Attackers are taking over NAS devices via SambaCry flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-7494 | Unauthenticated RCE in Samba via malicious shared library upload (SambaCry) CVE-2017-7494, widely known as "SambaCry," is a remote code execution vulnerability (CWE-94, code injection) in Samba versions since 3.5.0, fixed in 4.6.4, 4.5.10, and 4.4.14. A malicious client with write access to a share uploads a shared library to a writable share and then causes the Samba server to load and execute it, giving the attacker code execution on the host with the privileges of the Samba service. Because Samba is bundled with most Linux distributions and with NAS and other embedded devices, both enterprise Linux servers and consumer/small-business NAS appliances are affected; Debian also ships affected Samba packages. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30) with known ransomware use, and public reporting ties it to the SambaCry, CowerSnail, ETERNALSILENCE, and SHELLBIND malware campaigns. EPSS assigns a 99.4% probability of exploitation within 30 days (100th percentile). Do: Upgrade Samba to 4.6.4 or later (4.6.x), 4.5.10 or later (4.5.x), or 4.4.14 or later (4.4.x/earlier), or install updated samba packages from your distribution (e.g., Debian) per vendor instructions, as required by the CISA KEV catalog. Until patched, remove or restrict write access on shares reachable by untrusted clients, and audit writable shares for unexpected shared-library (.so) files that may have been planted by attackers. Prioritize internet-facing Samba servers and NAS devices, given confirmed ransomware and IoT/NAS malware exploitation of this flaw. | 9.8 | 99% | KEV ransomware |
| massOn the order of hundreds of thousands of internet-exposed Samba/SMB servers and NAS devices; millions of installations in total |
Full article335 words · extracted from helpnetsecurity.com · click to collapse
A Samba remote code execution flaw patched in May is being exploited to compromise IoT devices running on different architectures (MIPS, ARM, PowerPC, etc.), Trend Micro researchers warn.
Samba is an open source implementation of the SMB/CIFS networking protocol, which provides Linux/Unix servers with Windows-based file and print services. It runs on most Linux, Unix and Unix-like systems.
Since the public revelation of its existence, the so-called SambaCry vulnerability (CVE-2017-7494) has been misused by attackers mostly to install cryptocurrency mining software on Linux servers. But in this latest campaign, most of the targets are Network Attached Storage (NAS) devices favored by small to medium businesses.
“It is quite easy to find devices that use Samba in Shodan: searching for port 445 with a ‘samba’ string will turn up a viable IP list,” the researchers explained.
“An attacker would then simply need to create a tool that can automatically write malicious files to every IP address on the list. Once they write the files into the public folders, the devices with the SambaCry vulnerability could become ELF_SHELLBIND.A victims.”
The aim of the ELF_SHELLBIND.A Trojan is simply to establish communication with the attackers’ C&C server, grant them access to the compromised device, and provide them with an open command shell in the infected systems so that they can issue any number of system commands and take control of the device.
The researchers have not mentioned what the attackers do with the compromised devices, but you can be sure it’s nothing good.
They posit that the rate of infection might end up being low, as the attackers need to have writable access to a shared location in the target system to deliver the payload, and patches for the vulnerability have been available since May.
“However, Unix or Linux based devices (which comprise most IoT devices) are harder to protect,” they noted. “If Samba is enabled and the manufacturers have not sent out patches, then the devices are vulnerable. Users should proactively update or consult with the specific manufacturers.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2017/07/18/sambacry-flaw-nas-devices/