already bought the farm.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
It is not difficult to setup http://www.freenas.org/ on a small server machine, and benefit from FreeBSD security with no (known) backdoor accounts. If you're really serious get a proper NAS motherboard with ECC RAM (if you're not using ECC RAM, then it means you're not very serious with your data anyways), which won't cost you more than $500 with the case and the PSU.
Of course if you're unable or unwilling to secure your box, accept that anything on the Internet is wide open, and buy (rent) online storage from Amazon, Box, or somewhere similar. Amazon gives free unlimited backup account with prime (which is around $99)
The criminals are in shady and desperate corners of the world and it's unlikely we can do much about them. Control what you can control; though, and don't do known risky things.
Table-ized A.I.
What is the number of seconds in a day?
Tha is correct. (applause)
Geek trivia for $200, Alex.
Ahhh, the Internet of Things ... what could possibly go wrong?
Nah, just buy a Synology RAID NAS, just because Seagate are a joke, doesn't mean all vendors are. (QNAP are supposed to be good too, but I've never used it myself).
Why mine a crypto-currency that is nearly two years old? Why not mine something else, what made them choose Monero?
VICTIM BLAMING!!!!!111!!!
Not only are they criminals they're mind-numbingly stupid ones. Ignoring that outside of tech and their drug dealers no one uses any cryptocurrency, who the fuck mines a cryptocurrency nobody has ever heard of? These microcephalic monkeys have "$86,000" of Moneria less whatever some not-so-bright neckbeards have purchased.
Another day another massive Seagate failure. What year is it?
The criminals are virtually untouchable:
1: They are likely in countries of the world that have zero interest in turning them over for justice. In fact, they may be regarded as folk heroes or equivalents of Robin Hood, taking money from corporations or countries and bringing it to the region.
2: They are likely using employees to do the dirty work, with plenty of anonymity between them and the higher ups.
3: Malware can be traced, and a lot of people suggest origin, but code can be edited and spread anywhere in the world, so code that originally came from Latveria can be used and abused by people from Lower Elbonia, and if distribution is done, the whitehats may never know the real origin.
4: Compromising an endpoint isn't too difficult these days. If someone hacks a wi-fi router and compromises a home computer, all it takes is deleting the offending stuff securely, and that becomes a dead end.
5: For every one criminal, there are others behind them.
6: LEOs have many cases on their hands. It might be doubtful they may have the resources to handle anything but the big names, so chasing after every bad guy would be about as fruitful as chasing every pot smoker in the US.
Going after criminals is nice, but that is a game of whack-a-mole. Unfortunately, computer security is a defensive war, but there are useful tools on the whitehat end which can help mitigate attacks.
Long term, it may not be something is wanted in any shape or form, but I think what may end up happening is that countries themselves will demand control of the routers that go from one nation to another and enforce rules there. China has that, Iran is building it, and other countries are looking into blocking at their virtual borders, just like physical borders. It might be a token thing now, but as time goes on and money is put into it, it may become something all countries have in place, just so another country that has IP ranges that are hotspots for attack are blocked there, so every single Internet entity in the nation wouldn't have to deal with them.
5,000 represents 70%? That's hilariously low and not newsworthy..
From the NSA on a HD under EquationDrug or GrayFish https://www.wired.com/2015/02/... (02.22.15) to other strange software getting in...
If we had better encryption, networking tool, smarter academics in the private sector, computer experts working on networking issues like this then we could all sit back, buy with confidence from any big brand.
With better standards the internet community can restore storage options to been useful again and not an open door for any gov or malware attempt.
Domestic spying is now "Benign Information Gathering"
Throw the Seagate in the garbage and buy a Dropbox subscription. Chalk the cost up to a lesson learned about consumer electronics companies and security.
Are there no laws to force electronic manufacturers to fix these devices, in the same way that other manufacturers are forced to fix faults? Cyber security is supposed to be really important now with important people forming important committees and yet insecure devices are being sold, not fixed and not recalled even after manufacturers have been informed of their failings.
It seems rather lopsided when a hacker is sent to jail for poking holes in an insecure voting website but Seagate can just throw their hands in the air and say, hey, these thousands of devices are nothing to do with us now. How many compromised devices are funding terrorism and other criminal activity? Maybe ISIS are mining these coins.
https://blog.filippo.io/so-i-l...
TL;DR: jump to Chapter IV
I've in the last week or so installed a dns-320l by dlink for shared folders and auto backups in my small office. Being available across the internet has it's attractions so I set up a mydlink account to provide access via the web,,,,
Which worked. However after a bit of analysis I found that when accessing the drives remotely I was not using an encrypted channel though the mydlink servers, it was connecting to the drive using my home IP address.
Some sort of handshaking and hand off occurs.
But how did my laptop attach itself to my nas box through the firewall?
When I'm locally attached I can access my box using its local ip on port 80 to acces the webgui.
Lo and behold I can attach to my NAS using port 80 remotely as well using my public ip,
Log in to my router to check it's firewall is set up properley.
There are no exceptions. So no incoming connections are allowed. So why is it not dropping the packets. After much head scratching I found the upnp setting hidden in the menu, on. This is the default on a dgn22000v3 and I wouldn't be surprised if that is true on most consumer routers.
So rather than setting up a ssl channel via the mydlink servers that remote access to tunnels through, it punches it's way through firewalls that have upnp switched on. Very easy to set up, but kind of like sticking your butt out a car window with "spank me" written across your cheeks.
The only way to turn off (as far as I can tell) this is by not giving the NAS the mydlink login data on initial set-up. And just in case turning off upnp on the router (which had I known would not have been on in the first place).
Makes me wonder with all these other Cloud attached NAS boxes whether they are actually doing anything securly at all?
Apart from this, the 50 quid box actually seems rather capable with a bit of hacking. A bit like a rasberry pi of the NAS world.
But caveat emptor....
YMMV.... etc.
I was considering that, after all, they earned (ahem...) up to now "only" 86,400 USD. To do this probably more than one people was involved, so halving as a mininmum the income for each person taking part to the dirty work. Since by doing this these people demonstrated some good programming and organizing skills, why didn't they put their skills for good use working as a consultant or starting a software company ? I know, you have to deal with IRS, balances, maybe PHBs, and all the bureaucracy that affects good companies. On the other side, if you get caught your work is rapidly destroyed, and if identified you get a fine, maybe some jail or probation time, and you are known forever as a bad guy. Is it really worth of it ?
The internet is incompatible with the hierarchical structures of governance. The hierarchical structures of governance will have to be destroyed.
Just cos your insist on a distinction between criminal and businessman, does not make the distinction more real. Its all the same.
Who would you blame if auto manufacturers didn't offer door locks on your car and someone took all your stuff? Or they did put locks on but the key would open all the doors of each model, or even made it where attempting to open the door actually unlocked the door.
I'm sorry, but the manufacturers (not the vendors, Best Buy is a vendor, Seagate is a manufacturer) are responsible for poor/no security on their devices, and until we start holding them legally and financially responsible, breaches like this won't change.
--- Keep the choice with the user..