SmallNetBuilder

Under The Covers

Figure 25 shows the DS-106e's motherboard.

Figure 25: DS-106e Main Board (click image to enlarge)

As shown in the photo, the main processor is a 266 MHz Motorola Freescale MPC8241. The Ethernet support is provided by a Marvell Yukon 88E8001, the SATA controller is a Silicon Image SATALink 3512 and the USB controller is provided by NEC. As for the operating system used in the box, there was little question that the DS-106e was running Linux.

A development group has been around for a while and is working to add additional functionality to the whole line of Synology NAS boxes. There has been a ongoing back-and-forth between the group and Synology. A developer in the group finds a hole that lets them get internal access to the OS, Synology fixes the hole in a firmware update and then the group finds a new hole. Initially the holes found had to do with flaws in the PHP implementation, but then Synology locked that down. At the moment, the current flaw has to do with the way that Synology does firmware updates.

For firmware updates, a privileged process is run to verify the integrity of the firmware image. This privileged process is itself contained in the firmware package that gets uploaded to the device. It was found that it was easy enough to replace this process with an arbitrary script that can do whatever it wants with full privileges. Using this method, I wrote a simple script that enabled the existing telnet daemon and created a new root-level user. Then I packaged this up into a dummy firmware update image and used the standard DS-106e firmware update web page to load it. The update itself "failed" because it wasn't really a firmware image, but before it failed, my script was executed. This execution of my script gave me full command-line access to the box with root privileges.

Poking around the box showed a typical Linux embedded system with heavy use of open source software. The box had 32 M of RAM and it made use of Busybox for utilities. It used Apache for the Web server, Netatalk for Apple file sharing and Samba for the SMB support. The internal drive was divided into three partitions: One ext3 partition for the OS, one ext3 partition for data and one swap partition. Interestingly enough, PostgreSQL was being used in some capacity, so since the box also supports MySQL, that makes two powerful database servers running on the DS-106e. The multimedia capabilities were based on an Intel UPnP Server. For network backups, an rsync daemon was used.