Saint RISK:STATION, Who Commanded the Family NAS

Patron of NAS boxes full of photos, photo-management apps, and everyone who exposes the home disk to the Internet.

Life

On 1 November 2024 Midnight Blue revealed RISK:STATION, an OS command injection in the Synology Photos and BeePhotos apps, the photo managers for Synology NAS devices. A remote attacker could run arbitrary commands without authenticating, taking over the device and every photo stored on it. The researchers brought it to the Pwn2Own contest; the CVSS reached 9.8, and thousands of NAS boxes were reachable from the Internet.

Prayer

O Saint RISK:STATION, who comes in through the family album, let our NAS boxes not face the whole Internet. Amen.

How to celebrate

Celebrated by updating Synology Photos and BeePhotos and taking the NAS off the public network, letting it speak only at home.

Put the home disk in the square and strangers come to browse.