Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 13 Jul 2022, 10:44
{L_BUTTON_AT}TMroy
TerraMaster Forum
Bug Reports, Operation Guides, and Experience Sharing
https://forum.terra-master.com/en/
New Checkmate Ransomware Threatening Your NAS Devices
Page 2 of 3
Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 14 Jul 2022, 03:39
Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 14 Jul 2022, 08:06
{L_BUTTON_AT}onemeshnig
Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 20 Jul 2022, 01:14
Thanks for the heads up. I would add to use a firewall rule to allow only safe IPs to access the NAS. Regarding the firewall, I implemented it since the Ech0raix attack last december and had no problems since. The only issue I have is that when I reset the TNAS, it seems Plex can´t access the Plex servers since internet is disabled and my local movies are no longer found. I have to disable the firewall so that the TNAS has access to the internet and then restart the TNAS. Then the files are found and I enable firewall again. Do you know which IPs does the TNAS access to validate Plex or how can I fix this issue?TMroy wrote: ↑08 Jul 2022, 23:07 According to the official information provided by QNAP, a new ransomware known as Checkmate is targeting QNAP NAS devices recently. Checkmate attacks via SMB services exposed to the internet and employs a dictionary attack to break accounts with weak passwords. Once the attacker successfully logs in to a device, they encrypt data in shared folders and leave a ransom note with the file name "!CHECKMATE_DECRYPTION_README" in each folder.
Related news: QNAP warns yet another wave of attacks are targeting NAS devices by techradar
Your TNAS is also highly likely to be targeted.
Recommendation
1. Do not enable SMB 1 service on your TNAS device.
2. Review all TNAS accounts immediately to ensure all passwords are strong enough. It is recommended that the password contain at least 8 characters, upper and lower case letters, and special characters.
3. Back up your data and take snapshots regularly for your share folders by installing the Snapshot app. If you have installed the TOS 5.0 on your TNAS, it is recommended to enable the TerraMaster File System Snapshot(TFSS) immediately. What is TFSS?
Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 20 Jul 2022, 05:03
Does your firewall log all outbound flows? Should be relatively easy to see which site Plex is pinging when you open the firewall. then write a rule to allow that exception.CapCaveman wrote: ↑20 Jul 2022, 01:14Thanks for the heads up. I would add to use a firewall rule to allow only safe IPs to access the NAS. Regarding the firewall, I implemented it since the Ech0raix attack last december and had no problems since. The only issue I have is that when I reset the TNAS, it seems Plex can´t access the Plex servers since internet is disabled and my local movies are no longer found. I have to disable the firewall so that the TNAS has access to the internet and then restart the TNAS. Then the files are found and I enable firewall again. Do you know which IPs does the TNAS access to validate Plex or how can I fix this issue?TMroy wrote: ↑08 Jul 2022, 23:07 According to the official information provided by QNAP, a new ransomware known as Checkmate is targeting QNAP NAS devices recently. Checkmate attacks via SMB services exposed to the internet and employs a dictionary attack to break accounts with weak passwords. Once the attacker successfully logs in to a device, they encrypt data in shared folders and leave a ransom note with the file name "!CHECKMATE_DECRYPTION_README" in each folder.
Related news: QNAP warns yet another wave of attacks are targeting NAS devices by techradar
Your TNAS is also highly likely to be targeted.
Recommendation
1. Do not enable SMB 1 service on your TNAS device.
2. Review all TNAS accounts immediately to ensure all passwords are strong enough. It is recommended that the password contain at least 8 characters, upper and lower case letters, and special characters.
3. Back up your data and take snapshots regularly for your share folders by installing the Snapshot app. If you have installed the TOS 5.0 on your TNAS, it is recommended to enable the TerraMaster File System Snapshot(TFSS) immediately. What is TFSS?
Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 31 Jul 2022, 14:34
{L_BUTTON_AT}onemeshnig
And how do you do that?Saijin_Naib wrote: ↑14 Jul 2022, 08:06 ARM implementation of TOS 4.x is missing a ton of features, among them any way to set the SMB version and parameters like the x86 TOS users can. So, you don't have that control unless you drop into the shell via SSH and edit configs manually.
Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 27 Sep 2022, 23:47
I have a ransomware question. Deadbolt (for instance) seeks out a list of file suffixes and will encrypt those files, adding its own suffix, ".deadbolt". For obvious reasons, ".deadbolt" is not on the list of files its seeks to encrypt..
An amusing precaution against deadbolt would be a script that adds ".deadbolt" as a second suffix to every file as it it written and removes it immediately prior to it being accessed by its owner.
I mention this, because Terramaster's Snapshot app offers the ability to make the snapshots visible. This usefully makes it easy to restore individual files. However, the visible snapshot files retain their original suffixes and therefore are presumably as vulnerable to deadbolt as the originals.
Might it be of some value to offer a user-definable munge of some sort to snapshot suffixes?
--
Chris
An amusing precaution against deadbolt would be a script that adds ".deadbolt" as a second suffix to every file as it it written and removes it immediately prior to it being accessed by its owner.
I mention this, because Terramaster's Snapshot app offers the ability to make the snapshots visible. This usefully makes it easy to restore individual files. However, the visible snapshot files retain their original suffixes and therefore are presumably as vulnerable to deadbolt as the originals.
Might it be of some value to offer a user-definable munge of some sort to snapshot suffixes?
--
Chris
Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 28 Sep 2022, 00:07
The visible snapshot file is just a symbolic link, The real snapshot files are hidden in a specific directory.
If you want to be more secure, you can use the file system snapshot in TOS 5. File system snapshots take snapshots of the entire file system, and the snapshot files are read-only and cannot be encrypted or deleted by ransomware.
If you want to be more secure, you can use the file system snapshot in TOS 5. File system snapshots take snapshots of the entire file system, and the snapshot files are read-only and cannot be encrypted or deleted by ransomware.
Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 28 Sep 2022, 05:44
{L_BUTTON_AT}TMroy
Very useful to know. Thanks.
But I'm not clear how to do a filesystem snapshot. The Snapshot app doesn't appear to provide for this. Is this a `btrfs-progs` commandline utility?
--
Chris
Re: New Checkmate Ransomware Threatening Your NAS Devices
Posted: 28 Sep 2022, 10:01
To find the "File system snapshot", go to "TOS 5 desktop > Backup > File system snapshot".