Fordem, for heaven's sake, do you know the difference between physical security and data/network security. Your comparisons are all red herrings.
No one is expecting d-link to provide hardened physical security at this price point. However it is a reasonable expectation for d-link to provide a level of data access security that is comparable to that available on similarly priced (or even cheaper) consumer/SOHO equipment such as cell phones, PDAs and Windows Home -- i.e. that potentially private data is not readily viewable by prying eyes without at least some significant level of effort or physical invasion.
Almost all hardware on the market except perhaps the highest end military-grade gear is always vulnerable if a user can physically access the hardware unless the data itself is encrypted and even then there are almost always physical attacks that will allow you to intercept the data in an unencrypted format provided you have the right equipment.
For that reason, almost all businesses (and to some degree even many home offices) secure their physical servers to some degree. On the other hand, most businesses (and again even many homes) reasonably assume that individual users can be given access to the LAN without giving them unhindered access to private data.
In my simple home setup, I have my linux server and dns-323 in my home office. My kids (or house guests) do not have unfettered access to the office. Even if they were to access my office, I think they would realize that they would be doing something really wrong (and likely get caught) if they started to remove disks and cables from the dns-323.
On the other hand, it is much easier for them to just paste a link in their browser from the privacy of their own rooms. And much easier to morally justify such behaviors since those files are then just hanging out in the open and it probably wouldn't feel to them like "stealing" or invasion of privacy. Heck, there isn't any indication even that the data may be private -- it is like leaving your house wide open with a welcome sign.
As another analogy. If you have your paycheck lying face up in a public area, I might be tempted to look at your salary even though I know it is not my business. On the other hand, I would be far less likely to go to your office and open up your filing cabinets to snoop for your paychecks.
Finally, why go to all the bother of setting up and advertising R/W security if it is meaningless. In fact, it is arguably easier to read a file using the direct url then to have to browse to (or mount) a SAMBA share.
At best this is an embarrassing instance of programming negligence since even the lowest end Windows OS, PDA, or even cell phone has better security.
The reality is that the fix is EASY. We are not asking for NSA-level security and encryption. We are not even asking for current linux (or windows) level security. Just something that puts up the most minimal barrier to prying eyes.
The real issue here now is that D-Link has known about this problem for about 6 months and has not released any fixes. They continue to sell the device advertising R/W user/group access without any disclaimers despite knowing that any (read) protection is purely illusory. If they are really intending just to sell a NAS version of an external hard drive then they should advertise it as such and not include advertising and features that imply even a minimal level of user/group security.
Again, I think the dns-323 is a great product at a great price and I am not asking d-link to invest millions of dollars in the latest spook-level security protection. In summary, I am just pointing out the following points:
- The security hole is severe, pervasive, and easily exploitable without any special tools, knowledge, or access
- There are many potential fixes which are easy, well-know, and would require minimal cost in coding and testing (a rudimentary fix would require only a few lines of code)
- Despite all the above, D-link has done nothing to solve the problem in the field other than to note that they are working on it
If you cannot follow the above logic, then I begin to wonder whether you are a paid shill for d-link or whether you just simply don't understand the nature of the issue, or whether you just like being argumentative.
Author
Topic: Security broken on dns-323 (Read 21226 times)