IDK what DSM is but I know some of you nerds like hacking Synology stuff.
-
IDK what DSM is but I know some of you nerds like hacking Synology stuff.
https://www.synology.com/en-global/security/advisory/Synology_SA_26_13
@cR0w
Synology on September 18:Upgrade to 7.4-90075 or above.
Also Synology on July 24:
We've released Synology DSM 7.4.1-90080 -
IDK what DSM is but I know some of you nerds like hacking Synology stuff.
https://www.synology.com/en-global/security/advisory/Synology_SA_26_13
@cR0w What. *squints* The first one allows _unauthenticated_ attackers to read arbitrary files on a NAS?
I errmm... have questions. -
@cR0w
Synology on September 18:Upgrade to 7.4-90075 or above.
Also Synology on July 24:
We've released Synology DSM 7.4.1-90080 -
@cR0w What. *squints* The first one allows _unauthenticated_ attackers to read arbitrary files on a NAS?
I errmm... have questions.@christopherkunz The
SinNASstands forsecurity.Wait, there is an
SinNAS. Dammit. Well, it certainly doesn't stand forsecurity. -
@christopherkunz The
SinNASstands forsecurity.Wait, there is an
SinNAS. Dammit. Well, it certainly doesn't stand forsecurity.@cR0w @christopherkunz "it's not like anyone will attach this storage to a network."
-
@cR0w What. *squints* The first one allows _unauthenticated_ attackers to read arbitrary files on a NAS?
I errmm... have questions.@christopherkunz @cR0w Unauth reads mean that you get 200% credit for 'availability' and can construct the 'AIA triad'.
And if there are any unauth writes it's 300% credit, you construct the 'AAA' triad and shiftily try to blame DNS. Doesn't work in IPv6 only environments; but what are the odds?
-
@christopherkunz @cR0w Unauth reads mean that you get 200% credit for 'availability' and can construct the 'AIA triad'.
And if there are any unauth writes it's 300% credit, you construct the 'AAA' triad and shiftily try to blame DNS. Doesn't work in IPv6 only environments; but what are the odds?
@fuzzyfuzzyfungus @christopherkunz I believe you mean "AITA" since you're talking about Synology.
-
@christopherkunz The
SinNASstands forsecurity.Wait, there is an
SinNAS. Dammit. Well, it certainly doesn't stand forsecurity.@cR0w The "H" in Synology stands for "Hardened".
-
@cR0w
I can only assume that this is a case of "roll out the update and wait long enough for the masses to install it before telling anyone about the vulnerabilities it fixes" ?
️ -
@cR0w
I can only assume that this is a case of "roll out the update and wait long enough for the masses to install it before telling anyone about the vulnerabilities it fixes" ?️@wdormann I'm glad that's not as common as it used to be but it still frustrates me when vendors do that.
-
@fuzzyfuzzyfungus @christopherkunz I believe you mean "AITA" since you're talking about Synology.
@cR0w @christopherkunz Once they started with the drive-locking nonsense that was no longer a question.
Yeah guys, sell dodgy SMB toys; try to play enterprise SAN pricing games. Hell no.
-
@cR0w @christopherkunz Once they started with the drive-locking nonsense that was no longer a question.
Yeah guys, sell dodgy SMB toys; try to play enterprise SAN pricing games. Hell no.
@fuzzyfuzzyfungus @christopherkunz I don't know much about them but I hear people talk about using them all the time and I occasionally find a random one on a network for what I am sure is totally legit purposes.
-
@fuzzyfuzzyfungus @christopherkunz I don't know much about them but I hear people talk about using them all the time and I occasionally find a random one on a network for what I am sure is totally legit purposes.
@cR0w @fuzzyfuzzyfungus This whole toot could be about a NAS or a Cobalt Strike beacon.
-
@cR0w @fuzzyfuzzyfungus This whole toot could be about a NAS or a Cobalt Strike beacon.
@christopherkunz @fuzzyfuzzyfungus OMG you're right.
-
K kramse@helvede.net shared this topic
