TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

My Synology NAS has been hacked by ransomware calling itself Synolocker

180 点作者 hjuutilainen将近 11 年前

24 条评论

clebio将近 11 年前
Wow, so this article was impetus enough for me to get key-based SSH working correctly on my Synology.<p>Of curiousity, I looked in my Synology&#x27;s GUI for the logs, and find you can export them to CSV (System Logs &gt; Connections).<p>I have _a lot_ of this sort:<p><pre><code> Warning,Connection,2014&#x2F;08&#x2F;03 21:10:17,SYSTEM,User [root] from [111.74.239.52] failed to log in via [SSH] due to authorization failure. </code></pre> Curious how many distinct IPs, cut&#x2F;grep&#x2F;sed&#x2F;sort:<p><pre><code> cut -d &#x27; &#x27; -f 5 ~&#x2F;Downloads&#x2F;connection.csv | grep -E &#x27;[0-9.]+&#x27; | sed &#x27;s&#x2F;\[&#x2F;&#x2F;&#x27; | sed &#x27;s&#x2F;\]&#x2F;&#x2F;&#x27; | sort -u | wc </code></pre> There are 143 distinct IPs, in the 111.x.y.z, 202, 210, 222, etc. ranges:<p><pre><code> ... cut -d &#x27;.&#x27; -f -2 | sort -u 111.74 115.230 115.239 ... 220.177 222.186 222.187 </code></pre> I punched a few into (<a href="http://www.whereisip.net/index.php" rel="nofollow">http:&#x2F;&#x2F;www.whereisip.net&#x2F;index.php</a>) and they&#x27;re mostly in China (except a 23.9... in Rochester, NY). All the successful log-ins are from myself, at least ( grep &#x27;logged in&#x27; ...).
评论 #8130684 未加载
评论 #8132192 未加载
评论 #8131085 未加载
评论 #8132198 未加载
CamperBob2将近 11 年前
I made the mistake of leaving a copy of my wallet.dat file on a Synology box that had port 5000 open to the net for the Surveillance Station app.<p>Pro tip: don&#x27;t do that.
评论 #8131182 未加载
评论 #8130163 未加载
archagon将近 11 年前
A year or so ago, my Synology NAS got hacked by a Bitcoin mining virus. I only discovered it because a tech blogger tweeted about it and I happened to see it. My Synology was out of date and the virus must have exploited a vulnerability without any action on my part. Without knowing what to look for, the virus was effectively invisible. Given that I&#x27;m probably in the top 1% of tech savvy people, imagine how many others must have gotten infected! (I contacted Synology tech support and suggested that they send out an e-mail to their users, but they never responded.)<p>Unfortunately, last I checked, it&#x27;s still impossible to have a Synology NAS automatically update itself.
评论 #8131981 未加载
评论 #8133829 未加载
评论 #8129603 未加载
ksec将近 11 年前
I was just about to post something similar. Although I was lucky not to have the Cryptolocker or Synolocker.<p>My syslog shows a few people have accessed my NAS this month.<p>This is worrying.
评论 #8129199 未加载
评论 #8128976 未加载
评论 #8129041 未加载
评论 #8129425 未加载
jontro将近 11 年前
It would be very interesting to know how this happened, I guess this is the downside of using wide spread products.
评论 #8129094 未加载
hjuutilainen将近 11 年前
One forum post mentions this too: <a href="http://forum.synology.com/enu/viewtopic.php?f=3&amp;t=88716" rel="nofollow">http:&#x2F;&#x2F;forum.synology.com&#x2F;enu&#x2F;viewtopic.php?f=3&amp;t=88716</a>
foxhedgehog将近 11 年前
I&#x27;ve have my synology hooked up to the net and have seen a LOT of attempts in the past few weeks to log into root &#x2F; sh from what looks to be Chinese IPs.
评论 #8129716 未加载
voltagex_将近 11 年前
Just a warning, watch which Twitter accounts you click on in that stream - some very graphic Gaza&#x2F;Syria imagery in there.
junto将近 11 年前
As a first response, stop the port forwarding on your router.<p>Then wait for more info from Synology. I generally don&#x27;t connect mine to the internet (inbound). I don&#x27;t like the risks involved.
atmosx将近 11 年前
I wonder how many tech-savvy users have a complete reporting firewall, controlling in&#x2F;out connections at home as opposed to a router with a custom password attached online.
