Command injection and backdoor account in D-Link NAS devices

Original Article ↗ Hacker News Discussion ↗

Overview of the D-Link NAS Vulnerability

  • D-Link NAS devices (e.g., DNS‑320L) contain an unauthenticated GET-based RCE and a passwordless “backdoor” account tied to system users.
  • Authentication appears to rely directly on /etc/passwd users, including system accounts with no passwords, enabling logins that should be locked.
  • Commenters see this as either a de facto backdoor or extreme negligence and incompetence.

“Backdoor” vs Incompetence

  • Some argue “backdoor” implies malicious or intentional vendor access; this case looks more like poor design.
  • Others say “backdoor” just means any secondary access path bypassing normal auth, regardless of intent.
  • There’s debate about whether leaving such debug/service-like accounts enabled in production is distinguishable from a backdoor in practice.

Vendor Practices, EOL, and Firmware

  • Many note that consumer NAS and IoT vendors (especially cheap brands) routinely ship with serious vulnerabilities and stop updates after a few years.
  • D-Link’s DNS-320L was EOL in 2017 with support ended in 2019, yet ~90k devices are still online.
  • Users don’t typically track EOL dates; “plug it in and forget it” is exactly what vendors exploit.
  • Alternative firmwares (e.g., Alt-F) are used by some to extend life and improve security.

Home Network Security Models

  • One camp: firewall with no inbound traffic + VPN for remote access is “good enough” for home users and far more impactful than agonizing over appliance brands.
  • Another camp: assuming a “trusted internal network” is outdated; devices should be hardened as if on hostile networks (TLS/SSH, no auth bypass, minimal services).
  • Discussion of defense-in-depth vs. “secure enclave” thinking: some prioritize securing servers; others prioritize securing the network and treating a compromised LAN client as game over.
  • VLANs, guest Wi-Fi, and isolating IoT are recommended, but feasibility for average users is questioned.

Alternatives: DIY NAS, Routers, and Cloud

  • Many recommend:
    • DIY NAS using TrueNAS/Unraid or generic Linux on cheap hardware.
    • OpenWRT-based routers (e.g., Turris) or Ubiquiti/Mikrotik over consumer gear.
  • Others argue large cloud providers (Dropbox/Drive) are likely far more secure and robust than home NAS, but:
    • Cost at multi‑TB scale, bandwidth limits, and special use cases still make local NAS attractive.
    • Privacy and control remain major reasons to self-host.

Broader IoT Security Concerns

  • IoT devices are repeatedly called the weakest link; used not only for attacks but also as residential proxy nodes in black markets.
  • Some speculate about outsourced firmware and built-in botnets, but details here are left as open concerns, not proven.