Ransomware

[nit]

Has anyone heard about the ransomware thats happened for Synology lately?

Wondering what the situation is for Asustor, are we on the same boat and vulnerable?

Thanks

N

[Kapitein Haak]

Yes, i've seen multiple sites reporting on this. As it seems to be unknown how the Synology's are attacked you cannot be certain if your Asustor is save. The only secure network device is a device with it's network cable unplugged...

There are reports which seem to indicate that heartbleed is to blame (this is where Asustor NASses would be safe) and only Synology's with old firmware are attacked. The ransomware seems to work like it's pc counterpart (cryptolocker if I recall correctly). The files on your NAS are encrypted by the NAS itself and are unrecoverable unless you have the private key.

I was just about to add a feature request to Asustor: add an option similar to GeoIP on the Synology. Blocking access to all countries except the ones with lower risk (and at least the one you live in )

Best regards,
Kapitein Haak.

[nit]

Hi Kapitein,

Thanks for the quick reply!

I guess I'll have to restrict my NAS from the outside world till when ever i guess and just have it within the house.

But probably be good if Asustor had some reply on this or some feedback....

Thanks

N

[mafredri]

If you're worried, your best bet is to minimize the points of attack. For example, the only service I expose to the outside world is the OpenVPN server, only when connected can I access my other services. Personally I doubt anybody will be able to exploit it, and I doubt anyone has enough incentive to try to target me specifically . For added security you might try obfuscation (e.g. changing the port number to a non-default port).

Just because some Synology systems are vulnerable doesn't mean your ASUSTOR is.

[LUCKYDUCKY]

It seems that number of ransomware will grow without ending, the latest version of this infection named Thor have already attacked several thousands computers in Germany, the only tool I could found here but I am not sure that it is real..