Like every other website on the planet, SmallNetBuilder uses cookies. Our cookies track login status, but we only allow admins to log in anyway, so those don't apply to you. Any other cookies you pick up during your visit come from advertisers, which we don't control.
If you continue to use the site, you agree to tolerate our use of cookies. Thank you!

Wi-Fi Router Charts

Click for Wi-Fi Router Charts

Mesh System Charts

Click for Wi-Fi Mesh System Charts

Under the Covers

Normally I like to take these devices apart to see what chips they're using, but this one thwarted me. Instead of using standard bolts in the construction, Promise used some of those odd star-headed (Torx) bolts that manufacturers like to use when they don't want you inside their device. I didn't have anything on hand to unscrew these bolts, so I needed to take a different approach to see what was in use.

As for the processor, Promise documents it as a highly integrated Freescale MPC8343 processor that includes Ethernet and USB support. Software-wise, it's clear that internally this unit runs Linux. Promise references the GPL license in their documentation and provides a download site for the required source code.

To find out more about the internals of the device I started poking around. A port-scan turned up the fact that a telnet server was running on a non-standard port of 2380. I could connect to the server, but none of the users that I created were allowed to log in. But a quick "Google" for more info turned up a bug report from September that indicated that there was an error in the way that Promise was validating input, specifically for changing user passwords.

Like many of these devices, an assumption was made that parameter validation would be done by JavaScript in the browser. This assumption doesn't hold water since it's easy to intercept and modify the input that is being sent to the device by using an argument-modifying web proxy.

Once I set this up, I used the standard forms to change a user password, but when the proxy intercepted the data, I modified the username parameter to be "root", the "super user" on Unix/Linux systems. When this was done, I was successfully able to telnet to the SmartStor, log in and start exploring. Note that the technique I used to get into the device required me to have the administrator's password initially, so this was not a wide-open vulnerability that anyone could exploit.

By poking around I could see the standard set of utilities such as BusyBox, Samba, etc. The MPC8343 processor was running at 400 MHz. The Ethernet capabilities were identified as being provided via a Gianfar driver. The SmartStor had 128 MB of RAM, the Linux kernel was a 2.6.11 variation, the DLNA/UPnP support was provided by FUPPES and the web server in use was thttpd.

I also noticed the presence of rsync on the SmartStor, which may indicate that this is the utility used to back one SmartStor up to another.

Closing Thoughts

Overall, the SmartStor had a decent feature set. I appreciated the multi-platform protocol support and its RAID capabilities. The SmartStor didn't have as many services as other four-drive devices such as the Synology line. But for use as a standard file server, its feature set was adequate. And at a street price as low as $390, the SmartStor is quite a bit cheaper than most. Then again, the higher-end devices are also better performers than the SmartStor, so you're trading cost for performance and fewer features.

Comparing the SmartStor to the Iomega StorCenter Pro 150d shows a similar feature set and comparable performance—which is not surprising since they have similar hardware. But a price comparison between the two is difficult since the Iomega unit doesn't come in a BYOD configuration.

As far as physical construction of the SmartStor, I would have preferred to have a better constructed case, and the noise level was too high for my tastes. I was able to get a command-line on the device, but it would be better if this were a supported feature. When I trust my data to a device, I want full access in case something goes wrong.

The RAID rebuild time also seemed excessive to me, and I was also a bit disappointed that the email alert feature didn't work. With this much data at stake, problem notification is important.

If I were in the market for a four-drive RAID NAS, I think I'd spend the extra money and go with something like one of the higher-end Synology devices. But if you're on a limited budget and want only basic functionality in a RAID 5 capable NAS, the SmartStor might be worth a look.

Support Us!

If you like what we do and want to thank us, just buy something on Amazon. We'll get a small commission on anything you buy. Thanks!

Don't Miss These

  • 1
  • 2