Network Access Storage, or Network Attached Storage, (NAS)

silverdragon
Demi-God

Busters Stunt Double, .. because "Life" is something that happens when your planning something else.

Posts: 19,452

Network Access Storage, or Network Attached Storage, (NAS) Sept 8, 2014 7:38:19 GMT

Quote

Post by silverdragon on Sept 8, 2014 7:38:19 GMT

Network Access Storage (NAS)

If you have NAS, have you set it up right.
Chatter on the security web suggests that many people do not...
If you have set up you NAS drive as available to anyone on the network, GET SOME SECURITY....

If you Network drive is secure, all I would have to do is find out what the MAC address of that drive is.
And I can do that by simply looking at the EXIF data on any photograph you "Share" on the web by any web hosting service..........

Then all I have to do is type in the web numbers, say 255.255.255.1 for example, (That wont take you anywhere?..) and I have access to YOUR drive.

Scared yet?...
Good.
This board is here to inform you.

On my own system, the NAS is configured to only accept MAC addresses from known computers.
And then I have some simple security that makes sure the User has "Signed in" .....
Google BAS security for more details.

Its quite simple to set up, can involve a few moments configuring each attached machine, but can save you a LOT of problems....

-x-clacks-GNU Terry Pratchett----Release the Clan Mac Feegle, awae hame ye scunners.[p]Most of my Job is avoiding Stupid. ...You cant Fix Stupid. Especially when you turn Left at Hammerhead.

memeengine
Junior Member

Posts: 207

Network Access Storage, or Network Attached Storage, (NAS) Sept 8, 2014 17:34:49 GMT

Quote

Post by memeengine on Sept 8, 2014 17:34:49 GMT

Sept 8, 2014 7:38:19 GMT silverdragon said:

If you Network drive is secure, all I would have to do is find out what the MAC address of that drive is.
And I can do that by simply looking at the EXIF data on any photograph you "Share" on the web by any web hosting service..........

As there isn't an Exif tag that relates to a MAC address, I can't really see you being able to do that. The Exif data is usually created by the camera, so even if it did contain a MAC address, the address would be that of the camera (or rather its network card) and not of the network device on which the photo was subsequently stored.

Also a MAC address by itself isn't much use. It's actually a unique identifier for the device's NIC which is used at a LAN level. The internet doesn't route using MAC addresses, so knowing someone's MAC address is only useful if you're already on their LAN.

Sept 8, 2014 7:38:19 GMT silverdragon said:

On my own system, the NAS is configured to only accept MAC addresses from known computers.

If the hacker has managed to bypass your router's security and NAT to get access to your LAN, the chances are high that they'll have the MAC spoofing tools to let them simply bypass that protection too.

Anyway, the real security issue with home NAS setups is with devices which present a public web interface (aka "personal cloud"/"private cloud"). If they're misconfigured then they can allow anonymous access to the device and all of the stored data on shared drives is available to anyone that visits.

However, poor security configuration is not just an issue which affects NAS devices, the same is true for any network attached device.

silverdragon
Demi-God

Busters Stunt Double, .. because "Life" is something that happens when your planning something else.

Posts: 19,452

Network Access Storage, or Network Attached Storage, (NAS) Sept 9, 2014 8:38:55 GMT

Quote

Post by silverdragon on Sept 9, 2014 8:38:55 GMT

I have a program called Inspect Elements, this program will, when asked to, look at the data supplied from any web picture, and give me the exact home "Address" of where it was originally stored.
That is just one tool available.
I can go back further.
I can, and I wont say how, identify where it was uploaded from.
I wont say how because that would explain how to hack, and I wont be doing that on here.

I am trying to keep the information "Simples" here because this is an open forum, anyone can read, and I dont really want to give exact details on how I can identify certain things that perhaps with better security "Someone" would not want me to know?....

I am sure most people reading will either have, or be now getting, some better security.
That is the plan...
Not to question the how to do, but to encourage the how to stop....

How do I know this stuff?... because I need to.
Why?...
Because I beta test for Internet Security products....
I use my "Tools" to test other peoples products and make sure they cant be hacked by any but the most determined hacker.

