Japanatron Logo

Netgear ReadyNAS - Disturbing FTP Bug

Details

Netgear ReadyNAS NV+
I have a Netgear ReadyNAS NV+ and have loved everything about it up until now.  I recently enabled password-protected FTP access to 1 share, opened a port in my firewall, and used the

feature to transfer photos from my parent's computer in Los Angeles to my NAS in Tokyo.  It worked wonderfully.

Last weekend I was recabling the USB drive I use to backup the NAS.  I briefly disconnected it and reconnected it.  Unbeknownst to me, this action enabled public FTP access to the backup folder on my USB drive.  All of my private information was fully exposed to the public Internet.  The FTP access was neither password-protected nor even shown as active in the ReadyNAS's web console.
 
Lucky for me, I discovered the situation quickly and remedied it by disabling all FTP access and closing the port on the firewall.  I scoured the NAS's FTP logs checking if anyone had downloaded my information.  No one had.  Whew!  Close call!
 
I checked the ReadyNAS forums looking for anyone who had shared my experience.  Not too surprisingly, someone had: http://www.readynas.com/forum/viewtopic.php?f=23&t=25808

Netgear's response was that the bug will be fixed in a future firmware revision.  Well, at least they're aware of the problem.  Until then I simply don't trust this feature.  No more opening firewall ports for me.

Related Articles

HP Universal Print Driver - Sl...

PROBLEMRecently I switched a number of networked HP printers (Laserjet P4515n) to the universal print driver because the model-specific print driver was crashin...

The Hunt For the Ultimate Free...

I've been a hard-core Untangle fan for several years now, but I recently wanted to explore other firewall options.  Being wrapped around a commercial product, U...

UnRAID - Creating and Mounting...

Here's how to create and mount an encrypted unassigned device in UnRAID. 1) Make sure the unassigned devices plugin is installed in UnRAID. :-) 2) Wipe the de...

Joomla Running on Nginx and Ub...

What follows is an outline I compiled while researching how to tighten security on a Nginx web server. NOTE 1: Ubuntu 14.04 LTS was used for this. NOTE 2: This ...