It used to be that storage systems existed on small, trusted networks with minimal access. Now, with the never-ending expansion of storage systems, multiple administrators, management software "feature bloat" and the co-mingling of non-sensitive and sensitive information on the same storage systems, storage systems have taken on complexities of their own and are proving to be more and more vulnerable to security breaches.
When it comes to testing for vulnerabilities in storage systems (DAS, NAS, and SANs), it's easy to overlook weaknesses that may be obvious to a malicious insider or other attacker. From perimeter security weaknesses to insider advantages, such as knowing just where sensitive storage devices are located, these kinds of hit-or-miss issues will get you every time.
Any storage system that supports typical network protocols and file systems (HTTP, FTP, CIFS, NFS, etc.) will also inherit any vulnerabilities associated with those protocols; likewise for operating system configuration weaknesses, software exploits, password problems, Web applications and more. At a minimum, you should perform the following security tests (a.k.a. ethical hacks) on your storage system to find holes and fix them before someone exploits them. Keep in mind that certain tests will vary (or not apply) depending upon the type of storage system you have and its underlying operating system (OS), as well as the type of network and/or physical access obtained.
- Scan the system to discover open ports, listening services, banner pages, missing patches, Web application and/or database concerns and exploitable weaknesses. Tools you can use for this include:
- Enumerate the system to find available shares, exports, users, security policies and more. Tools and OS commands you can use for this include:
- Attempt to exploit weaknesses discovered in steps 1 and 2 above. Metasploit and its commercial equivalents are great for this. For Web and database vulnerabilities, consider using a href=" http://www.spidynamics.com/products/webinspect/index.html">WebInspect and AppDetective, respectively -- two very powerful commercial tools you can use to dig in deep.
- Go for anonymous access to see if a connection can be made (surprisingly this is all too common on network shares). Commands and tools you can use for this include:
- mount for UNIX/NFS-based systems (i.e., mount –o anon IP:/volume k:)
- net use for Windows/CIFS-based systems (i.e., net use k: \\ip_address\share_name "/u:""")
- Test for ARP spoofing weaknesses to determine if the network switch can be "disabled" and full network visibility can be obtained. Ettercap is a great tool for this.
- Sniff network traffic to discover clear-text usernames and passwords that can be used to further penetrate storage devices. For SAN environments, Fibre Channel, switch and management information can be discovered in clear-text traffic. Tools you can use for this include Ethereal and EtherPeek.
- Modify the World Wide Name (WWN) using the host bus adapter's device driver configuration software to see if WWN zoning controls for SANs can be bypassed.
Given all the variables, the list of available storage hacks could go on and on indefinitely. These should be on your short list, though. Don't forget about physical security either; if you can justify it, it'll likely behoove you to hire someone to perform physical security penetration and social engineering tests to see how your data center can be compromised. It's important not to overlook these weaknesses because once an attacker has physical access to your storage systems, all bets are off.
Also, during your testing or at least once you're done, check the logs of your network and storage-centric security controls such as firewalls, IDSs and access logs to see if anything was discovered and highlighted as a possible security event. Look for port scans, malformed network traffic, intruder lockouts that were tripped, privilege escalations and other security-related issues. This is a time and a good way to verify your security controls are doing what they're supposed to be doing.
About the author: Kevin Beaver is an independent information security consultant, author and speaker with Atlanta-based Principle Logic, LLC. He has more than 18 years of experience in IT and specializes in performing information security assessments. Kevin has written five books including Hacking For Dummies (Wiley), Hacking Wireless Networks For Dummies, and The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He can be reached at kbeaver @ principlelogic.com.
This tip originally appeared on SearchStorage.com.