Spoofing home MAC address once on the lan....
If you have not set passwords, then you are open to that type of attack.

Each computer on my LAN had been "Approved", if you try a new device, it will be rejected, until it allowed, and then, to get to storage, you must input the password details....
There is simple password protection on any folder via the details.
You can make the folder "Private", so only you the user can use them.
Otherwise, learn more via google.....

-x-clacks-GNU Terry Pratchett----Release the Clan Mac Feegle, awae hame ye scunners.[p]Most of my Job is avoiding Stupid. ...You cant Fix Stupid. Especially when you turn Left at Hammerhead.

memeengine
Junior Member

Posts: 207

Network Access Storage, or Network Attached Storage, (NAS) Sept 9, 2014 21:11:49 GMT

Quote

Post by memeengine on Sept 9, 2014 21:11:49 GMT

Sept 9, 2014 8:38:55 GMT silverdragon said:

I have a program called Inspect Elements, this program will, when asked to, look at the data supplied from any web picture, and give me the exact home "Address" of where it was originally stored.

Almost every modern browser and web debugging tool has an "inspect element" feature. All they will show you is the IMG tag's SRC attribute and that simply gives the current web host for the picture, it's not going to give you the 'exact home "Address" of where it was originally stored' because that information isn't stored with the image. Even if the uploader's public IP was stored with the picture, you'd still be in the dark in most cases because the uploader is most likely on a private subnet (which could contain hundreds of devices) which their router NATs to a public IP. As a further complication, a lot of domestic accounts have dynamic public IP addresses, so you can't guarantee a public IP address that you obtained yesterday would point to the same device or network today.

silverdragon
Demi-God

Busters Stunt Double, .. because "Life" is something that happens when your planning something else.

Posts: 19,452

Network Access Storage, or Network Attached Storage, (NAS) Sept 10, 2014 6:13:45 GMT

Quote

Post by silverdragon on Sept 10, 2014 6:13:45 GMT

To retort to your post would give too much information on how to collect the required information.
May I suggest you do not continue on this line, but, accept, there ARE people out there who CAN track your internet usage, trace you, and collect data of your own personal LAN...

You may not believe that they can do this.

However, for those who follow technical news, they will be aware that they actually CAN.

If you wish to call Bogus on my initial alert post, please go ahead.
That is your right.
Bear in mind its easily available news that I can post to back up the reasons why I call attention to it.
www.bbc.co.uk/news/technology-28707117

I may know a little more than is available by that actual article, or a LOT more, posting the exact methods in use on here would be stupid at least, dangerous at worst, we do not know who is watching, and to what use they may put the information.

As much as anyone tries to draw me, I will not in any way be pulled into arguing my point by posting exact methods of how I bloody well can watch (Say for instance) your facebook page for your next update and immediately find what IP address you just used.....

And that is freely available information on how these people target their intended victims.

Enough of the petty pedantics on how its actually done, its done, and if you do not wish to check your security, fine, just dont doubt that other people NEED to check their security?...

All Network Access Storage, Network attached storage, CAN be accessed by an outside hacker if they know which address to put into the browser bar.

There is a reason why Router manufacturers have set security that only a physical wired connection to your router can open its home page of 192.168.0.1 or 192.168.2.1......
The reason?...
SECURITY.
If it was available to anyone on the network, you could easily be hacked.
That is why you are invited to put in or change the default user ADMIN and password CHANGEME the first time you use it.

So that is the address of your router, again, freely available information for two of the most popular addresses for routers, how hard can it be to run a simple incremental number changer to check all other available addresses on your network to see which other ones are "Valid".
Again, freely available information on how you can get hacked.

Believe me, that is a simple for I = 1 to 10 basic command program....
Hackers are a LOT more sophisticated than that.

I can not argue further without giving away much more technical details.
Please do not argue against what I am saying, do not shoot the messenger, read the article, and beware.

-x-clacks-GNU Terry Pratchett----Release the Clan Mac Feegle, awae hame ye scunners.[p]Most of my Job is avoiding Stupid. ...You cant Fix Stupid. Especially when you turn Left at Hammerhead.