TerraMaster Forum

....then this won't be an option for me (and most of us I assume), because we would lose most functions. Hard to find a balance between usability and security.

Charlie_Croker wrote:
> More on the QNAP attacks and its possible there is a shared vulnerability.
>
> While the company (QNAP) did not share any other details on these active
> attacks, BleepingComputer reported on QNAP customers saying their systems
> were targeted with eCh0raix ransomware (also known as QNAPCrypt).
>
> These incidents follow an increase in activity right before Christmas and
> are using an unknown attack vector.
>
> However, some of the users' reports seen by BleepingComputers link
> successful ransomware attacks to improperly secured Internet-exposed
> devices. Others have also claimed that the attackers exploited an
> unspecified QNAP Photo Station vulnerability.
>
> BleepingComputer has seen ech0raix ransom demands ranging from $1,200 to
> $3,000 worth of bitcoins during these recent attacks. Some of them were
> paid because the victims didn't have a backup of the encrypted files
>
> QNAP devices were previously targeted by threat actors using eCh0raix
> ransomware in June 2019 and June 2020, with the NAS maker also alerting
> users of another series of another surge of eCh0raix attacks targeting
> devices with weak passwords in May 2021.

I got hit this month. Analyzing how they got it was because of an internal attack. My son was trying Multi GBA S for Android and hours later I got hit. Checking the TNAS logins, there is a login from 209.141.41.x and 209.141.42.x, then from his Android phone. I can confirm his phone was infected because he had several . encrypted files on his documents.
I think this was a coordinated attack from apps in phones which were inside of the network. This is the app I refer to:

https://play.google.com/store/apps/deta ... networkgba

I will be contacting Google regarding it. The apps does no have a trojan, but it asked for full google permissions and you need to connect to their servers. I believe this was the hackers way in.

I will harden my Nas, accept lost files and double check apps before downloading them.

Hopefully the Terramaster team can make tests and confirm this was the infection entry used.

CapCaveman wrote:
>
That would be an interesting attack vector. I tend to use VLANS to keep my IOT, and devices that will never need access to my NAS drives (I have three and all three have been the victims of attacks, well not my own devices , but other peoples by the same manufacturers).

So I would recommend putting all devices that don't need access to the NAS on a separate VLAN https://www.youtube.com/watch?v=jC6MJTh9fRE

Jac de Lad wrote:
>
I would recommend doing it, (Blocking WAN access) at least until the attack vector is patched.

Thanks. Already did.

Charlie_Croker wrote:
> Jac de Lad wrote:
> >
> I would recommend doing it, (Blocking WAN access) at least until the attack vector is
> patched.
Thanks, but I'm alread using Synology. I was attacked yesterday (6 times, all blocked). Going offline is not an option, also Thai would render the NAS senseless, I could use an external drive instead. However, my two remaining Terramaster don't host valuables, so if it happens, it happens. My valuables are in a safe backup.

sports_wook wrote:
>
I can understand your frustration, ClamAV would not be able to prevent these kind of attack vectors in any case.
But every NAS manufacturer has been targeted in the last year or so. (QNAP multiple times and they have warned users to remove devices from the internet, I will place links below). Only asustor devices don't seem to have been hit (yet).

This site lists all the latest security issues and its worth staying on top of the news. https://www.bleepingcomputer.com/news/security/

The issue isn't entirely TM's fault (Although advising users to disable the "admin account" when this isn't possible on TNAS, doesn't bode well. talk about shoot yourselves in the foot). TMRoy is obviously part of customer services/public relation and not tech support and I'm guessing English is his second language, so sometimes he makes mistakes. (I live/work in Middle East and my Arabic is far worse!).

I think the issue will be a fundamental zero day with part of Linux as its hit QNAP as well.

Snap advises users (3 days ago)
https://www.techspot.com/news/92909-qna ... ected.html

Western Digital attack (June 21)
https://www.techradar.com/uk/news/weste ... ets-device

Synology warns users (Aug 21)
https://www.bleepingcomputer.com/news/s ... ansomware/

REBELinBLUE wrote:
>
Thanks for that.

So to confirm, allowing a range forces the TOS firewall to REJECT every other connection that does not match this rule?