Abstract

Netatalk is a freely-available Open Source AFP fileserver. It is used widely in routers and NAS devices. A UNIX, Linux or BSD system running Netatalk is capable of serving many Macintosh clients simultaneously as an AppleShare file server (AFP).

In Pwn2Own Austin last year, I found many bugs in Netatalk and used them to hack 3 different NAS devices successfully. Moreover, I discovered that Samba also had the same bug pattern as Netatalk.

This attack surface has its unique impact for a reason and we hope this brings a new paradigm to vulnerability research and inspires other security researchers. This talk tries to change this a bit by describing the attack surface and the inner workings. We will give a detailed walkthrough of the different exploits included. We will also discuss the bugs in detail and share our exploitation method.