评论 #8129332 未加载
vomitcuddle将近 11 年前
I&#x27;m guessing this only affects you if you have their EZ-Internet service enabled that exposes the NAS to the public internet. Or if you exposed it yourself on your firewall.<p>I&#x27;ve had a Synology NAS for almost a year now. I really like the UI, but the software stack they&#x27;re using under the hood (Apache, PHP, MySQL, etc.) has a massive attack surface, if not routinely kept up-to-date.<p>Here&#x27;s an nmap trace from my Synology DiskStation: amber@leysritt ~ % nmap -A &lt;redacted&gt;<p><pre><code> Starting Nmap 6.46 ( http:&#x2F;&#x2F;nmap.org ) at 2014-08-03 23:06 BST Nmap scan report for &lt;redacted&gt; Host is up (0.011s latency). Not shown: 987 closed ports PORT STATE SERVICE VERSION 22&#x2F;tcp open ssh OpenSSH 5.8p1-hpn13v11 (protocol 2.0) | ssh-hostkey: | 1024 &lt;redacted&gt; (DSA) | 2048 &lt;redacted&gt; (RSA) |_ 256 &lt;redacted&gt; (ECDSA) 80&#x2F;tcp open http Apache httpd |_http-generator: ERROR: Script execution failed (use -d to debug) |_http-methods: No Allow or Public header in OPTIONS response (status code 301) |_http-title: Did not follow redirect to http:&#x2F;&#x2F;&lt;redacted&gt;:5000&#x2F; 111&#x2F;tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port&#x2F;proto service | 100000 2,3,4 111&#x2F;tcp rpcbind | 100000 2,3,4 111&#x2F;udp rpcbind | 100003 2,3 2049&#x2F;udp nfs | 100003 2,3,4 2049&#x2F;tcp nfs | 100005 1,2,3 892&#x2F;tcp mountd | 100005 1,2,3 892&#x2F;udp mountd | 100021 1,3,4 33154&#x2F;tcp nlockmgr | 100021 1,3,4 38187&#x2F;udp nlockmgr | 100024 1 44039&#x2F;tcp status |_ 100024 1 53309&#x2F;udp status 139&#x2F;tcp open netbios-ssn Samba smbd 3.X (workgroup: REDACTED) 161&#x2F;tcp open snmp? 445&#x2F;tcp open netbios-ssn Samba smbd 3.X (workgroup: REDACTED) 515&#x2F;tcp open printer 548&#x2F;tcp open afp Netatalk 2.2.3 (name: redacted; protocol 3.3) | afp-serverinfo: | | Server Flags: 0x8f79 | | Super Client: Yes | | UUIDs: Yes | | UTF8 Server Name: Yes | | Open Directory: Yes | | Reconnect: No | | Server Notifications: Yes | | TCP&#x2F;IP: Yes | | Server Signature: Yes | | ServerMessages: Yes | | Password Saving Prohibited: No | | Password Changing: No | |_ Copy File: Yes | Server Name: redacted | Machine Type: Netatalk2.2.3 | AFP Versions: AFP2.2, AFPX03, AFP3.1, AFP3.2, AFP3.3 | UAMs: Cleartxt Passwrd, No User Authent, DHX2, DHCAST128 | Server Signature: redacted | Network Address 1: redacted |_ UTF8 Server Name: redacted 631&#x2F;tcp open ipp CUPS 1.5 | http-methods: Potentially risky methods: PUT |_See http:&#x2F;&#x2F;nmap.org&#x2F;nsedoc&#x2F;scripts&#x2F;http-methods.html |_http-title: Not Found - CUPS v1.5.4 2049&#x2F;tcp open nfs 2-4 (RPC #100003) 3689&#x2F;tcp open daap mt-daapd DAAP 0.2.4.1 5000&#x2F;tcp open http Apache httpd |_http-generator: ERROR: Script execution failed (use -d to debug) |_http-methods: No Allow or Public header in OPTIONS response (status code 302) | http-robots.txt: 1 disallowed entry |_&#x2F; |_http-title: Did not follow redirect to https:&#x2F;&#x2F;redacted:5001 5001&#x2F;tcp open ssl&#x2F;http Apache httpd |_http-generator: ERROR: Script execution failed (use -d to debug) |_http-methods: No Allow or Public header in OPTIONS response (status code 301) | http-robots.txt: 1 disallowed entry |_&#x2F; |_http-title: Did not follow redirect to https:&#x2F;&#x2F;redacted&#x2F;webman&#x2F;index.cgi | ssl-cert: Subject: commonName=synology.com&#x2F;organizationName=Synology Inc.