UPDATED 02:14 EDT / SEPTEMBER 08 2015

NEWS

Wireless Seagate hard drives vulnerable to hacking due to open root access

Owners of wireless hard drives made by Seagate Technologies PLC are at risk of being hacked after it was discovered that certain drives were shipped with a vulnerability that delivered hackers easy access.

First discovered by Tangible Security, Inc. last week, the vulnerability is a strange one simply due to the absurd simplicity of it: affected devices are shipped with an undocumented Telnet service that is accessible over the internet by using the default credentials of “root” as the username and a default password.

If that’s not bad enough, the credentials are hard-coded into the device so it’s not simply a matter of owners hitting the control panel of the hard drives and switching it off to fix it.

Given access, an attacker is able to covertly take control of the device, not only compromising the confidentiality of files stored on it but use it as a platform to conduct malicious operations beyond the device.

Even worse, the newly identified vulnerability is one of several for the device, with others including affected device firmware providing unrestricted file download capability and an upload vulnerability that allows others on a shared WiFi network to gain access.

Security researcher Kenn White commented on the vulnerability on Twitter Sunday, writing that “People don’t expect DOD-level security but, Seagate, please stop adding hidden hardcoded root logins to hard drives.”

Are you vulnerable?

The good news is that Seagate has come to the party and provided a firmware update that fixes the issue, however getting users to update their firmware on an external hard drive is another matter.

Affected Seagate devices include:

  • Seagate Wireless Plus Mobile Storage
  • Seagate Wireless Mobile Storage
  • LaCie FUEL

Firmware on the devices affected ranges from 2.2.0.005 and 2.3.0.014, dating to October 2014, however it is noted that other firmware versions may be affected.

“We urge users of these devices, including older and newer models, to download and install the latest firmware updates available from Seagate that address these vulnerabilities, “Tangible Security notes. “Failing to do so exposes those benefiting from the use of these devices to cybercrime risks.”

If you are using a Seagate device that needs to be updated and you’re looking for the new firmware, it can be downloaded here.

Image credit: vector_tf/Flickr/CC by 2.0

A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU