TerraMaster Forum

I got the terramaster f4-210 with a Raid 5.

How can i do data scrubbing? Is there a command for the shell? Or how can i do it and is it save for my data?

Greetings.

is there a internal mechanism inside the TNAS to avoid Bit rotting like some scrupping mechanismen with Raid 5?

Thanks for your answer

In TOS 4.2.3.1 ARM i can't use my USV with activated internal Firewall. My Firewall rules are allow all internal connections from 192.16.... to *255, . Because the USV is running via USB i can't get why it is not detected with the firewall deactivated. With Firewall https://imgur.com/a/g6Ydlh1 Witho...

I guess the latest version with the security fixes got some real hard issues. Here is what i saw in only a few minutes while installing Lets start with installing "Online Mode" https://linklist.live/terra/1.jpg What shall i chose? First or Last ? The First was it.. After installing i began...

Again some Update, i found only one posting about the payload about were the attacker ran into a honeypot https://blog.stevenyu.tw/2022/03/02/%E6%88%91%E7%9A%84-honeypot-%E8%A2%AB-muhstik-%E9%A7%AD%E6%83%B9/ So as Steven Yu mentioned, it is a try to implement a Webshell via Post Parameter, and they ...

So last post for somedays. i don't know what the original content of the mobile class were

but.. i'm a bit confused about the running of SU and MKDIR 777, that looks not quiet safe right

https://imgur.com/a/HbDMcYU

Furthermore it seems that the first attacks did not happen on 28.02 the first appeared on the 07.01 with the Ransomware "Muhstik Ransomware". So overall two attacks in one Month Why Muhstik? Because i found the Base64 encrypted tag inside the uploaded file .m.php on 07.01 https://imgur.com...

Some Updates to find more about the attackers, maybe this will help for a investigation of interpol After i digged deeper in the Hardisk i found some deleted files of the attacker. The IP Adress that was used to attack my NAS was 191.101.210.172, it leads to a Australian VPN Provider ( ​Servers Aust...

@mbucayr

See this thread

viewtopic.php?f=6&t=2877

@KHnats

Did Snapshots in practice helped you to recover of it?

Thanks for the information. Can you give us a statement if the exploit was possible due SAMBA?

https://www.zerodayinitiative.com/blog/ ... BFghVzMqvg