Open Source Cloud Storage Firm Finds Unsettling Number of Unpatched Instances Online

The open source file sharing project scanned the web to find numerous vulnerable and unpatched instances of its software on critical websites.

Christine Hall

October 31, 2017

4 Min Read
Network cables
In this photo illustration, network cables are plugged in a server room on November 10, 2014 in New York City. U.S. President Barack Obama called on the Federal Communications Commission to implement a strict policy of net neutrality and to oppose content providers in restricting bandwith to customersMichael Bocchieri/Getty Images

During a year of data-breach disclosures by the likes of Equifax, Yahoo, and Verizon, you'd think there would be no need for a cautionary tale on the importance of keeping software properly patched. Not so, according to Frank Karlitschek, founder and managing director of Nextcloud. Too many system administrators still aren't getting with the program.

Nextcloud is a German-based startup that began life as an open source file sharing application similar to Dropbox. In the year and a half since the project started as a fork of ownCloud (which was also founded by Karlitschek), its functions have expanded to include online collaboration similar to Office 365 or Google Docs, as well as other features such as messaging and video conferencing.

It's also security focused. Among other features, it comes with a finely-honed permission system and with the next release will feature end-to-end encryption based on best practices such as encryption keys that are never stored on the server.

Businesses like its functions and also that it can be run on-premises. They also like it because it's open source. Companies that don't want a support contract are free to download and install it without cost.

"I have to say, that comes with some responsibility," Karlitschek told Data Center Knowledge. "For example, you have to update the software yourself. You can't just install it and let it run for a few years."

Related:Do CEOs Dream of Timely Software Patches?

That should be obvious, but it seems to be a problem.

Although Karlitschek and his team work to keep Nextcloud free from vulnerabilities, even going so far as to offer a substantial bounty for any reported security hole, as with any software project vulnerabilities are sometimes found that require patching. The trouble with patches, however, is they don't work unless they're installed.

"The only thing we can do is provide a new update, a new patch release, notify all the users, and make it super easy for them to install the patch," Karlitschek said. "But at the end of the day they have to install the patch. If they don't, then that's a problem. Over the years we've made it really easy, with one click or one command line command you can update your instance."

Late last year, Karlitschek and his team decided to investigate to get an idea of the number of vulnerable unpatched versions of Nextcloud that were online. Because the software is freely downloadable by anybody, this required scanning the internet for instances of Nextcloud. When they found one, they would check to see whether it was the latest and greatest secure version or a version with known vulnerabilities.

Related:Equifax Says Unpatched Apache Struts Flaw Behind Massive Security Breach

Not only did they end up finding a disturbingly high number of vulnerable instances, but they found them running on domains where security should be considered critical: sites for large businesses, governments, and other organizations undoubtedly hosting sensitive information. Most concerning to Karlitschek was the inclusion of several German political parties at a time when national elections were on the horizon -- and just after the cybersecurity brouhaha in the US after its last election.

The folks at Nextcloud immediately went to work to rectify the situation.

"We provided a security scanner where you can type in the URL of any Nextcloud/ownCloud instance and see what patches are needed and if you're secure or not," he said. "We also worked together with governments in Germany, and also with Switzerland, Austria, and other countries, where they helped us to contact organizations running vulnerable versions."

Like many vulnerabilities, some holes in unpatched versions of Nextcloud are easily exploited. For example in one case, an authenticated user can gain access to all files using a URL and a simple command. "You can go through it and just increase a number in the URL and you get the first file, and then the second file, and the third file, and all without being authenticated," he said. "That's a pretty big problem."

Another more serious flaw gives a user access to the underlying server. "Not as root," Karlitschek explained, "but if there's a second vulnerability in the operating system, then you might additionally get root permission."

Karlitschek's concern isn't about vulnerabilities in old versions of Nextcloud that have since been patched but about the implications of a large number of unpatched versions of any software facing the internet even though patches are readily available. "There's nothing specific to Nextcloud in the scenario," he said. "The assumption is that it's a problem that is bigger than Nextcloud."

It's not news that updating software or addressing other "minor" security issues is often far down on an admin's to-do list, sometimes due to pressure from management to get more visible work done. There's also the attitude that there's no great urgency, because a flaw in little-known software is unlikely to be exploited.

"When I talk to people about security issues, sometimes I get the impression that they view this as all theoretical," Karlitschek said, "like you have to be a real expert to hack something. Sure, you can also break into my house if you know how to do it, but nobody really knows how to do it, so that's not a real threat.

"This may be the case for some of the less critical security issues out there, but there are critical ones."

About the Author(s)

Christine Hall

Freelance author

Christine Hall has been a journalist since 1971. In 2001 she began writing a weekly consumer computer column and began covering IT full time in 2002, focusing on Linux and open source software. Since 2010 she's published and edited the website FOSS Force. Follow her on Twitter: @BrideOfLinux.

Subscribe to the Data Center Knowledge Newsletter
Get analysis and expert insight on the latest in data center business and technology delivered to your inbox daily.

You May Also Like