Slashdot Mirror
Synolocker 0-Day Ransomware Puts NAS Files At Risk
Deathlizard (115856) writes "Have a Synology NAS? Is it accessible to the internet? If it is, You might want to take it offline for a while. Synolocker is a 0-day ransomware that once installed, will encrypt all of the NAS's files and hold them for ransom just like Cryptolocker does for windows PC's. The Virus is currently exploiting an unknown vulnerability to spread. Synology is investigating the issue."
not to connect your NAS directly to the internet.
Of course. But they are on another similar box connected to the internet of things which was crypted earlier.
Backup? What do people usually use NAS for, I always thought it's mostly for ripped/torrented movies and backups of other computers. Neither of these need backups.
PlusFive Slashdot reader for Android. Can post comments.
Really?
They may have some unhappy customers right now; but 'NAS', in Synology's product lineup, includes a variety of devices that are aimed either at reasonably serious users or very serious pirates.
So between TOR and bitcoin, they think they finally have a viable method of collecting on ransomware. Also, I found it interesting that they're asking specifically for 0.6BTC - that is, double what Cryptolocker is asking. I wonder if there's an intentional correlation there.
They may have some unhappy customers right now; but 'NAS', in Synology's product lineup, includes a variety of devices that are aimed either at reasonably serious users or very serious pirates.
Translation: They have a built-in torrent client and FTP server. Therefore you can practically smell the salt water reeking from ye digital box.
I love how certain tools label people as scurvy dogs hell-bent on illegal activities.
The deluxe edition comes with an eye-patch. They initially offered a parrot, but there where some shipment incidences*.
*: There's still some debate about the actual status of the parrots upon arrival. Synology insists on the parrots' being alive, but there have been customer reports on the parrots being: "passed on", "no more", "ceased", "expired and gone to meet it's maker", "a stiff", "Bereft of life", "resting in peace", among others.
My Synology NAS is my home-based business' file server, a local machine backup (for my development machine and my digital audio workstation), and a media server for my ripped DVDs and Blurays, although this third function is just a nice bonus for me. Synology NAS devices have a very handy cloud backup application as well, which I use to backup all my most critical files to Amazon S3 services. I hope most people made use of this, because if Cryptolocker has taught us anything, it's that you absolutely need offsite backups that are NOT connected to your network.
I bought it specifically because it makes it easy to set up a multi-tiered backup strategy like that - something that takes on new importance when you spend a few years writing code on your own dime. As a file server, it's fantastic for small operations. I had a drive begin to fail last year, and so had a chance to test out the hot-swapping / RAID rebuilding feature. Worked like a charm - was super simple and zero down-time.
Personally, I've never once considered opening up my NAS to the outside internet. That always seemed crazy risky to me - after all, a single software mistake, a buffer overrun in a protocol stack of some sort, and *poof*, there's direct access to your file server and all it's critical data. I guess sometimes being paranoid pays off, but it gives me no pleasure to say so.
Irony: Agile development has too much intertia to be abandoned now.
From TFA: the message that pops up to the victims ends with:
Copyright 2014 SynoLocker(TM) All Rights Reserved.
I have a real hard time respecting that copyright...
Updated posted 8/5/2014 by Jeremie on the English language Synology Forum: [We’d like to provide a brief update regarding the recent ransomware called “SynoLocker,” which is currently affecting certain Synology NAS servers. Based on our current observations, this issue only affects Synology NAS servers running some older versions of DSM (DSM 4.3-3810 or earlier), by exploiting a security vulnerability that was fixed and patched in December, 2013. At present, we have not observed this vulnerability in DSM 5.0.]
There is no mention in the article of this being a zero day vulnerability, in fact the article specifically says "it’s not clear yet how SynoLocker’s operators installed the malware".
As others have said Synology is reporting the vulnerability was patched in December. Hardly a zero day.
There is however the constant Nag from Synology to upgrade to the latest versions that system automatically kicks out to you along with the emails they send about the current patches that they recommend you apply to your system. No one auto-patchs NAS devices as bad things can happen to peoples data.
Beware the Lollipop of Mediocrity, Lick it once and you suck forever.
Forum post so far:
Hello Everyone,
We’d like to provide a brief update regarding the recent ransomware called “SynoLocker,” which is currently affecting certain Synology NAS servers.
