A Pain in the NAS: Exploiting Cloud Connectivity to PWN Your NAS

Have you ever wondered how you can access your family pictures on your home network-attached storage (NAS) device remotely from your mobile? Do you know how this magic works? At Pwn2Own Toronto 2022, we chained multiple bugs to exploit both Synology and Western Digital NAS devices by abusing vulnerabilities in the device, cloud and the mutual trust between them.

In our research, we reviewed the pairing mechanism of NAS devices with the WD and Synology cloud platforms...

By: Sharon Brizinov …

abusing access bugs cloud connectivity device devices digital exploit exploiting family home home network magic mobile nas network network-attached storage pictures pwn2own pwn2own toronto 2022 storage synology toronto western western digital