1

I have a Buffalo Linkstation Pro 2 Duo for home use. It has a web GUI for browsing the contents of the NAS (distinct from the admin interface). The idea is that you would expose the web GUI to the outside world and you could share files on the public internet. Internally the NAS is using some kind of LAMP flavor, I think.

What concerns me, though, is that Buffalo hasn't published an update in months (ever?). This would seem to tell me that Apache and all the other software on the NAS is very out-of-date.

Practically, would it be a very bad idea to leave the web GUI open to the outside world? Would the NAS be vulnerable to some kind of exploit? What about for a business?

3

This is a great question and I think your reasoning is sound: Regular updates generally mean the software will have a better security posture. The flip side of that coin is that software that doesn't get regular updates is either perfect (not possible) or neglected. The later is much more likely. So your instincts are working :)

The reputation of the company or open source project providing the software in question is a big factor here as well. This is especially true if the software in question is proprietary as you'll have to trust that the provider knows what they're doing and has good security practices (which includes pushing out regular updates). A quick web search can help you here as you can search for known vulnerabilities in the software you're using.

Use caution though: just because vulnerabilities aren't publicly known doesn't mean there aren't any. This is often just a good indication that the product isn't widely used and that no one is attacking it and publishing their results. What you really want here is a history of vulnerabilities being disclosed and the product being updated in a timely manor (quickly).

Also be sure you know what interfaces you're exposing to the Internet. NAS boxes always support web UIs like you mention but they also have tons of interfaces for 'native' integration with Windows/OSX/Linux systems like CFIS, NFS etc. Exposing interfaces like these to the Internet has different implications ... like NFS having NO built-in authentication!

So to answer your question directly: I'd strongly discourage you from exposing the web UI of a home NAS device like the one you mention to the Internet. I would liken this to exposing the management interface on a server (like ILO / IPMI interfaces) to the Internet and recent history has shown that just a bit of poking can uncover a ton of problems in popular IPMI implementations: http://threatpost.com/ipmi-protocol-bmc-vulnerabilities-expose-thousands-of-servers-to-attack

As always you should balance the risks you're taking in proportion to the data you're protecting. If you don't have anything sensitive on this device and it all gets backed up elsewhere then the implications of a compromise are lower. You can just wipe it and restore if you need to (that is if you even notice that it's been compromised). On the other hand if you're putting sensitive data on this thing (business, personally identifiable information etc) then a compromise will be more damaging to you or your business.

In this situation, IMHO, the "right thing" to do is to set up a good VPN and require all access to the NAS go through the VPN. You can do this with an industrial strength VPN or something as simple as an SSH tunnel and proxy. Personally I do the later and it's sufficient for my needs but YMMV.

Hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.