Based on our current observations, this issue only affects Synology NAS servers running some older versions of DSM (DSM 4.3-3810 or earlier), by exploiting a security vulnerability that was fixed and patched in December, 2013. At present, we have not observed this vulnerability in DSM 5.0.
For Synology NAS servers running DSM 4.3-3810 or earlier, and if users encounter any of the below symptoms, we recommend they shut down their system and contact our technical support team here: https://myds.synology.com/supp....
-When attempting to log in to DSM, a screen appears informing users that data has been encrypted and a fee is required to unlock data.
-A process called “synosync” is running in Resource Monitor.
-DSM 4.3-3810 or earlier is installed, but the system says the latest version is installed at Control Panel > DSM Update.
For users who have not encountered any of the symptoms stated above, we highly recommend downloading and installing DSM 5.0, or any version below:
-For DSM 4.3, please install DSM 4.3-3827 or later
-For DSM 4.1 or DSM 4.2, please install DSM 4.2-3243 or later
-For DSM 4.0, please install DSM 4.0-2259 or later
DSM can be updated by going to Control Panel > DSM Update. Users can also manually download and install the latest version from our Download Center here: http://www.synology.com/suppor....
If users notice any strange behavior or suspect their Synology NAS server has been affected by the above issue, we encourage them to contact us at security@synology.com.
Apologies for any problems or inconvenience caused. We will keep you updated with latest information as we address this issue.
Synology now insists that this in fact reflective of their move to quantum computing technology, and that the parrot is both alive and dead.
A NAS device is not a toaster. It's a file server running a lightweight but fully-featured operating system. You don't need to be a professional network administrator, but you do need to be careful enough to at least check in regularly for updates. One presumes such hardware was purchased because you had valuable data you wished to manage or protect. Honestly, a NAS is really not a purchase for "normal" people. Power-users and up, I'd say, are the minimum personnel requirements.
Even so, Synology machines are not hard to patch. They download OS updates automatically by default. All you have to do is log in via the administration page once in a while and click the "update" button, since it pops up right on the page after it sees you have an update to install. And every update has a link right next to it that points to a web page detailing exactly what changed or what was fixed. I'd suppose the reason there's no "auto-update" is because an update requires a 5-10 minute patch and reboot cycle, and you generally don't want your file server automatically rebooting at it's own convenience.
I'm presuming (since information is a bit scarce) that users either failed to patch their machines for six months or longer due to neglect, or they made a deliberate choice not to do so for some reason, yet kept their internet-facing services wide open (note that these are not installed or enabled by default). Unfortunately, that's pretty much a guaranteed recipe for an attack of this sort. It's a crappy way to have to learn a lesson.
Irony: Agile development has too much intertia to be abandoned now.
Backups need backups too. Your data isn't safe unless there are 3 copies, working, backup, archive (minimum), one should be offline.
Cheap storage VM.
No I think it was a Norwegian Blue, but I'm not sure we can af-fjord any more references to that sort of thing
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon
Backups need backups too. Your data isn't safe unless there are backups all the way down.
But seriously, having two copies is enough most of the time, provided they are somewhat separate (i.e. not on two identical, connected NAS machines).
PlusFive Slashdot reader for Android. Can post comments.
Mine nags me every time there's an update released. There's no unattended update option, but that makes sense for a NAS.
Vintage computer games and RPG books available. Email me if you're interested.
You do realize that for the S3 backup to work Synology or the NAS (and the NAS has you Synology login info) has your login information for S3, and that if this thing is owning the NAS there is a pretty damn good chance the malware has owned your S3 instance as well right? The only way it wouldn't is if the S3 backup is totally manual.
You do realize that for the S3 backup to work Synology or the NAS (and the NAS has you Synology login info) has your login information for S3, and that if this thing is owning the NAS there is a pretty damn good chance the malware has owned your S3 instance as well right? The only way it wouldn't is if the S3 backup is totally manual.
Amazon has a very extensive authentication system -- you can easily configure the Synology with an S3 access key that only has "List Files" and "Upload Files" permissions, but not "Delete Files" or "Overwrite Files". This way, even if the Synology box gets owned or a user fat-fingers something, the files on S3 aren't at risk. You don't (and shouldn't) need to use your AWS root access keys for S3.
I have a similar setup with Amazon's Glacier: my standard access key has only list, upload, and retrieve permissions. A separate access key is required to delete files (I've configured my Glacier client, FastGlacier, to prompt me for a password when I switch to the "delete" key) so that I don't accidentally end up deleting important backups.