6 ms·

I'd assume that every consumer NAS device is insecure these days. I had a Terramaster NAS and was hit with a ransomware attack because of the poor security of t

by starky 3y ago

I'd assume that every consumer NAS device is insecure these days. I had a Terramaster NAS and was hit with a ransomware attack because of the poor security of their OS through a feature I had turned off. It caused me to look into it more and realized that all of the consumer NAS devices have had similar security issues. You are far better off getting cheap hardware and running TrueNAS or Unraid on it as they actually get regular software updates and don't have a history of major security issues.

0x073 3y ago
Terramaster is a cheap young Chinese nas brand. Never had issues with Synology.
- starky 3y ago
  As I said, while that was the brand I had, brands like QNAP and Asustor have also had the exact same issues. These devices are all just examples of poorly supported hardware, where a solution where you control the hardware and software installed on it is far more likely to be supported going forward.
  - syntaxing 3y ago
    QNAP is known to have garbage security though. I personally have a Synology NAS with no internet access (blocked using my firewall)
ajross 3y ago
> You are far better off getting cheap hardware and running TrueNAS or Unraid on it as they actually get regular software updates and don't have a history of major security issues. Unpopular opinion: really you'd be "far better off" using Dropbox or Drive or whatever. By demanding to store your junk yourself you've already walked away from the clearly most robust solution. Obviously this will engender the standard HN freakout about privacy and Big Tech and whatever, and I won't engage. But at the narrow level of robustness and security, the cloud experts are going to do this objectively better than anything under your personal control, probably by more than an order of magnitude.
- derekp7 3y ago
  You are leaving out the other primary reasons for a local NAS -- upload bandwidth, data caps, and special usage scenarios. Not to say that cloud-hosted solutions purely for backup purposes don't have their place, but it is just one component of a 3-2-1 backup policy.
- beeboobaa3 3y ago
  Have you seen how much those services charge for even just 10tb of storage? It's insane.
  - ajross 3y ago
    Looks like $15 a month at Dropbox (it's true that the other providers don't count that high[1] in their standard rates, so you end up having to do it as more expensive overage). Seems like a bargain for not getting backdoored to me. But then I did say it was an unpopular opinion. [1] I do chuckle at the use of "just 10tb". Obviously the real issue here is that these NAS boxes are deployed in service of movie and porn collections that people don't want to leave with a third party. But my point was about reliability and security, not legality or propriety.
    - beeboobaa3 3y ago
      From what I can tell dropbox will charge you E14.50*3=43.5/month (Business plan with a minimum of 3 users) or E522/year for 9TB, but maybe I'm missing something in their pricing? > I do chuckle at the use of "just 10tb" It's 2024. 2TB SSDs can be bought cheaply, and so can 16TB HDDs.
      - IshKebab 3y ago
        Yeah but the fact that you can buy a 10TB disk doesn't mean it's normal to need to store 10TB of data. I think bandwidth is a bigger issue with cloud storage. Most people have terrible upload bandwidth.
        3y ago
Ao7bei3s 3y ago
Unraid is not confidence inspiring either. It's just more commercial closed source software, developed behind closed doors and with a slow update cadence (~3 months). They have made questionable security choices anywhere you can see, and I have strong doubts that their code quality is any better. The PHP scripts certainly are a horrible mess, in all ways. For example, shell injection prevention is based on using escapeshellarg at each call site... that pattern is _exactly_ the structural root cause for vulnerabilities like the one D-Link had. In no particular order, and obviously not exhaustive: Everything runs directly as root - nginx, php-fpm, smb, ... No AppArmor/SELinux. There is no Secure Boot support (especially unfortunate since boot is from USB stick). No HTTPS access to web frontend by default. SMB protocol defaults are insecure. SMB shares default to public. SSH allows password-based root login. Pools are unencrypted at rest by default. They have a checkbox to enable telnet for management! Very permissive iptables rules. Almost any features that real competitors like Synology would officially provide come from third parties via a moderately shady app store. Note it's not about any of these individual points. I see above as signal that they are not security experts and see security as an afterthought, rather than as something that deserves a team of experts that specifically cares about it. (There's certainly other fields they also aren't experts in, like UX - their predominant UI pattern is "list of dropdown fields". Even in storage, one could have a longer discussion how their Array feature - the true core of their product -, compares to modern solutions. There's a reason they've evolved cache pools to just pools as a separate thing, and some users do pool-only Unraid...) That's all quite understandable since it's a small team with only 2-3 coders (https://unraid.net/about https://unraid.net/about). But nevertheless.
- ffsm8 3y ago
  > Everything runs directly as root - nginx, php-fpm, smb, For the record: you need root on Linux to open ports below 1000. By necessity, these programs need at least one thread that runs as root just from that. Can't comment on the rest. As I never used it. Fedora server + cockpit UI was enough for me when I switched from my Synology NAS the other day
  - matthews2 3y ago
    You can drop root after binding, or you can use capabilities to allow a particular program to bind on privileged ports. php-fpm could listen on a UNIX socket instead of a TCP socket.
deleted 3y ago
[deleted]
m463 3y ago
I think people should learn how to configure their network in the first place. - Don't get a cloud router (ever!) - learn about vlans and use them. - never hook a critical device like a NAS to the wider internet
- IYasha 3y ago
  What good is VLAN if an attacker breaks into your router? (non-rhetorical question) He could forge any packets and networks after that. I also have doubts in my separate wire setup (data LAN + management LAN) because any device with both cables attached can potentially be made into a bridge.
IYasha 3y ago
Most likely - ANY (even business-class) device, not limited to storage, is prone to this, unfortunately. Most terrifying of which are routers, mobile phones and home security cams/doorbells/etc. s/NAS/network/

by starky 3y ago

0x073 3y ago

Terramaster is a cheap young Chinese nas brand. Never had issues with Synology.

