LIVESTREAM: Walkthrough on Running Arbitrary Commands on the ZyXEL NSA325v2

Показать описание

Follow us on:

Website:

Abstract:
ISE Labs’ continuing research into the security of IoT and embedded devices has uncovered vulnerabilities in devices from a broad spectrum of manufacturers. Devices aimed at the small office/home office market often have numerous features designed to be easy to use, but are often lacking in security.
This livestream, hosted by Joshua Meyer, looks at the ZyXEL NSA325v2, a consumer-grade network attached storage (NAS) device. This device is interesting because of a custom command-line language used server-side. We’ll look at this language and how attackers are able to exploit it to run arbitrary commands on the NAS.
Bio:
Joshua Meyer has had a passion for technology since an early age. Growing up in a small town in Maryland, Josh spent a lot of his time learning about different computing concepts. Josh graduated from University of Maryland, Baltimore County with a bachelors degree in computer science and likes to remark that he studied how to write code, but spends his days breaking software. Josh is an Associate Security Analyst at Independent Security Evaluators, a firm of security specialists that provide a wide range of services including custom security assessments and software development.