Penetration Test Report (Matasano): wp multistore security analysis

NetApp MultiStore:
An Independent Security
Analysis
Prepared By:
Thomas Ptacek and Eric Monti, Matasano Security
EXECUTIVE SUMMARY
In early 2008, Matasano Security conducted an extensive security audit of the NetApp® Data ONTAP® operating system and the
licensed software feature, MultiStore®. At the conclusion of our testing, we found that the Data ONTAP operating system
exceeded our expectations for security. Matasano Security knows of no vulnerabilities in Data ONTAP or MultiStore that would
compromise data integrity in MultiStore virtual storage resources, or the compromise of NetApp FAS Storage Systems.
SYNOPSIS
For several years, Matasano Security has worked with enterprises to assess and mitigate risks in storage networking technology.
We began in 2005, with the discovery of the first published exploitable vulnerability in an iSCSI storage appliance. Since then, we
have worked with clients and their vendors to uncover, mitigate, and resolve storage risks and vulnerabilities. Software security is
what Matasano does, and storage security is a Matasano practice focus.
Early in 2008, our team was offered an opportunity to work directly with NetApp to research the security of their Data ONTAP
operating system and its MultiStore software for secure partitioning of network and storage resources. With complete access to
FAS Storage System technology, a direct line to NetApp technical resources, and free rein to inspect the functional areas of the
Data ONTAP system that we felt were most exposed to attacks, we set about evaluating the security of a leading storage system.
This document describes our efforts and our findings. We constructed a test environment based on a threat model that pitted a
FAS Storage System against a determined, skilled attacker, willing to invest the time to research and develop new vulnerabilities
in a storage system, and given full access to a compromised subnet. At the conclusion of our testing, we found that the Data
ONTAP operating system exceeded our expectations for security. We know of no vulnerability in Data ONTAP that would allow an
attacker to use a FAS Storage System, even if they have a login to a portion of it, to compromise another subnet.
1
INTRODUCTION
About Matasano Security
Matasano Security is an independent evaluator of software security. We take software, appliances, firmware, and services and
assess them for security flaws. Working with the vendors of the affected products, we help ensure that those vulnerabilities are
fixed. Founded in 2005 by David Goldsmith, Jeremy Rauch and Thomas Ptacek, we are one of the leading firms in our field.
This project was conducted by Thomas Ptacek and Eric Monti. Both of us have prior experience with storage technology in
general and with NetApp in particular.
About NetApp MultiStore
NetApp is the leading provider of networked storage for enterprises. NetApp's flagship product is the FAS Storage System, an
appliance that provides access to large arrays of disk storage using storage protocols. FAS Storage Systems typically comprise
the backbone of enterprise storage systems.
MultiStore is a licensed software feature of NetApp Data ONTAP that enables enterprises to deploy a single FAS Storage System
and partition it into independent "virtual storage systems" (vFiler™ units), each serving up a specific set of storage assets, each
administered separately.
MultiStore "virtualizes" storage and network resources by creating multiple IP endpoints for storage clients, differentiating clients
based on which IP they connect to. Each vFiler unit has logically segregated storage, inaccessible to other vFiler units.
About This Assessment
In a “Penetration Test”, a team of security experts is given a target and instructed to simulate the actions of attackers in order to
compromise it. Penetration tests are commonly conducted against networks and web applications in order to test the
effectiveness of security mechanisms. Penetration testers usually rely on security scanning tools such as “Nessus”, or on
libraries of exploits for well-known security flaws, in addition to common-sense testing for weak passwords and configuration
errors.
Our test of the NetApp FAS Storage System was similar to a penetration test, but differed in several important ways. First, we
were testing not for resistance to known vulnerabilities, but rather for the existence of new, previously unknown vulnerabilities.
Furthermore, our testing was conducted inside of storage and management protocols, and in that environment, there are no
commercially-available scanning tools to test for vulnerabilities. Next, we were testing the resilience of the FAS appliance itself,
and not the security of a network deployment with firewalls and access control; in our test, the FAS was exposed directly to
attackers. Finally, as we will describe in the next section, our hypothetical attacker was given unusual access to the target FAS
Storage System.
As a result, where a conventional penetration test would involve running security tools and analyzing the results, our test instead
involved multiple weeks of storage protocol research and software development. For each of the protocols we tested, we
developed new testing tools to attempt to uncover vulnerabilities. Our hypothetical attacker was thus not simply a disgruntled
employee, but rather a team of skilled researchers willing to invest weeks of time to identify and exploit any software vulnerability
in the NetApp storage protocol stack.
The MultiStore Threat Model
Assume a FAS Storage System is deployed with a MultiStore configuration in two environments. First, a high-security environment
that stores customer protected information (PI). Second, a low-security environment for testing, QA, and development.
2
The high-security environment is tightly locked down to a small number of administrators, runs a minimal set of applications, and
is fully patched. None of these steps have been taken in the low-security environment. Individual vFiler units support each
environment, all sharing a single NetApp FAS Storage System.
Now assume the low-security environment is compromised by an attacker, who obtains full access to its vFiler unit. Can the
MultiStore featureset of Data ONTAP protect the customer PI in the high-security environment?
In our threat model, attackers have the following assets:
• An administrative login to a vFiler unit on the
target
• Configured storage and network access to
CIFS, NFS, and iSCSI
• Access to the vFiler unit through SSH and
HTTP management interfaces
Our attackers do not have:
• Access to the core FAS Storage System, above
that provided by the MultiStore feature set.
• Direct network access to the high-security
target environment
• The ability to intercept packets between the
high-security vFiler unit and the servers in the
high-security environment.
In an enterprise security environment, this is an atypically generous scenario for the attacker, who has been granted full access
to a vFiler unit "for free". A typical attacker would not start out with a password to the Data ONTAP CLI, would not have direct
access to a CIFS share on the system, or the ability to bring up an iSCSI session to a LUN on the vFiler unit. Here, we have
assumed the worst-case scenario for an enterprise defending one internal environment from another.
Our attackers win if they:
• Can access files or storage resources provisioned to the high-security vFiler unit from their compromised vFiler unit.
• Can run configuration commands in the high-security vFiler unit.
• Can run configuration commands or access the configuration registry of the core FAS Storage System.
• Can execute and run code in the kernel of Data ONTAP, across all vFiler units.
• Can use the network stack in Data ONTAP to route traffic from the compromised low-security environment to the high-security
environment.
• Can use the network stack in Data ONTAP to route traffic from the compromised low-security environment to