NEWS
NEWS
NEWS
Wireless Seagate hard drives vulnerable to hacking due to open root access
Owners of wireless hard drives made by Seagate Technologies PLC are at risk of being hacked after it was discovered that certain drives were shipped with a vulnerability that delivered hackers easy access.
First discovered by Tangible Security, Inc. last week, the vulnerability is a strange one simply due to the absurd simplicity of it: affected devices are shipped with an undocumented Telnet service that is accessible over the internet by using the default credentials of “root” as the username and a default password.
If that’s not bad enough, the credentials are hard-coded into the device so it’s not simply a matter of owners hitting the control panel of the hard drives and switching it off to fix it.
Given access, an attacker is able to covertly take control of the device, not only compromising the confidentiality of files stored on it but use it as a platform to conduct malicious operations beyond the device.
Even worse, the newly identified vulnerability is one of several for the device, with others including affected device firmware providing unrestricted file download capability and an upload vulnerability that allows others on a shared WiFi network to gain access.
Security researcher Kenn White commented on the vulnerability on Twitter Sunday, writing that “People don’t expect DOD-level security but, Seagate, please stop adding hidden hardcoded root logins to hard drives.”
Are you vulnerable?
The good news is that Seagate has come to the party and provided a firmware update that fixes the issue, however getting users to update their firmware on an external hard drive is another matter.
Affected Seagate devices include:
- Seagate Wireless Plus Mobile Storage
- Seagate Wireless Mobile Storage
- LaCie FUEL
Firmware on the devices affected ranges from 2.2.0.005 and 2.3.0.014, dating to October 2014, however it is noted that other firmware versions may be affected.
“We urge users of these devices, including older and newer models, to download and install the latest firmware updates available from Seagate that address these vulnerabilities, “Tangible Security notes. “Failing to do so exposes those benefiting from the use of these devices to cybercrime risks.”
If you are using a Seagate device that needs to be updated and you’re looking for the new firmware, it can be downloaded here.
Image credit: vector_tf/Flickr/CC by 2.0
Since you’re here …
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.
