This also means that the very powerful version detection via dynamic analysis was mostly failing. After finishing the testing process EMBA has identified around 50 software components with version details and a lot of other interesting stuff like the used binary protections and weak binary functions.ĭuring our investigation of the results, we realized that most of these results were based on our static analysis module - s09. As EMBA is doing a lot of tests on a firmware this scan took quite a while. The firmware got decrypted and during the deep-extraction a lot of filesystem areas where extracted. On a user installation this is done by the EMBA installer and so the module just needs to execute this binary with the correct set of parameters.Īfter updating everything we were ready for the first run.

The compiled PC1 binary which is needed for the decryption process is placed in the. If the output of this command includes “QNAP encrypted firmware footer, model” then the QNAP decryption module is used. In our case we run Binwalk with the “qnap encrypted” signature in the P02 module for the identification:īinwalk -y “qnap encrypted” “$CHECK_FILE” With the -y parameter Binwalk supports checking only specific signatures. We designed it in a way to identify the QNAP encrypted firmware via Binwalk. We wrote a quick EMBA module for the decryption and everything should be good to go.

After compiling it on a current Kali Linux machine we were able to extract a tgz archive from the update image. In issue 1 also the source code of a working version of the needed PC1 tool was linked. We found the interesting project qnap-utils which should be able to decrypt QNAP firmware images. This means we had to start with some recon work. The bad was, that Binwalk was not able to extract the firmware. Additionally, Binwalk was able to give another hint on it: After some digging and research we identified that the firmware update files from the download site are somehow encrypted.

The initial check on a not extracted firmware is typically the entropy value:Īn entropy value of straight 1 typically means the firmware is compressed or encrypted. After a while we realised that EMBA was running into the deep-extraction mode and finally failed extracting the needed firmware. The firmware was available from the QNAP download site and starting EMBA with the default profile looks like a quick win. While we started investigating the device via the network, we also wanted to use our firmware scanner EMBA for the automated firmware analysis tasks. On one of our last penetration tests we had a QNAP device in front of us.

Qnap check filesystem