&#x2F;stateOrProvinceName=Taiwan&#x2F;countryName=TW | Not valid before: REDACTED |_Not valid after: REDACTED |_ssl-date: REDACTED | tls-nextprotoneg: | spdy&#x2F;3 | spdy&#x2F;2 | http&#x2F;1.1 |_ x-mod-spdy&#x2F;0.9.4.2-465a04f Service Info: OS: Unix Host script results: |_nbstat: NetBIOS name: redacted, NetBIOS user: &lt;unknown&gt;, NetBIOS MAC: &lt;unknown&gt; (unknown) | smb-os-discovery: | OS: Unix (Samba 3.6.9) | Computer name: redacted | NetBIOS computer name: | Domain name: | FQDN: redacted |_ System time: redacted | smb-security-mode: | Account that was used for smb scripts: guest | User-level authentication | SMB Security: Challenge&#x2F;response passwords supported |_ Message signing disabled (dangerous, but default) |_smbv2-enabled: Server supports SMBv2 protocol Service detection performed. Please report any incorrect results at http:&#x2F;&#x2F;nmap.org&#x2F;submit&#x2F; . Nmap done: 1 IP address (1 host up) scanned in 40.47 seconds </code></pre> It&#x27;s sad that most of the open-source NAS solutions are so bad compared to their commercial counterparts. FreeNAS (and related forks) sacrifice too much flexibility and don&#x27;t offer anything that you can&#x27;t easily do yourself with a Linux&#x2F;BSD server distro.<p>I&#x27;d love to work on an open-source, security-oriented, user-friendly DSM &quot;clone&quot; with the right kind of people. If this sounds like fun or it sounds like something you&#x27;re currently working on - shoot me an email: amber@fastmail.jp<p>I also wish there was such a thing as a nice, inexpensive ARM board (~$100) with plenty of SATA ports and upgradable RAM (so you can run huge ZFS pools on it) that you can install your own OS on...
评论 #8129467 未加载
评论 #8129658 未加载
评论 #8130946 未加载
评论 #8129471 未加载
评论 #8130534 未加载
评论 #8129881 未加载
评论 #8131573 未加载
评论 #8129571 未加载
评论 #8131593 未加载
based2将近 11 年前
<a href="http://www.cvedetails.com/vendor/11138/Synology.html" rel="nofollow">http:&#x2F;&#x2F;www.cvedetails.com&#x2F;vendor&#x2F;11138&#x2F;Synology.html</a>
评论 #8130531 未加载
mkhalil将近 11 年前
I hate to see things like this. I feel horrible for anyone who has to face the realization that there going to actually have to pay a online-terrorist money to get their data back.<p>Here&#x27;s to hoping this will only make the tech industry invest more into security, especially for consumer products which are often neglected. Sad that stuff like this needs to happen, but it&#x27;s the cost we pay.
jarnix将近 11 年前
I don&#x27;t understand how he got hacked. Anyway, there is a service like fail2ban on the Syno.
hjuutilainen将近 11 年前
And the plot thickens. Synology acknowledged on Facebook and customers are not happy: <a href="https://www.facebook.com/synology/posts/10152343606857897" rel="nofollow">https:&#x2F;&#x2F;www.facebook.com&#x2F;synology&#x2F;posts&#x2F;10152343606857897</a>
评论 #8134218 未加载
antr将近 11 年前
Wow, I was just about to buy a Synology this coming week and now I have second thoughts. Now more than ever I&#x27;m certain that having <i>only</i> Drobo&#x2F;Synology is not a good backup solution, but having a backup of the backup is equally important.
评论 #8129147 未加载
achillean将近 11 年前
Looks like there are at least 150 affected devices: <a href="https://www.shodan.io/search?query=title%3Asynolocker" rel="nofollow">https:&#x2F;&#x2F;www.shodan.io&#x2F;search?query=title%3Asynolocker</a>
mschuster91将近 11 年前
I&#x27;m waiting for this bullshit to appear on ordinary routers...
评论 #8129050 未加载
评论 #8130490 未加载
pwelch将近 11 年前
I have a Qnap and they are pretty similar to Synology. Wonder if there is a similar attack against them.<p>Also curious if this was linked directly to the internet.
评论 #8130309 未加载
foxhedgehog将近 11 年前
Looks like you gain access to firewall and other security tools if you upgrade the DSM to the latest version.
gadtron将近 11 年前
To Recover your Synology NAS Devices Data from SynoLocker Virus Can Call me at:<p>+65 9762 7078
shALKE将近 11 年前
That&#x27;s why I use a firewall in front of it.
NietTim将近 11 年前
Holy shit, after seeing these comments I&#x27;m never buying synology
评论 #8132283 未加载
评论 #8131178 未加载
wyred将近 11 年前
If a few guys ran a Synology NAS with terabytes of dummy data, let the ransomware do it&#x27;s job, rinse and repeat, would we be able to inflict a huge storage bill on the datanappers? If their storage limit got maxed out, would it stop the ransomware from working?
评论 #8130696 未加载