/dbbroker exploit

Question

3 weeks ago I&nbsp;purchased a Netgear ReadyNAS and moved all my files onto it. &nbsp;This week I tried to turn on "ReadyNAS Replicate" under the Cloud tab in the LAN http interface. &nbsp;There were some user credentials auto-populated in the pop-up box that followed, and the user was "/dbbroker" with the usualy ******** for the pasword.&nbsp;As I didn't recognise this username (and I only have the original 'admin' user and a single ReadyCloud user (which is nothing like 'dbbroker'). &nbsp;I searched the internet and came across a number of pages about a ReadyNAS User Credentials Disclosure exploit called /dbbroker - see this link (or just search Google for "dbbroker readynas" and goto the second link: https://www.exploit-db.com/exploits/37720/&nbsp;I cant find any more details on the exploit and wondered if I should be worried? &nbsp;I was using Chrome, so presuming the details have been auto-populated from Chrome, I cleared the Chrome cache / history.&nbsp;

JennC · Answer

Hello redstamp,

&nbsp;

Is this a brand new sealed ReadyNAS unit? Or a pre-owned one?

&nbsp;

Welcoem to the community!

&nbsp;

Regards,

redstamp · Answer

JennC,Thanks for the welcome.This was a new unit purchased from Scan Computers. &nbsp;One of the drive bays had a faulty spring out of the box, so I was initially concerned it was a pre-used NAS, but the box was sealed with the Netgear tape still, so I convinced myself it was a brand new unit and the spring just came lose during transit. &nbsp;I fixed the spring within 5 mins, so no need to return etc.&nbsp;The firmware wanted updating when I initially plugged it in (1st April 2016), although I forget from and to which versions. &nbsp;And again I updated to the new 6.5.0 on about 20th May 2016.&nbsp;Thanks,Jon

Skywalker · Answer

redstamp wrote:
&nbsp;
I cant find any more details on the exploit and wondered if I should be worried? &nbsp;I was using Chrome, so presuming the details have been auto-populated from Chrome, I cleared the Chrome cache / history.
&nbsp;

&nbsp;
That "exploit"&nbsp;isn't&nbsp;directly related to&nbsp;dbbroker. &nbsp;It's just a generic method of trying to sniff&nbsp;HTTP Basic Auth headers. &nbsp;That can be accomplished by an attacker on your local network if the traffic passes through a hub that the attacker is connected to, or if an attacker is able to launch a successful man-in-the-middle attack, or if the attacker has access to the system from which you log in to the admin interface. &nbsp;To prevent these attacks, just use HTTPS. &nbsp;You can also completely disable HTTP access to the admin UI by going to System -&gt; Settings, then click on the HTTP button, and uncheck "Enable HTTP Admin".

StephenB · Answer

Skywalker wrote: &nbsp;You can also completely disable HTTP access to the admin UI by going to System -&gt; Settings, then click on the HTTP button, and uncheck "Enable HTTP Admin".
Disabling http admin access is a good idea (I actually think it should be disabled by default).

Retired_Member · Answer

The problem with disabling HTTP admin by default is the panic created by the browser WARNING THIS IS UNSECURE CONNECTION, BEWARE, YOU MAY BE GOING TO GET DESTROYED overdone messages warning that the HTTPS certificate isn't signed properly (doesn't match fqdn, etc.).

Forum Discussion

/dbbroker exploit

9 Replies

Related Content

No access to dbbroker.

PDF Exploit

R7000 buffer overflow exploit patch

Netgear Router Exploit - 10/8/2015

Nighthawk Armor detected & blocked exploit an exploit attack on LT SECURITY camera from.....

NETGEAR Academy

ProSupport for Business