13 ms·
My Synology NAS has been hacked by ransomware calling itself Synolocker
- junto 12y agoAs a first response, stop the port forwarding on your router. Then wait for more info from Synology. I generally don't connect mine to the internet (inbound). I don't like the risks involved.
- hjuutilainen 12y agoOne forum post mentions this too: http://forum.synology.com/enu/viewtopic.php?f=3&t=88716 http://forum.synology.com/enu/viewtopic.php?f=3&t=88716
- mschuster91 12y agoI'm waiting for this bullshit to appear on ordinary routers...
- mkhalil 12y agoThey wouldn't really have anything to hold ransom. Router's usually have hardware reset switches in the back too. Not saying it's not possible, but little to gain by holding it randsom. If they hacked the router, they'd be doing the kind of things they WON'T inform you about, like man in the middle attacks stealing everything from all your user/passwords to credit/bank/personal info.
- mschuster91 12y agoWell, the reset switch usually causes the bootloader to reformat the volatile partition of the flash. But there's nothing to stop an attacker from rewriting the "write protected" areas like e.g. a firmware update does. Consider that many routers these days come with NAS or MediaServer functionality... and thus are a valid target for hackers. Furthermore, they are often directly connected to the Internet, and there have been numerous remote-root exploits for cheap chinese knock-offs as well as for highly praised manufacturers like AVM.
- munin 12y agoso they hold your router hostage. then what? you buy another one. whatever.
- meowface 12y agoAgain, the dangerous part isn't holding it hostage, it's what they can do to it without you noticing. They can intercept all your network traffic, redirect websites you visit to a server they control, etc.
- nitrogen 12y agoIf you have a hard drive plugged into your router, they can perform the same crypto-lock attack being discussed here. They can also use your router to launch attacks against the rest of your hardware.
- ejr 12y agoIf modern routers are delegated to router duty only, this wouldn't be a problem. However, routers these days are for all intents and purposes, specialised home servers with shared media streaming and the like as well. These are value-added functionalities ISPs use to entice new users and I'm sure a fair number of them use these to store photos, connect their USB drives - mine is also a print server for use with non-wifi network printers.
- BrandonM 12y ago> like man in the middle attacks stealing everything from all your user/passwords to credit/bank/personal info. If you're logging in or sending financial data over unsecure (non-SSL) connections, you already have a problem.
- MertsA 12y agoSSL Strip still works and banks don't care about anything other than providing the illusion of security and standard SSL. Take for example an old lady down the road who somehow got some futuristic malware on her router. She goes to Bing to search for Wells Fargo to do some online banking (and you know that there is a huge portion of users who only browse the web this way). Hypothetical malware then just runs SSLStrip over the page from bing.com which isn't served over ssl because Microsoft values their bottom line over your privacy and security, which then replaces the link to the https site with http, the router acts as a proxy between http and https so wellsfargo.com is none the wiser. Evil hacker now has poor old lady's password and transfers the money in her account to his own foreign bank account. This hypothetical scenario is doable even running off of a slow router while not using many more resources than the parental keyword filtering uses. At no point does SSL ever come into play and the top 4 Banks in America (Chase, Citibank, Bank of America, Wells Fargo) don't use HSTS so there's no real way to protect their users from SSLStrip unless a browser includes them in some force SSL list.
- phlo 12y ago> SSL Strip still works and banks don't care about anything other than providing the illusion of security and standard SSL. Speaking as a security officer for a (non-US) bank, this is not true. We use EV certificates (to increase visibility vs. standard certs), deployed HSTS over a year ago on most of our propierties, force HTTPS and pin keys wherever we can (i.e. mobile apps). And even if a session is compromised: transactions are screened and verified before execution. Yes, our chief concern remains the bottom line. Pushing for more trust increases our user base. Fighting fraud avoids compensation payments. Building awareness and implementing technical measures aids both of these goals, so we get to spend a reasonable amount on both.
- Scoundreller 12y agoDoes someone have the expertise to set up a Synology OS or DDWRT as some type of virtual machine, run it as a honeypot, and do daily/hourly high-level tests for compromise?
- jontro 12y agoIt would be very interesting to know how this happened, I guess this is the downside of using wide spread products.
- elorant 12y agoUsually these types of machines have a web interface so that you can connect to your backups remotely. Once you plug it into a router or a home network it sits there waiting for someone to log-in. And as the saying goes, anything that’s connected to the Internet will eventually be hacked. Either it was misconfigured or there is an exploit in the wild.
- ksec 12y agoI was just about to post something similar. Although I was lucky not to have the Cryptolocker or Synolocker. My syslog shows a few people have accessed my NAS this month. This is worrying.