starky 3y ago
As I said, while that was the brand I had, brands like QNAP and Asustor have also had the exact same issues. These devices are all just examples of poorly supported hardware, where a solution where you control the hardware and software installed on it is far more likely to be supported going forward.
- syntaxing 3y ago
  QNAP is known to have garbage security though. I personally have a Synology NAS with no internet access (blocked using my firewall)

ajross 3y ago

> You are far better off getting cheap hardware and running TrueNAS or Unraid on it as they actually get regular software updates and don't have a history of major security issues. Unpopular opinion: really you'd be "far better off" using Dropbox or Drive or whatever. By demanding to store your junk yourself you've already walked away from the clearly most robust solution. Obviously this will engender the standard HN freakout about privacy and Big Tech and whatever, and I won't engage. But at the narrow level of robustness and security, the cloud experts are going to do this objectively better than anything under your personal control, probably by more than an order of magnitude.

derekp7 3y ago
You are leaving out the other primary reasons for a local NAS -- upload bandwidth, data caps, and special usage scenarios. Not to say that cloud-hosted solutions purely for backup purposes don't have their place, but it is just one component of a 3-2-1 backup policy.
beeboobaa3 3y ago
Have you seen how much those services charge for even just 10tb of storage? It's insane.
- ajross 3y ago
  Looks like $15 a month at Dropbox (it's true that the other providers don't count that high[1] in their standard rates, so you end up having to do it as more expensive overage). Seems like a bargain for not getting backdoored to me. But then I did say it was an unpopular opinion. [1] I do chuckle at the use of "just 10tb". Obviously the real issue here is that these NAS boxes are deployed in service of movie and porn collections that people don't want to leave with a third party. But my point was about reliability and security, not legality or propriety.
  - beeboobaa3 3y ago
    From what I can tell dropbox will charge you E14.50*3=43.5/month (Business plan with a minimum of 3 users) or E522/year for 9TB, but maybe I'm missing something in their pricing? > I do chuckle at the use of "just 10tb" It's 2024. 2TB SSDs can be bought cheaply, and so can 16TB HDDs.
    - IshKebab 3y ago
      Yeah but the fact that you can buy a 10TB disk doesn't mean it's normal to need to store 10TB of data. I think bandwidth is a bigger issue with cloud storage. Most people have terrible upload bandwidth.
      - 3y ago

Ao7bei3s 3y ago

Unraid is not confidence inspiring either. It's just more commercial closed source software, developed behind closed doors and with a slow update cadence (~3 months). They have made questionable security choices anywhere you can see, and I have strong doubts that their code quality is any better. The PHP scripts certainly are a horrible mess, in all ways. For example, shell injection prevention is based on using escapeshellarg at each call site... that pattern is _exactly_ the structural root cause for vulnerabilities like the one D-Link had. In no particular order, and obviously not exhaustive: Everything runs directly as root - nginx, php-fpm, smb, ... No AppArmor/SELinux. There is no Secure Boot support (especially unfortunate since boot is from USB stick). No HTTPS access to web frontend by default. SMB protocol defaults are insecure. SMB shares default to public. SSH allows password-based root login. Pools are unencrypted at rest by default. They have a checkbox to enable telnet for management! Very permissive iptables rules. Almost any features that real competitors like Synology would officially provide come from third parties via a moderately shady app store. Note it's not about any of these individual points. I see above as signal that they are not security experts and see security as an afterthought, rather than as something that deserves a team of experts that specifically cares about it. (There's certainly other fields they also aren't experts in, like UX - their predominant UI pattern is "list of dropdown fields". Even in storage, one could have a longer discussion how their Array feature - the true core of their product -, compares to modern solutions. There's a reason they've evolved cache pools to just pools as a separate thing, and some users do pool-only Unraid...) That's all quite understandable since it's a small team with only 2-3 coders (https://unraid.net/about https://unraid.net/about). But nevertheless.

ffsm8 3y ago
> Everything runs directly as root - nginx, php-fpm, smb, For the record: you need root on Linux to open ports below 1000. By necessity, these programs need at least one thread that runs as root just from that. Can't comment on the rest. As I never used it. Fedora server + cockpit UI was enough for me when I switched from my Synology NAS the other day
- matthews2 3y ago
  You can drop root after binding, or you can use capabilities to allow a particular program to bind on privileged ports. php-fpm could listen on a UNIX socket instead of a TCP socket.

deleted 3y ago

[deleted]

m463 3y ago

I think people should learn how to configure their network in the first place. - Don't get a cloud router (ever!) - learn about vlans and use them. - never hook a critical device like a NAS to the wider internet

IYasha 3y ago
What good is VLAN if an attacker breaks into your router? (non-rhetorical question) He could forge any packets and networks after that. I also have doubts in my separate wire setup (data LAN + management LAN) because any device with both cables attached can potentially be made into a bridge.

IYasha 3y ago

Most likely - ANY (even business-class) device, not limited to storage, is prone to this, unfortunately. Most terrifying of which are routers, mobile phones and home security cams/doorbells/etc. s/NAS/network/