Abstract

Network Attached Storage (NAS) is a device that makes storage available on a network. It's mainly used for providing centralized and shared storage for digital files. Synology, which is the leader in the small-business and home NAS area, offers a wide range of network-attached storage choice for every occasion.

With the increasing usage of Synology NAS, it's essential to secure these devices because they can contain sensitive information and are often exposed to the Internet.

In this talk, we will introduce the steps to prepare the environment for bug hunting, the protocol used to search the devices in the local area network, the flows to process the requests and so on. Then we will share some vulnerabilities found from both the local attack perspective and the remote attack perspective.