- yoodenvranx 12y agoWas it directly connected to the internet? Do you know how they got access? I am now worrying about my synology, but I am away from home for the next few days.
- ksec 12y agoIt was behind my router. My quick scan on log from 2011 shows i had no such problem, until recent months when they started to attack on Synology and turning them into Bitcoin miner.
- pwelch 12y agoSo there were no open ports being forwarded to the Synology NAS?
- huhtenberg 12y agoIt probably UPnP'ed itself out. (Edit) Or it might've been checking for updates, got redirected elsewhere via a DNS hijack, downloaded something funny, didn't bother to check if it's authentic and installed it.
- OWaz 12y agoHow do you think they accessed your NAS?
- AmVess 12y agoReally, there aren't that many ways to gain access. Two primary and likely methods: 1) Weak passcode. 2) Security exploit in DSM. The fixes are easy; better passcode, and turn off remote access to the device until whatever flaw(s) can be patched.
- deleted 12y ago[deleted]
- jkelsey 12y agoYou do realize that the NSA and it's ilk are military organizations, right? We're (supposed to be) a nation of laws with due process: it's extremely worrisome to a free and open society to have the military go after criminals. That should be handled by law enforcement and the judicial system. You know what would actually be useful though, since we're talking about taxpayers reaping benefits from the government? How about a non-military government agency that does computer security research, but instead of hoarding all the exploits, they share them with the public through well-financed and organized open source projects?
- deleted 12y ago[deleted]
- jkelsey 12y agoLet's get this straight. Can your position be correctly defined as: Blackhats are accused of breaking the law, therefore, they are not entitled to due process and legal representation in court? In addition, the military is allowed to make a hostile response with any offensive network resources they have available?
- deleted 12y ago[deleted]
- tdicola 12y agoIt's not really the NSA's jurisdiction to handle crimes like this. You're better off contacting the FBI, however it's probably wayyyy down on their list of stuff to worry about.
- dm2 12y agoThey do have a Cyber Most Wanted list: http://www.fbi.gov/wanted/cyber http://www.fbi.gov/wanted/cyber
- antr 12y agoWow, I was just about to buy a Synology this coming week and now I have second thoughts. Now more than ever I'm certain that having only Drobo/Synology is not a good backup solution, but having a backup of the backup is equally important.
- the_ancient 12y ago1. Never expose it to the internet... Use a VPN if you have to access from outside your network. Most home routers support vpn;s so there is no reason not to 2. You should always have 3 copies of data, 1 working, 1 local back and 1 geo diverse backup (i.e a spideroak, crashplan, or even a friends house) Most people forget the 3rd but what happens if your house burns down? 3. You should have a completely cold backup of important data, this could be a external hard drive that is only plugged in when backups are done, DVD's, Tape Drive, or something else, but what ever it is it should not be accessible to the system with out manual intervention, this will prevent scripts from deleting everything.
- Nexxxeh 12y agoWhy can't your offsite backup also be your offline backup?
- the_ancient 12y agoit can
- junto 12y agoFor many people internet access speeds are too slow.
- gambiting 12y agoWe have this problem at our company where the fastest internet our company can possibly get is 20mbps down/4mbps up - and we make ~20GB of backups each day. Absolutely impossible for us to upload all of it to a server offsite overnight.
- pwelch 12y agoI have a Qnap and they are pretty similar to Synology. Wonder if there is a similar attack against them. Also curious if this was linked directly to the internet.
- voltagex_ 12y agoQuite possibly. Run an internal and external nmap scan against your device so you at least know the attack surface.
- based2 12y agohttp://www.cvedetails.com/vendor/11138/Synology.html http://www.cvedetails.com/vendor/11138/Synology.html
- chmars 12y agoMy favorite Synology vulnerability from the linked list: 'The OpenVPN module in Synology DiskStation Manager (DSM) 4.3-3810 update 1 has a hardcoded root password of synopass, which makes it easier for remote attackers to obtain access via a VPN session.' http://www.cvedetails.com/cve/CVE-2014-2264/ http://www.cvedetails.com/cve/CVE-2014-2264/
- CamperBob2 12y agoI made the mistake of leaving a copy of my wallet.dat file on a Synology box that had port 5000 open to the net for the Surveillance Station app. Pro tip: don't do that.
- epaladin 12y agoI'm sorry for your loss.
- xorcist 12y agoStop teasing us! How much was in there?
- CamperBob2 12y agoEnough to get my attention (bigtime), but not enough to hurt.
