If malicious users are able to access the administrator account, they can change the settings of the NAS and install malicious programs. As these management interfaces only require a simple username and password as authentication, attackers can use brute-force method to crack the password to gain access to the system. We discovered that we could discover most of the NAS devices' brands by accessing the devices' default web admin interface.Įxposing the web admin interface, FTP service and Samba service to the Internet causes extreme security risks. Some devices use special communication protocols as an entry point, such as Synology which defaults to TCP on port 5000 and QNAP which uses TCP on 8080. Although the quantity is not relatively large, nonetheless using FTP and Samba services while directly connected to the Internet opens up a wide variety of risks that should not be ignored due to the fact that most devices have a simple login authentication.Īll NAS devices come with a Web Admin Interface. The data shows that NAS devices with FTP services and Samba services enabled were no more than 3% and 2% respectively. We used the commonly employed functionalities/services FTP and Samba and analyzed the number of NAS devices that were connected to the Internet with these services enabled: Internet Small Computer System Interface (iSCSI).Some examples of the functions are listed below: Newer versions of NAS devices have increased functionalities in addition to the major function of sharing files. On the 28th of August, HKCERT selected seven relatively popular small-capacity NAS brands for analysis and discovered 17,459 NAS devices that were connected to the Internet. HKCERT used Shodan to search for relevant data to further analyze the usage of NAS devices on Hong Kong networks. Furthermore broadband and mobile connection speeds are exponentially growing, some users connect their NAS directly to the Internet to make their files accessible from anywhere, while ignoring the risks in the process. NAS are usually installed on a private network (intranet). NAS have also been adopted by enterprises for a long period of time due to its applications in a business setting. With the advance in technology, many users have incorporated NAS decides in their homes to share and disseminate files with their families. Continuing on from where the two previous articles discussing the risks of networked devices left off, this article will focus on the increasingly popular networking device – the network-attached storage (NAS).

Best nas for home backup 2015