NASLite Network Attached Storage

The SE02 utility distributed with NASLite+ generates pages with the following HTML:



which "phones home" with your license number and MAC address everytime you access the webserver. I reverse engineered the encryption on the SE{0,1,2,3,4,5} utilities to check what other suspicious behaviour is performed, and noticed that one of them creates a root account:



is this a backdoor? what is the corresponding password to this account? why is there no way to disable this account, or change the password? This seems very shady behaviour, I hope there is a reasonable explanation.

btw, that $SELT comes from here:



so everytime you access the web server, your license number, IP address you're accesssing it from, and the MAC Address of the system you're running NAS on is reported home. this is 1984 stuff. Please provide an explanation.

(ps, I hope this isnt something you would do, but just in case, removing this post without explanation will force me to release this information publically so that your customers know what you're doing)

I don't see what the fuss is all about? So what if they have my IP and Mac address?

I trusted Server Elements with My credit card details and have never had a problem with payments made to them. So in turn I trust them with my IP number, Hell they even got it by me using this forum so whats the fuss?

Server elements a front for a hacking group ERM NO.

God half my apps call home one way or another. Far to many other things to worry about then the comments you made.

Eden

and an undocumented root account on your file server. oops.

Sorry, but just because spyware seems to be everywhere these days does not make it okay. Of course, if you dont mind, that's great, but i can guarantee a lot of people will.

I can't comment on the "undocumented root account" This is something for Tony,

But I am not worried one bit by your "Findings".

Most people who have Naslite+ paid for it, they used there credit card details or pay pal etc, so whats more scary them having your credit card details or your ip? Its down to trust, I parted with my cash and never looked back. why should anyone else?

if someone has a "warez" version then its good there IP is logged!

Who is going to warez it for the sake of $20

That's not the point, the point is that everytime you login, everytime you change the computer you're running NAS on server elements knows about it. This is a privacy issue. I dont want the usage of my fileserver tracked, or to be monitored for compliance with their licensing...that's not what i signed up for.

This "if you have nothing to hide, you have nothing to worry about" argument is unacceptable. My privacy is valuable to me, and I despise being tracked. A lot of people agree with me, and while you may take it for granted right now, i guarantee you will miss it if you ever lose it.

I want an explanation, and I suspect a lot of other people will too.

Well it has been warez I have seen it. Infact I helped put a stop to it on ebay. So people will warez no matter of cost, I have even seen FREE apps released as warez!

I think your jumping the gun a bit though Tony the developer has not even commented on these "features" so you might end up with egg on your face.

Hello galps,

Firstly, for the record - NASLITE IS NOT AND DOES NOT INCLUDE SPYWARE!



If your primary concern is whether NASLite is or isn't spyware, you should email Server Elements, Ralph or me privately with your inquiry. We'll respond and answer your question accordingly. By posting copyrighted code to this public forum, you've already devalued NASLite.

Now, I'll make an attempt to answer your questions and hopefuly put your concerns to rest.

There are 2 reasons for the javascript code you see on the top of the Info pages. The first one is to display the latest release. The second is to display an "ILLEGAL COPY" image when a pirated license ID is used. I hope this isn't something you would do, but are you using a pirated license ID?

The root account that the code creates is unnecessary and should have been removed prior to release. You'll also notice that the same code creates the admin, NAS-User and the nobody accounts. Is that also suspicious? If you take a closer look at the code that you decripted, you'll notice that the admin and root users are one and the same in every respect. The admin account is an alias of root and can do all that root can do. In the same way, if you continue examining the code, you'll notice that root can do nothing more than what admin can do.

NASLite does not create a backdoor. It does not provide any facilities for a gateway, so a backdoor is impossible. There is no way to access a NASlite server remotely but only through a LAN. Everyone can access NASLite on the LAN.

I hope the above explanation sheds some light on the code you are looking at. Please keep in mind that NASLite is a licensed, copyrighted product. From a developer's point of view, decripting the code to satisfy your curiosity is understandable. Posting that code to a public forum is unethincal and shows lack of integrity. Please do not publicly post any more of the management code. If you are interested in supporting our work and not disrupting development, my email address is tzt_at_serverelements.com.

Good, but you do collect personally identifiable information and track usage and hardware that your customers use? I dont think this was meant to invade my privacy, but I'm not too happy about it.


That wasnt my intention, as a programmer myself I absolutely respect copyright law. It was a very small extract just to illustrate what I was talking about. Very sorry if you really feel this way.



No, absolutely not. But this could be construed as distrust for your customers, I'm sure the majority of us are honest. And of course the ones who do pirate it already know it's illegal, If your concern is that people could be sold black-market copies unknowingly, perhaps you could add a button like "Is this copy legal?" to the interface.

I dont see any reason why you need my MAC address and serial number to check if an update is available.


