Search the Community

TLDR: DON'T INSTALL THE SOFTWARE ON YOUR NAS, IT'S A SECURITY NIGHTMARE, DON'T INSTALL ANY SOFTWARE PROVIDED BY YOUR UPS UNLESS YOU REALLY, REALLY TRUST IT I bought a Powercool Smart UPS earlier this year, it arrived with linux software and installation scripts, but I had concerns about just running this on my NAS so elected to try and manually configure it via TrueNAS (I couldn't get it working properly so abandoned that and bought a new Eaton NAS which just works). I've just gone back to look at the Powercool NAS with the intention of getting it set up for my gaming PC and thought I'd check the software out. First thing I did was look at how it was installed, which is as root, no sandboxing, no user for the software (so it's never getting installed) Then I asked copilot to audit it (an actual good use for AI): The summary (full report attached as markdown) is: neokylin/ ├── install.sh 🟡 MEDIUM #4 — deletes/relies on predictable /tmp socket & lockfile paths ├── SECURITY-REVIEW.md (audit report — added by this review) ├── upsSmartView.desktop ─ (launches per-user GUI that talks to root daemon; context for #2) ├── upsSmartView.service 🟠 HIGH #2 — runs upsSmartServer as root, no User=/sandboxing, Restart=always └── upsSmartView/ ├── upsSmartServer 🟠 HIGH #2 — root daemon, system()-executed external program via unauthenticated /tmp socket │ 🟡 MEDIUM #4 — predictable /tmp lockfile (symlink attack) │ 🟡 MEDIUM #6 — writes cleartext SMTP/shutdown passwords to config │ ⚪ LOW #7 — insecure RUNPATH (relative `lib`, /home/zang/… dev path) ├── upsSmartServer.sh 🟠 HIGH #3 — forces LD_LIBRARY_PATH to EOL bundled libs ├── upsSmartView 🔴 CRITICAL #1 — hardcoded FTP update credentials; plaintext-FTP updater, MD5-only integrity │ 🟡 MEDIUM #5 — default password `123456`, weak credential storage in SQLite ├── upsSmartView.sh 🟠 HIGH #3 — forces LD_LIBRARY_PATH to EOL bundled libs ├── copylib.sh ─ ├── cp.sh ─ ├── istartTest ─ ├── snmpTest ─ ├── snmpv3_boot_counter ─ (encoded engine ID only; not a secret) ├── libpng12.so.0 🟠 HIGH #3 — libpng 1.2.54, EOL branch with known CVEs ├── upsevent_ch.wav ─ ├── upsevent_en.wav ─ ├── config/ │ └── IDBK/ │ └── upsSmartView.conf 🟡 MEDIUM #6 — cleartext credentials at rest, world-readable (0644) ├── dep/ (95 bundled libraries) 🟠 HIGH #3 — EOL/vulnerable vendored stack, e.g.: │ ├── libssl.so.1.0.0 🟠 HIGH #3 — OpenSSL 1.0.2v-dev (EOL Dec 2019) │ ├── libcrypto.so.1.0.0 🟠 HIGH #3 — OpenSSL 1.0.2v-dev (EOL Dec 2019) │ ├── libQt5*.so.5 🟠 HIGH #3 — Qt 5.9.8 (EOL) │ ├── libicu*.so.56 🟠 HIGH #3 — ICU 56 (ancient) │ └── … 🟠 HIGH #3 — old libc, libexpat, libgcrypt, libfreetype, etc. ├── lib/ │ ├── libupdateManage.a 🔴 CRITICAL #1 — contains the hardcoded FTP credentials / FTP updater code │ ├── libsnmpClient.so ─ (SNMP attack surface for #3's vulnerable parsers) │ ├── libSnmpManage.a ─ (SNMP attack surface) │ ├── lib<model>*.so ─ (UPS device protocol drivers) │ ├── cJSON/ ─ (leftover vendor build artifacts — CMakeFiles, .o files) │ └── libmodbus/ ─ (leftover vendor build artifacts) ├── platforms/ │ └── libqxcb.so 🟠 HIGH #3 — part of the EOL Qt 5.9.8 runtime └── sqldrivers/ └── libqsqlite.so 🟠 HIGH #3 — part of the EOL Qt 5.9.8 runtime (also where #5's weak-password SQLite DB is accessed) This is would appear to be an intentional developer backdoor/maintenance pipeline left in production code pulling anything from a remote chinese IP and running it on your computer. It would be trivial to push some code to your NAS that not only can execute anything including stealing your data, but also wipe the entire thing (or just wipe any trace of them having been there) SECURITY-REVIEW.md