Hacker News Reader

Comment by pjc50 | Hacker News Reader

People are somewhat missing the point with the security discussion: the target use case is almost certainly the "home NAS" box, such as the WD "My Cloud" they already sell. You put it entirely inside your firewall and use it to stream media and so on.

Having an open-source version supported by WD is much better than having a random closed-source web UI on your NAS.

View on HN

Yeah, I'm looking at the security discussion with interest and a lot of confusion.

I appreciate that security is important and those that give it up for connivence deserve neither... but I'm at a loss as to why some 'hacker' would go to the effort to sift through the type of content that is typically stored on the average NAS box. Like you said, family photos, birthday videos...

If you're a digital nomad / homeoffice user then yes, your livelyhood depends on something more secure - but that's not the userbase here.

I have rolled my own raspi/owncloud in the past but happily use the WD MyCloud to sync all the devices in my house.

> but I'm at a loss as to why some 'hacker' would go to the effort to sift through the type of content that is typically stored on the average NAS box. Like you said, family photos, birthday videos...

It's not 'some hacker' going through your stuff, it's an automated attack scheme. Your adversary may choose to do something CryptoLocker-like or more stealthy stuff that makes your NAS part of a botnet. Neither option is good.

As others pointed out, it is highly likely that the ownCloud instance ends up publicly accessible, because that's the primary way to access files from the outside.

Thank you. Out of curiosity, can you point me at a significant case cryptolockering of NAS data? I've read windows boxes being hit.

I have nothing on my WD MyCloud that isn't duplicated somewhere else (either it's a backup of google photos/videos, or dupe'd to a USB drive)

Again, a lock is the same as a HD failure to me. Both could happen with this setup. If the information is too valuable to fall prey to either circumstance then the system as implemented the wrong setup.

Now, a botnet is different. I assume one could not run off of the WD box and the Raspi/Owncloud base is too small to target. Unless you can point me at content that indicates otherwise?

> Out of curiosity, can you point me at a significant case cryptolockering of NAS data?

http://www.theinquirer.net/inquirer/news/2358733/synology-na...

> I have nothing on my WD MyCloud that isn't duplicated somewhere else (either it's a backup of google photos/videos, or dupe'd to a USB drive)

It sounds like it doesn't apply to your case, but a potential issue with Dropbox/ownCloud/Google Drive is that the master server can instruct all copy-holders to delete their copies. You should have off-site backups, but I suspect many people don't.

> I assume one could not run off of the WD box and the Raspi/Owncloud base is too small to target.

This is not really an issue - there are multiple router-based botnets as well. You can't really mine bitcoins, but there are tons of other stuff you can do, e.g. DDoS is usually not constrained by the processing power.

Everyone who's not living in a disused nuclear bunker has given up some security for convenience. We have to be a little realistic. But the threat is automated. The only sensible thing to do is keep it off the public-facing internet, and the average home NAT router will achieve that unless configured otherwise.

A home cloud that's accessible outside the home is an interesting promise, but as everyone has said is a risk.

I agree with sibling comment about the threat model being entirely automated, either botnetting or cryptolocker.

I wonder how successful such automated scanning attacks are against a simple login screen though. Does that really have much chance with a reasonably secure project? That then says "don't use self hosting, EVER, for ANYTHING. Get rid of the NAS, too...".

In the past it's been something of a problem against routers: http://www.securitytracker.com/id/1029769

XSS/CSRF is often effective as well: bypass the login screen by using the existing session of a user who's visiting $BADSITE from the same browser as they used to login to their device.

Tragically, for the average nontechnical user, the risk of everything except state attacks and acquishutdowns is lower when using a cloud service than self-hosting.

Reply on news.ycombinator.com