No, but it's suspicious that it's a valid working account that has a password. It does concern me that you could have admin access to a file server if you ever visit a LAN That uses your software...and if the password is found out any of the users on my network (okay, the kids ) they could overwrite my settings. but as it's an mistake I suppose it will be corrected next version?

maybe a free update that disables the account could be provided as a security precaution? I expect it's a simple matter of removing the line and rerunning mkisofs.



Absolutely, you do not have to be concerned about this. Thanks for your response.

I bet someone feels rather stupid now! threats of exposing Server elements for something that was untrue!

galps, you should have got your facts staight before posting, like you owe us all something, you don't if you don't like a product don't use it.

Egg in the face of galps!

Nuff Said!

Please explain how I have egg on my face, my claims:

* there is an undocumented root account distributed with NAS.
* NAS phones home with MAC address and serial number.

Please let me know which one or both was incorrect, KTHX!

btw, I like eggs

You have egg on your face because you come to this forum post a bit of code and suggest that there is something we should all really need to know. something so important that

"removing this post without explanation will force me to release this information publically so that your customers know what you're doing)"

As a programmer you will know that not every feature or bug is documented and as pointed out the root and admin are the same so nothing fishy there! So you found it, WOW

And Tony never said Naslite+ phones home or not so I cant comment.

Come on you thought there was more to this and you feel a little stupid.
you thought you discovered something that was nothing. "backdoor"

I think maybe your better putting code together then pulling apart, i'd stick to that.

Pay no attention to the man behind the curtain!!!

Tony says it's not spyware, so it isnt!!!!!!

sorry, but tony has invested interest in not having this product labelled spyware. It clearly fulfils the definition of monitoring users, as it demonstrably phones home and reports on the hardware it's running on, the ip address you are accessing the web interface with and a serial number that can be used to personally identify you.

Tony says it's not a backdoor!!!

wrong again, from Wikipedia:

"A backdoor in a computer system (or a cryptosystem, or even in an algorithm) is a method of bypassing normal authentication or obtaining remote access to a computer, while intended to remain hidden to casual inspection."

and

"A backdoor in a login system could take the form of a hard-coded user and password combination which gives access to the system."

This hardcoded account is clearly an example of a backdoor. This is a serious breach of trust that consumers need ot know about. Just because you're too much of a fanboi or too incompetent to know what this means doesnt mean it's not a big issue.

And this was the result of a cursory examination of some of the components of NASLite, what else would an in depth examination uncover? I will probably be migrating after this, as I have lost confidence in Server Elements. But I still want this stuff to be either fixed, or documented for the benefit of other customers.

Come on, having to go to wikipedia and post quotes.

If you really want a challange try pulling a MS OS apart and am sure you will find plenty of undocumented features and backdoors in there.

Then you could make your findings "PUBLIC"

Are a super hero who is out to protect us, or spyware cop. or just a geek who has nothing better to do.

if you don't like Naslite galps don't use it, This is getting boring now.

http://en.wikipedia.org/wiki/Troll

I am not a fan of splitting hairs galps, so I'll do my best not to. Here are the issues that you claim concern you:

The reason you gave for your concern is:

I don't mean any disrespect by this, but you have got to be kidding. NASLite is an open server. Every file is read/write visible to everyone, so why would anyone want to change the settings? For the purpose of what? What exactly does one have to gain by changing the settings of a NASLite server? Besides, unlike a conventional distribution, all you have to do is pull the floppy out, reboot and reconfigure.

The second issue that you have with NASLite:


NASLite does not "phone home". It has no facilities to do so since it has no concept of a gateway. We established that above. What NASLite does do is to create an encripted string (the code for which now you have made public), containing the ID and MAC. That string is then passed to our server by your browser in a similar way as you would with an HTTP cookie. Is your browser spyware since it hands over referrer, and a host of other info to a server? Disable javascript on your browser and no "phone home" as you put it.

Initial versions of NASLite did not include the facilities to envoke the "ILLEGAL COPY" image from our server. That oversite on our part resulted in thousands of copies being traded on warez sites, Ralph and I answering thousands of support emails by people that obviously did not purchase the software, hardware vendors selling their NAS devices all over the place with pirated copies of NASLite+, etc. The point is that the little image on the top does something very fundamental for us. It allows us development time. Otherwise, both Ralph and I would have to regretfully step back and witness the demise of Server Elements. That will be both unfair to the users that support us and also to the tolerant families we go home to in the evening.

I am really puzzled by your approach galps. You are obviously skilled enough to decrypt the code. As a programmer, you should also be aware that there is a reason why the code is encrypted in the first place. Both Ralph and I know that keys are for honest people. The encryption simply states that the code has an owner and is not for public viewing. As I said in my previous post, I understand the curiosity even though I am not happy about it. You chose a rather distructive way to illustrate what you are talking about and made it so on this public forum

What I am satisfied about is the fact that you acknowledge my concern and will respect the license and copyright.

So let me get this straight,

ip address : they got it when i come here and also when i bought it
serial number: they issued it to me, so i assume they know it belongs to me

mac address: what are they gonna do with that?

Im not getting any of this paranoia unless you've pirated the software.