- foxhedgehog 12y agoI've have my synology hooked up to the net and have seen a LOT of attempts in the past few weeks to log into root / sh from what looks to be Chinese IPs.
- cpncrunch 12y agoThis is pretty normal for ANY device connected to the internet. I configure all my servers (including my synology box) to only allow ssh logins from certain IP addresses.
- walshemj 12y agoI had sever running on a bare ip on AWS address that was never publicised and only ran ssh and a custom node.js server I saw tones of dodgy attempts from Russian and Chinese ip.
- jarnix 12y agoI don't understand how he got hacked. Anyway, there is a service like fail2ban on the Syno.
- atmosx 12y agoI wonder how many tech-savvy users have a complete reporting firewall, controlling in/out connections at home as opposed to a router with a custom password attached online.
- chrishas35 12y agoI've been pondering the idea of a more feature rich router/firewall device for my home connection. Something that would do like you say report, log, audit, etc. Any suggestions for specific model or models to look at?
- atmosx 12y agoCarambola 2 + OpenWRT or FreeBSD (if you are very tech savvy). Then using remote syslog to log everything on another device (RPi?). There you could run analytics.
- PhantomGremlin 12y agoI happily run OpenBSD as my firewall. It's developed by competent people who care about what they are doing and who take pride in their work. But it's general purpose Unix, it's not just a firewall or router. Which means that it's more work to administer than something developed as a dedicated router or firewall. Also I'm running on a generic x86 computer. I pay about $1/yr per watt drawn 24x7, which means my firewall costs me about $80/yr just in electricity. A smaller "appliance" type firewall would certainly have much lower operating costs. Sorry I don't have any suggestions more tailored to your request. I'm just letting you know what works for me.
- voltagex_ 12y agoWow, what's your price per kWH and what (rough) location?
- me1010 12y ago8760 hours = 1 year So... a 1 Watt device running 24x7 = 8.760 kWh billed at about $0.40/kWh [includes both generation and delivery and normal for NE USA - ain't deregulation great?!] ~ $3.50 per year. In order to get to $1.00, total cost per kWh must be about $0.114 ...
- vomitcuddle 12y agoI'm guessing this only affects you if you have their EZ-Internet service enabled that exposes the NAS to the public internet. Or if you exposed it yourself on your firewall. I've had a Synology NAS for almost a year now. I really like the UI, but the software stack they're using under the hood (Apache, PHP, MySQL, etc.) has a massive attack surface, if not routinely kept up-to-date. Here's an nmap trace from my Synology DiskStation: amber@leysritt ~ % nmap -A <redacted> Starting Nmap 6.46 ( http://nmap.org ) at 2014-08-03 23:06 BST Nmap scan report for <redacted> Host is up (0.011s latency). Not shown: 987 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.8p1-hpn13v11 (protocol 2.0) | ssh-hostkey: | 1024 <redacted> (DSA) | 2048 <redacted> (RSA) |_ 256 <redacted> (ECDSA) 80/tcp open http Apache httpd |_http-generator: ERROR: Script execution failed (use -d to debug) |_http-methods: No Allow or Public header in OPTIONS response (status code 301) |_http-title: Did not follow redirect to http://<redacted>:5000/ 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100003 2,3 2049/udp nfs | 100003 2,3,4 2049/tcp nfs | 100005 1,2,3 892/tcp mountd | 100005 1,2,3 892/udp mountd | 100021 1,3,4 33154/tcp nlockmgr | 100021 1,3,4 38187/udp nlockmgr | 100024 1 44039/tcp status |_ 100024 1 53309/udp status 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: REDACTED) 161/tcp open snmp? 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: REDACTED) 515/tcp open printer 548/tcp open afp Netatalk 2.2.3 (name: redacted; protocol 3.3) | afp-serverinfo: | | Server Flags: 0x8f79 | | Super Client: Yes | | UUIDs: Yes | | UTF8 Server Name: Yes | | Open Directory: Yes | | Reconnect: No | | Server Notifications: Yes | | TCP/IP: Yes | | Server Signature: Yes | | ServerMessages: Yes | | Password Saving Prohibited: No | | Password Changing: No | |_ Copy File: Yes | Server Name: redacted | Machine Type: Netatalk2.2.3 | AFP Versions: AFP2.2, AFPX03, AFP3.1, AFP3.2, AFP3.3 | UAMs: Cleartxt Passwrd, No User Authent, DHX2, DHCAST128 | Server Signature: redacted | Network Address 1: redacted |_ UTF8 Server Name: redacted 631/tcp open ipp CUPS 1.5 | http-methods: Potentially risky methods: PUT |_See