Seagate announced the detection and fixing of firmware issues concerning some of its wireless hard drives.
Three hard drives containing the firmware versions 2.2.0.005 and 2.3.0.014, from Oct. 2014, are at risk: Seagate Wireless Plus Mobile Storage, Seagate Wireless Mobile Storage and LaCie FUEL.
As it happens with brands as powerful as Seagate, there is more than one name on the market for each product, which in fact means that the vulnerability circle could be much wider. Other vendors have contracts with Seagate that allow them to sell the hardware under different names. This means that only Seagate can offer a comprehensive list of all named products that are affected.
Here are the dangers:
Malicious use of hard-coded credentials
Description: The firmware of the vulnerable hard drive has Telnet services that can be reached by using factory credentials of 'root' as username and the default password.
What can happen: The device can be discretely controlled by the perpetrator, with impact on both the confidentiality level of the files and the security of the system that the HDD is connected to.
Codes: CVE-2015-2874 and CWE-798.
Direct Request ('Forced Browsing')
Description: The afflicted hard drive firmware gives free file download capacity
What can happen: All the files on the device can be accessed by the perpetrator. For this to happen, hackers must be within range of the affected device's wireless signal.
Codes: CVE-2015-2875 and CWE-425.
Unregulated uploading of files with dangerous type
Description: The affected hard drive firmware offers a file upload possibility to the device's /media/ sda2 file system, which is normally used only for file sharing.
What can happen: attackers still have to be within range of the object's wireless network and can upload random files to it. If those files were to contain malicious software, they may cause damage at endpoints where they are accessed.
Codes: CVE-2015-2876 and CWE-434.
Seagate made firmware updates available, fixing the vulnerabilities.
Users that own these devices, older models included, are encouraged to download and to install the ultimate firmware updates provided by Seagate. Refraining from updating can expose the users of the hard drives and their clients or families to a higher risk of cyber-crime.
Accolades go to Allen Harper, J. Rach and Mike Baucom from Tangible Security, who uncovered essential liabilities in the wireless storage hardware manufactured by Seagate. Tangible Security also salutes Seagate's efforts to improve their products and to keep customers more secure.
