Slashdot Mirror
Malware Infects 70% of Seagate Central NAS Drives, Earns $86,400 (softpedia.com)
An anonymous Slashdot reader writes: A new malware family has infected over 70% of all Seagate Central NAS devices connected to the Internet. The malware, named Miner-C or PhotoMiner, uses these hard-drives as an intermediary point to infect connected PCs and install software that mines for the Monero cryptocurrency... The crooks made over $86,000 from Monero mining so far.
The hard drives are easy to infect because Seagate does not allow users to delete or deactivate a certain "shared" folder when the device is exposed to the Internet. Over 5,000 Seagate Central NAS devices are currently infected.
Researchers estimates the malware is now responsible for 2.5% of all mining activity for the Monero cryptocurrency, according to the article. "The quandary is that Seagate Central owners have no way to protect their device. Turning off the remote access NAS feature can prevent the infection, but also means they lose the ability to access the device from a remote location, one of the reasons they purchased the hard drive in the first place."
The hard drives are easy to infect because Seagate does not allow users to delete or deactivate a certain "shared" folder when the device is exposed to the Internet. Over 5,000 Seagate Central NAS devices are currently infected.
Researchers estimates the malware is now responsible for 2.5% of all mining activity for the Monero cryptocurrency, according to the article. "The quandary is that Seagate Central owners have no way to protect their device. Turning off the remote access NAS feature can prevent the infection, but also means they lose the ability to access the device from a remote location, one of the reasons they purchased the hard drive in the first place."
It is not difficult to setup http://www.freenas.org/ on a small server machine, and benefit from FreeBSD security with no (known) backdoor accounts. If you're really serious get a proper NAS motherboard with ECC RAM (if you're not using ECC RAM, then it means you're not very serious with your data anyways), which won't cost you more than $500 with the case and the PSU.
Of course if you're unable or unwilling to secure your box, accept that anything on the Internet is wide open, and buy (rent) online storage from Amazon, Box, or somewhere similar. Amazon gives free unlimited backup account with prime (which is around $99)
Once again, exposing various things directly to the Internet is a Bad Thing.
Indeed it is, but it likely isn't really exposed "directly to the Internet". More likely it runs some service through a Seagate server that makes it available (likely by default, no less). After all, this is designed for home users and how many home users even would know how to modify their router's default rules to expose a specific port on a specific system to the internet?
claiming device owners "have no way to protect their device" is bullshit.
Well, if the first thing it does out of the box is call home to Seagate to give owners remote access to their files through the magical Seagate cloud, then the statement might be pretty darned accurate. These drives most likely default to getting addresses by DHCP on the user's network, and the user most likely gets their outside address by DHCP from their ISP. These hackers likely aren't finding these drives to be exposed directly, but rather to be exposed via Seagate. And considering the (lack of) quality that is Seagate these days, the drives probably have some terrible default password as well that makes it trivially easy for a hacker to get in.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
The criminals are in shady and desperate corners of the world and it's unlikely we can do much about them. Control what you can control; though, and don't do known risky things.
Table-ized A.I.
I like my ASRock motherboards, there is a physical switch that makes it boot up from the primary bios or the backup bios. Overwriting the Backup requires intentionally telling the Bios to overwrite the backup. You can flip the switch and make it boot from the backup and it can overrite the primary. You can't screw this up.
Also you can't flash the bios in Windows 10. You can however tell the bios to update the bios over the internet.
Now, why this is relevant. I had a Gigabyte motherboard last time around, it flashed itself to death. Because of issues with the CPU it would occasionally boot up and malfunction, and try to recover by copying the backup to the primary and rebooting. This happened enough times that it eventually bricked itself.
But you're right, the correct mechanism is to make it so that the BIOS/Firmware on a hardware product has a mechanical switch thrown to enable this. I've bricked 2 WRT54G's due to bad firmware, and they could have been salvaged if they had a backup firmware that could be switched to. Certain devices are more susceptible to being damaged, with wireless routers being at the top of the list. All those need to be overwritten is for a rogue access client to tell it to reboot and accept a TFTP firmware most of the time. When I first moved to this city, I found open wireless access points with no password set on the admin panel, I told those devices to update the firmware and then logged back in, set an admin password, then wiped the access log. This was more than 12 years ago.
More to the point however, IPv6 is supposed to give every device a real world ip address, no more NAT bullshit. Unfortunately IoT devices are often setup with no security because otherwise they can't be setup at all.
This reminds me of back in the early days of cable modems before routers were standard, If you connected a Windows XP machine to a cable modem, you were infected with malware within minutes. Not enough time to download any patches. Even with Windows 95 and 98 (remember "back oriface" ?) the kiddies were getting any machine connected to the same ISP infected, or bumping users off that they didn't like, stealing their passwords and so forth.
It's like nobody wanted to learn anything from 20 years ago with this "assume some idiot is going to plug this device right into an internet-facing device" problem that was pretty much everywhere.
For IoT things, the best thing to do is have two firmwares, (oh but that costs a few more pennies) one to boot if DHCP reveals a non-routable ip address (eg 192.168.x.x) and one to boot if ipv4 or ipv6 show routable ip addresses, with the latter making sure that it doesn't have "default" settings like admin/password accounts setup.
There's a culture of insecurity at Seagate's NAS unit.
Some years ago, we (not a security or IT firm) reported some issues with their web interface. Basically there was a public (no authentication needed) PHP script in the directory used to serve the web admin interface which ran arbitrary commands from the URI as wheel. That could be used to reset the admin password, load and run arbitrary code, load an entire hostile OS for the NAS, etc.
Support didn't understand the issue, and security ignored it as being too difficult to exploit in practice. We soon pointed out to Seagate and some friendly media that there were hundreds of these exploitable Seagate NAS boxes indexed on Google, including Organizations working in charitable and vulnerable sectors, and that we would be contacting Seagate's customers about the issue.
They still didn't admit that there was an issue, but their next 'firmware' update addresses the issue by requiring a password to run arbitraty commands from the URI. The passwors was the same for all devices and was stored in a plaintext file in the same publicly accessible directory.
We stopped using Seagate products altogether after that experience.