http://nmap.org/nsedoc/scripts/http-methods.html |_http-title: Not Found - CUPS v1.5.4 2049/tcp open nfs 2-4 (RPC #100003) 3689/tcp open daap mt-daapd DAAP 0.2.4.1 5000/tcp open http Apache httpd |_http-generator: ERROR: Script execution failed (use -d to debug) |_http-methods: No Allow or Public header in OPTIONS response (status code 302) | http-robots.txt: 1 disallowed entry |_/ |_http-title: Did not follow redirect to https://redacted:5001 5001/tcp open ssl/http Apache httpd |_http-generator: ERROR: Script execution failed (use -d to debug) |_http-methods: No Allow or Public header in OPTIONS response (status code 301) | http-robots.txt: 1 disallowed entry |_/ |_http-title: Did not follow redirect to https://redacted/webman/index.cgi | ssl-cert: Subject: commonName=synology.com/organizationName=Synology Inc./stateOrProvinceName=Taiwan/countryName=TW | Not valid before: REDACTED |_Not valid after: REDACTED |_ssl-date: REDACTED | tls-nextprotoneg: | spdy/3 | spdy/2 | http/1.1 |_ x-mod-spdy/0.9.4.2-465a04f Service Info: OS: Unix Host script results: |_nbstat: NetBIOS name: redacted, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) | smb-os-discovery: | OS: Unix (Samba 3.6.9) | Computer name: redacted | NetBIOS computer name: | Domain name: | FQDN: redacted |_ System time: redacted | smb-security-mode: | Account that was used for smb scripts: guest | User-level authentication | SMB Security: Challenge/response passwords supported |_ Message signing disabled (dangerous, but default) |_smbv2-enabled: Server supports SMBv2 protocol Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 40.47 seconds It's sad that most of the open-source NAS solutions are so bad compared to their commercial counterparts. FreeNAS (and related forks) sacrifice too much flexibility and don't offer anything that you can't easily do yourself with a Linux/BSD server distro. I'd love to work on an open-source, security-oriented, user-friendly DSM "clone" with the right kind of people. If this sounds like fun or it sounds like something you're currently working on - shoot me an email: amber@fastmail.jp I also wish there was such a thing as a nice, inexpensive ARM board (~$100) with plenty of SATA ports and upgradable RAM (so you can run huge ZFS pools on it) that you can install your own OS on...
- voltagex_ 12y agoJust a warning, watch which Twitter accounts you click on in that stream - some very graphic Gaza/Syria imagery in there.
- archagon 12y agoA year or so ago, my Synology NAS got hacked by a Bitcoin mining virus. I only discovered it because a tech blogger tweeted about it and I happened to see it. My Synology was out of date and the virus must have exploited a vulnerability without any action on my part. Without knowing what to look for, the virus was effectively invisible. Given that I'm probably in the top 1% of tech savvy people, imagine how many others must have gotten infected! (I contacted Synology tech support and suggested that they send out an e-mail to their users, but they never responded.) Unfortunately, last I checked, it's still impossible to have a Synology NAS automatically update itself.
- vomitcuddle 12y agoyou can set it up to send email notifications when an update is available
- m_t 12y agoThat was a kinda "funny" virus. I got it too. How did I find about it? The fans kept spinning. Usually my syno is really quiet, you can only hear the drives. But that mining exploit made the cpu > 90% and the fans had to do their job. So after a quick search, I discovered what it was all about, and some days later Synology released a nice update that got rid of it. You can't auto update, that's true, but you can receive email alert for each new release of the DSM. You can also do that for each package installed. So, all in all, that good for me: I don't want my NAS to auto update when I'm not there, as I also usually wait a week or two before updating.
- CamperBob2 12y agoIt does have an auto-update function of sorts, but the Bitcoin miner virus disabled it.
- mkhalil 12y agoI hate to see things like this. I feel horrible for anyone who has to face the realization that there going to actually have to pay a online-terrorist money to get their data back. Here's to hoping this will only make the tech industry invest more into security, especially for consumer products which are often neglected. Sad that stuff like this needs to happen, but it's the cost we pay.
- foxhedgehog 12y agoLooks like you gain access to firewall and other security tools if you upgrade the DSM to the latest version.
