NAS with a public IP and multiple file sharing services – security concerns

Question

I've ‘inherited’ (it's now my responsibility to take care of it) a WD My Cloud EX2 with a public IP and since it's exposed to the internet, I want to make sure that the data and other machines on the local network are secure.

I've read that certain services are inherently vulnerable because the traffic isn't encrypted and the authentication methods (signing algorithms?) are weak. Unfortunately, I know fairly little about networking, let alone networking security, so please bear with me.

When I run Nmap on the public IP of the NAS from outside the local network, I get the following list of open ports:

21/tcp    open  ftp
80/tcp    open  http
139/tcp   open  netbios-ssn
443/tcp   open  https
445/tcp   open  microsoft-ds
548/tcp   open  afp
3306/tcp  open  mysql
3689/tcp  open  rendezvous
4443/tcp  open  pharos
8080/tcp  open  http-proxy
8181/tcp  open  intermapper

Sure enough, I can connect from OS X via afp, smb, ftp, and who knows what's Windows using when I boot up a W10 virtual machine and choose to map a network drive as \\ip_address\share (netbios-ssn and microsoft-ds are basically smb, right? this legacy MS stuff is completely beyond me) and I see it just as if it were on a local network.

To me, this doesn't seem safe because I don't know how the authentication and encryption works (unlike ssh, for example) and thus I don't have confidence in this implementation.

I believe some of these services should be behind a firewall because they provide a lot of information about the local network and could possibly be used for an attack. However, the question then is how do I ensure the same functionality, i.e. that any user will be able to map a share as a network drive over the internet and work with files as if they were on a local drive.

Again, I believe I should use a VPN to have clients securely connect to the local network and then access the NAS, or possibly at least isolate the NAS from the rest of the local network (DMZ?).

What are the risks of having a NAS with these ports exposed to the internet and what steps should I take to mitigate these risks?

Thank you in advance.

Answer 1

Risks

Every listening port you leave exposed to the internet increases your risk and likelihood of compromise. I doubt that you have a legitimate need for most of those services, and I'd be willing to bet at least one or more of them is vulnerable, misconfigured, or secured with weak or known credentials.

In addition, some of the remote services may not provide the confidentiality you are looking for due to weak or nonexistent encryption. For example, everything that happens over your FTP service will be plaintext and visible to anyone who is able to observe the connection. Modern versions of SAMBA (SMB services on Linux) may be reasonably secure, but it may be possible to downgrade or man in the middle these connections such that the data or credentials can be read.

So, in short, the risks include unauthorized access, passive interception of data, and complete compromise due to exploitation of a vulnerability.

Mitigation

The ideal solution, as you have mentioned, would be to place this device behind a VPN. That way, you would no longer need to worry about exposure of vulnerable services or protocols with poor security. The only concern is administrative; you need to set up a VPN server and manage how clients will access it.

Alternatively, you could configure a firewall between the device and the internet, only allowing the ports that are absolutely necessary for remote access (you certainly don't need remote MySQL access, for instance). This reduces overall attack surface but does not completely eliminate the issues that the VPN would.