Categories: NewsSecurity

Criminals Leverage SambaCry Vulnerability to Gain Backdoor Access to NAS Devices

Computers are no longer the only devices susceptible to attacks. We have seen various types of malware targeting Internet of Things devices in recent months. It now appears that there is a new SambaCry vulnerability, capable of exploiting NAS devices. These devices can easily be backdoored by this exploit.

NAS Devices Are at Risk of Getting Hacked

Many people have a NAS device somewhere at home. These Network Attached Storage devices are often used to store either videos or photos, although some people also use them to keep specific documents safe. Any hardware running older versions of the Samba file-sharing service is now susceptible to the infamous SambaCry vulnerability. Leveraging this exploit allows criminals to install a backdoor Trojan on these Linux devices.

Most people who own a NAS are well aware of how these devices often come equipped with the Samba server software. This is done to provide a convenient solution for file-sharing interoperability. In fact, most people who use a NAS to access photos and videos from their Network Attached Storage device will do so using the Samba protocol. This protocol is especially useful when using devices running different operating systems in order to access information stored on the NAS itself.

This new exploit is called SHELLBIND. It leverages the SambaCry vulnerability, which has been known to the public since late May 2017. SHELLBIND appears to affect all versions of the Samba software released since 2010. Anyone who runs Samba version 3.5.0 or higher can be affected by this exploit. The Samba team is well aware of this problem, and a security patch has been issued to address the vulnerability.

Related Post

Some people may be wondering what criminals hope to gain from leveraging this exploit. It can be used to install cryptocurrency mining software such as the EternalMiner tool, which we have discussed earlier. Additionally, with a backdoor to the NAS device opened on port 61422, there is no limit to the damage criminals could do. They could simply open a remote shell on the infected device, giving them full administrator rights.

The backdoor Trojan is designed to modify existing local firewall settings and open a TCP connection on port 61422. Once SHELLBIND successfully infiltrates a device of its choice, it sends a notification to a centralized server, which could prove to be a fatal point of weakness in the future. This allows criminals to remotely connect to the NAS and have their way with the system. Installing cryptocurrency mining software is just one possible threat.

Security researchers are mainly concerned with how SHELLBIND could be used to steal sensitive information. Even though it mainly targets NAS devices, the malware could be deployed against other IoT devices as well. Although we might never know the full scope of these attacks and what criminals may be after, data theft is still a very likely outcome. Any information obtained from NAS or IoT devices could easily be sold on the darknet, as there will always be interested parties looking to buy personal information.

JP Buntinx

JP Buntinx is a FinTech and Bitcoin enthusiast living in Belgium. His passion for finance and technology made him one of the world's leading freelance Bitcoin writers, and he aims to achieve the same level of respect in the FinTech sector.

Share
Published by
JP Buntinx

Recent Posts

100% Bonus Offer from BlockDAG, INJ Dominates DeFi & ADA Price Stumbles

Whales Make a Splash After BlockDAG's 100% Bonus Offer Goes Live - INJ Ecosystem Boosts…

3 hours ago

Plus Wallet: Top Crypto Wallet for Massive Rewards

Plus Wallet—Where Effortless Crypto Management and Rewards Align Perfectly In the world of cryptocurrency management,…

4 hours ago

Aptos (APT) and Tron (TRX) Prices Slide, As Volume Soars For Rollblock Suggesting Parabolic Rally

As Aptos and Tron prices take a recent downturn, the spotlight shifts to Rollblock, whose…

11 hours ago

Altcoins to Watch in November: Binance Coin (BNB), Rollblock (RBLK), and Neiro (NEIRO)

As the crypto markets roll into their most bullish time of year, we present three…

11 hours ago

Analysts Forecast $1 for Cardano and Lunex Network As Dogwifhat Plunges To Former Lows

As the crypto market prepares for a major rally, experts believe that two top altcoins,…

11 hours ago

Retail Traders Panic Sell During ‘Fake Dip’; Whales Hold Tight to SOL, DTX, and SHIB for a Millionaire-Maker Bull Run

Solana (SOL): A Strong Ecosystem Despite Volatility Solana (SOL) has been all over the place…

12 hours ago