- clebio 12y agoWow, so this article was impetus enough for me to get key-based SSH working correctly on my Synology. Of curiousity, I looked in my Synology's GUI for the logs, and find you can export them to CSV (System Logs > Connections). I have _a lot_ of this sort: Warning,Connection,2014/08/03 21:10:17,SYSTEM,User [root] from [111.74.239.52] failed to log in via [SSH] due to authorization failure. Curious how many distinct IPs, cut/grep/sed/sort: cut -d ' ' -f 5 ~/Downloads/connection.csv | grep -E '[0-9.]+' | sed 's/\[//' | sed 's/\]//' | sort -u | wc There are 143 distinct IPs, in the 111.x.y.z, 202, 210, 222, etc. ranges: ... cut -d '.' -f -2 | sort -u 111.74 115.230 115.239 ... 220.177 222.186 222.187 I punched a few into (http://www.whereisip.net/index.php http://www.whereisip.net/index.php) and they're mostly in China (except a 23.9... in Rochester, NY). All the successful log-ins are from myself, at least ( grep 'logged in' ...).
- cpbotha 12y agoOpen the Control Panel, then select Security (under "Connectivity"), then the "Auto Block" tab and check "Enable auto block". Kiddies will scan, this blocks their IP numbers after N (by default 5) failed attempts to connect to a number of services, including SSH. My synology has blocked large parts of the internet over the past few months. :) (only my SSH port is open to the outside so that my laptops can synchronize with my Synology via unison over SSH when I'm on the road.)
- hrrsn 12y agoAny open SSH port will get these kinds of hits.
- eric_h 12y agoOur cloud ssh gateway gets literally thousands of hits like this a day to users like root, mysql, oracle, etc. If you've got an ssh host open to the internet at large, always disable root login and password based authentication.
- tehaugmenter 12y agoChange the port your SSH is on to something other than 22.
- wyred 12y agoIf a few guys ran a Synology NAS with terabytes of dummy data, let the ransomware do it's job, rinse and repeat, would we be able to inflict a huge storage bill on the datanappers? If their storage limit got maxed out, would it stop the ransomware from working?
- dagw 12y agoThe ransomware doesn't copy any data off the NAS, it simply encrypts it in place. When you've paid up, they send you the key to unencrypt your data.
- wyred 12y agoMy bad, for not understanding how it works.
- BozeWolf 12y ago"they send you the key" If they send the key. If I was a criminal, I would minimise contact with the victims.
- dagw 12y agoI gather that historically at least they almost always send the key. At the end of the day they're a business like any other and a few bad reviews will kill their revenue stream. However if they are known to offer fast replies and support, it's a lot easier to convince people to pay up.
- junto 12y agoSeems so ironic: Bad guys ransom-ware business dependent on good reviews from 'paying customers' whilst processing support requests for 'license keys' in a timely manner.
- pistle 12y ago"Quick response and delivery. Decrypted as listed in the instructions. Would do business again! 5-stars! Best hackers on eHack."
- shALKE 12y agoThat's why I use a firewall in front of it.
- deleted 12y ago[deleted]
- NietTim 12y agoHoly shit, after seeing these comments I'm never buying synology
- Fastidious 12y agoI do not think Synology has much to do what it happen. A weak password, an out-of-date Synology software and/or an incorrect setup are all caused by the user. Synology produces very good products at very affordable prices.
- NietTim 12y agoSynology has a vulnerability in their closed down software which allows this... how is this not something they have control over? Also, this is not the first time this has happened to Synology hardware. Sure, bigger companies attract more attacks, but this is incredibly bad.
- Fastidious 12y agoHave this proven to have been the case? ("a vulnerability in their closed down software which allows this"). Could you give me a link? Thanks!
- NietTim 12y agoYou can see that there has been hacks of synology products, right?
- Fastidious 12y agoYou are trolling me, yes? Next you will say Crytolocker is a Windows vulnerability (that is not to say that Windows does not have vulnerabilities).
- CamperBob2 12y agoThe problem is that Synology has historically not been very proactive at informing and educating their users about security threats, including very specific ones like this. A company that specializes in selling advanced network appliances to novice users and non-IT pros has a certain obligation to those users, IMHO. PayPal has been described as "a fraud detection company that also transfers money." That's how Synology needs to think of themselves.
- hjuutilainen 12y agoAnd the plot thickens. Synology acknowledged on Facebook and customers are not happy: https://www.facebook.com/synology/posts/10152343606857897 https://www.facebook.com/synology/posts/10152343606857897
- eduo 12y agoDoesn't this actually un-thicken the plot? :)
- deleted 12y ago[deleted]
- achillean 12y agoLooks like there are at least 150 affected devices: https://www.shodan.io/search?query=title%3Asynolocker https://www.shodan.io/search?query=title%3Asynolocker
- gadtron 12y agoTo Recover your Synology NAS Devices Data from SynoLocker Virus Can Call me at: +65 9762 7078