Urgent Notification about TNAS being Attacked by Ransomware

[LaMosca]

ESPAÑOL

Siento que no estás diciendo lo correcto. terramaestro. NO es curable de nada. ni puede ser considerado responsable de lo que hacen los demás.
de hecho me ayudaron cada vez que tuve un problema, con el TANS. pero Terra-Master no tienen la culpa de lo que hacen los hackers.

ya que muchos han sido atacados. Me tomé el tiempo para publicar una guía. lo que te ayudará a tener tu dispositivo en condiciones. y poder saber. ¿De dónde vienen los ataques?

Aquí abajo les dejo el enlace. si desea evitar ataques a su sistema TNAS.

TAMBIÉN PODRÁ BLOQUEAR A LOS INTRUSOS QUE INTENTEN ESCANEAR SU SISTEMA EN BUSCA DE VULNERABILIDADES.

en enlace ir a la sesión de seguridad.

http://larry.serveftp.com/ayuda/

--------------
--------------

ENGLISH.

I feel like you're not saying the right thing. earthmaster. It is NOT curable of anything. nor can he be held responsible for what others do.
in fact they helped me every time I had a problem, with the TANS. but Terra-Master is not to blame for what the hackers do.

as many have been attacked. I took the time to post a guide. which will help you to have your device in conditions. and be able to know. Where do the attacks come from?

Here below I leave the link. if you want to prevent attacks on your TNAS system.

YOU WILL ALSO BE ABLE TO BLOCK INTRUDERS THAT TRY TO SCAN YOUR SYSTEM FOR VULNERABILITIES.

in link go to the security session.

http://larry.serveftp.com/ayuda/

[V8Triker]

LaMosca wrote:
>

Well said.

Yes there was a vulnerability, but they are not always known until they are found.
I do feel for the people who have lost data, but it does highlight the point that you should never open your data to the Internet, unless using a secure point to point VPN connection.
Oh, and always back your data up.

It is not until you have lost data, and I have lost Gigs of photos, that you realise how fragile your data is.
That is why I now have my data on a RAID5 array, that is backed up to a RAID1 array, and also backed up to an "off site" 4Tb USB drive.

TerraMaster have always been swift to respond to support requests, on this forum.
They are doing their best, and certainly can not be expected to try and break an encryption key.

[LaMosca]

so my system is open to internet. and pay those who violate it. I laugh at the moment. but look at this it's coming in from a proxy.
trying to find that vulnerability.
:80/config/getuser?index=0
this is the proxy IP address, already blocked: ✔️ 75.119.145.87
that's why my system takes it all.

If you want you can have the same security, try it... it costs nothing and it's free.

http://larry.serveftp.com/ayuda/

[ChinChillaH]

@Bellcorp
Yes, I can now access all my data. I was really lucky here that I noticed this. There were only a few movies and unimportant documents encrypted. I am glad that it remained only with this small part.

The tips and links from you helped me. It is worth a try. I am glad that I have my backups.

I have restored the original TOS configuration. All the users that were previously created are back as well as the configuration settings. It is now back to the way it was before.

I have only one problem. I cannot log in via SSH. Apparently the login data is wrong.

[alexinwonderland]

{L_BUTTON_AT}fpsking

TMroy wrote:
> >
> You are the one who exposes your device to the internet but doesn't want to
> do anything.

I don't think that's a good / correct answer to this specific customer (fpsking listed all the things he did) or to your customers in general. Do you really think that, if your customers had received detailed step-to-step instructions from TerraMaster on how to avoid this issue, they would have not "wanted to do anything" about it? Your first instructions were as generic as "change this port" (to what?), "install an anti-virus" (which one? there's only one on the app store and it won't defend you against ransomware) or "disable the admin user" (the OS that most people have installed does NOT allow you to disable it).

Furthermore, blaming people for using standard ports or having FTP enabled is quite hypocritical, considering that Terramaster ships with telnet and FTP options enabled by default and with all the standard ports enabled. Terra Master units should be SECURE BY DEFAULT. The users should then have the OPTION TO REDUCE SECURITY at their own risk (with proper warning messages popping up). NOT THE OTHER WAY AROUND.

[Charlie_Croker]

{L_BUTTON_AT}fpsking

alexinwonderland wrote:
> TMroy wrote:
> > > >
> > You are the one who exposes your device to the internet but doesn't want to
> > do anything.
>
> I don't think that's a good / correct answer to this specific customer (fpsking
> listed all the things he did) or to your customers in general. Do you really think
> that, if your customers had received detailed step-to-step instructions from
> TerraMaster on how to avoid this issue, they would have not "wanted to do
> anything" about it? Your first instructions were as generic as "change
> this port" (to what?), "install an anti-virus" (which one? there's
> only one on the app store and it won't defend you against ransomware) or
> "disable the admin user" (the OS that most people have installed does NOT
> allow you to disable it).
>
> Furthermore, blaming people for using standard ports or having FTP enabled is quite
> hypocritical, considering that Terramaster ships with telnet and FTP options enabled
> by default and with all the standard ports enabled. Terra Master units should be
> SECURE BY DEFAULT. The users should then have the OPTION TO REDUCE SECURITY at their
> own risk (with proper warning messages popping up). NOT THE OTHER WAY AROUND.


100% right!

[LaMosca]

Este no es un foro para discutir quién es culpable o no. pero si necesitas seguridad en tu TNAS sigue mi link publico y alli encontraras una muy buena guia. Está en español pero si necesitas ayuda avísame y con gusto te ayudo.

Configuración exitosa de TNAS.
http://larry.serveftp.com/ayuda/

-----------
-----------

This is not a forum to discuss who is guilty or not. but if you need security in your TNAS follow my public link and there you will find a very good guide. It is in Spanish but if you need help let me know and I will gladly help you.

Successful configuration of TNAS.
http://larry.serveftp.com/ayuda/

[fuzball71]

All this info is very appreciated for a new NAS owner. I have a f4-210 NAS my questions is where can I find a antivirus that works on the arms NAS . I have locked its down so it can only be seen on my home network. Any Help would be use full for me and other F4-F2 210 users

[hgvandy]

Has anyone paid the ransom and how do you buy .03 of bitcoin and transfer? I have never purchased crypto, but before I do, I want to make sure this will unlock my data. I will be doing things much different in the future. Thanks!

[Charlie_Croker]

LaMosca wrote:
> Este no es un foro para discutir quién es culpable o no. pero si necesitas
> seguridad en tu TNAS sigue mi link publico y alli encontraras una muy buena
> guia. Está en español pero si necesitas ayuda avísame y con gusto te ayudo.
>
> Configuración exitosa de TNAS.
> http://larry.serveftp.com/ayuda/
>
> -----------
> -----------
>
> This is not a forum to discuss who is guilty or not. but if you need
> security in your TNAS follow my public link and there you will find a very
> good guide. It is in Spanish but if you need help let me know and I will
> gladly help you.
>
> Successful configuration of TNAS.
> http://larry.serveftp.com/ayuda/

You might want to review your security, I got blocked and within 2 seconds could access your site again. Your source code can easily be viewed and you have even commented what each piece does. It might keep a script kiddy out but I don't think it's going to protect you from someone determined.