BlackArmor NAS Network Storage Server

[infotek411]

I need the security contact at Seagate to contact me so we can discuss a critical flaw in the security of the Black Armor NAS that allows anyone to download ALL of the usernames and passwords from these Black Armor devices.

Message Edited by infotek411 on 01-31-2010 01:22 AM

[AlanM]

Please PM me the details and I'll see about getting that to the right people.

[infotek411]

AlanM,

  If you work for Seagate, please provide your name title and contact information.  I will only disclose this problem to a Seagate employee responsible for security.  I feel that PM'ing a security disclosure on a web based chat room is unprofessional.

Jason Ellison (infotek) 

[wifi-tom]

any chance on getting the link to the older version of the firmware Seagate?!?!?!?! I would love to get my device working again.

[wifi-tom]

So here is the result of my phone convesation with Seagate:

Q

here are your options sir:

- wait for new firmware - no ETA

or 

- return the device

unQ

Basically they are looking for anyone to blame for the issue. I had my b1220 working just fine yesterday and after the firmware urade to the ba220 everything stopped working. The funny thing is that it stopped working after a restart to the system, but not directly after the firmware upgade but a second time around.

ALSO!!!

There is no way to downgrade the firmware fo the device. Seagate does not provide this as an option. They say it's impossibe, which obviously is bogus.

AND LAST BUT NOT LEAST.

THESE FORUMS ARE NOT FOR SUPPORT, THEY ARE FOR DISCUSSION!! Said by the man on the phone in Seaget US phone support.

[wifi-tom]

http://forums.seagate.com/stx/board/message?board.id=BlackArmorNAS&thread.id=786

look here for solution

[infotek411]

  There is no solution in that post.  The mt-daapd server that Seagate has chosen to implement DLNA and DAAP is broken.  In addition it has known security bugs that have already been publicly disclosed on CVE in 2007.  I believe it would best serve Seagate and Seagate's customers to add Twonky Media Server to the firmware... because it works.  The version of mt-daapd DOES NOT WORK PROPERLY.

The version seagate is using is

"mt-daapd Build svn-1586 (Thu, 17 May 2007)"

These issues were not discovered until Nov 02 2007.

Firefly Media Server Webserver.C Multiple Format String Vulnerabilities 

http://www.securityfocus.com/bid/26310

Firefly Media Server Multiple Null Pointer Dereference Vulnerabilities

http://www.securityfocus.com/bid/26309

If Seagate is actually trying to charge people, as wifi-tom has indicated in the post he referenced, for support on something that they sold broken,  that would border on criminal.

[wifi-tom]

infotek:

the link I posted refers to DLNA. Xbox 360 does not support direct DLNA, only via Mediacenter, as for PS3 i installed firmware 2000.1555 on my wb220 and it cause a LOAD of problems. after a long and completly useless conversation with seagate tech support I found out:

1. there is no security flaw which you claim there is (an believe me I believe you more then them)

2. DLNA is an "open" standard and the problem is caused by the PS3 - even though my ps3 is on fw 3.15 since 02/01/2010 and the only change in my environment is the fw on the ba220 

3. this is not a support form, but a discussion board and I shuld not expect to find answers here

BUT!! after doing some tests I found a solution to DLNA on PS3

1. turn off media service on shares

2. restart

3. turn off media service in main menu

4. restart

5. turn on media service on shares

6. restart.

7. turn on media service on shares

8. restart

and it all came back like it never happened. I get the feeling that I don't have to restart my MS system after a thursday update so  many times

[infotek411]

wifi-tom,

  Could you write me an email describing what Seagate told you concerning the security flaws with the dates that the conversation(s) occurred.   It seems like Seagate is pulling a Toyota.

Jason [Edited: Removed personal information per the community rules and regulations.]

Message Edited by pamelaz on 02-04-2010 07:08 PM

[micro44]

@wifi-tom, there seems to be a typo in your list at #5 or #7. In which order did you turn on shares and main menu?

Did you restart your PS3 as well?

Message Edited by micro44 on 02-21-2010 12:57 PM