Oh boy, QNAP NAS users can’t seem to catch a break, as they’ve been urged to patch up their endpoints immediately, again.
This time around, an unknown threat actor is on the hunt for vulnerable QNAP NAS devices to deploy the Deadbolt ransomware on.
Among the vulnerable devices are those running on the QTS 4.3.6 and QTS 4.1.1 operating systems. That would include the TS-x51 series, and the ST-x53 series, although it’s probably not limited to these two.
No decryptor
Those who end up attacked will see a warning right on the login page, demanding payment in Bitcoin in exchange for the decryption key. All of the files on the affected endpoint will be encrypted using the AES128 algorithm and will have the .deadbolt extension to their filenames.
At this time, we don’t know how high the ransom demand is.
Cybersecurity researcher Michael Gillespie has recently published a decryptor key for Deadbolt, but it seems that it only works for Windows devices. At this time, it would seem, the only way to recover the device is to actually pay the ransom.
That’s why, researchers are saying, it would be best not to get infected in the first place. That can be achieved, first and foremost, by applying the patch that’s already been made available by QNAP. Furthermore, the company urged NAS device owners to “avoid exposing their NAS to the Internet”.
To that end, users are advised to block port forwarding on their home router, and to disable UPnP in the NAS control panel. Furthermore, they should turn off SSH and Telnet connections. Users can still access their NAS devices away from their home intranet by deploying a VPN, and using the myQNAPcloud Link app.
It’s been less than a month since QNAP urged users to patch against two vulnerabilities with a 9.8 severity score. The bugs can be used to perform low complexity attacks that don’t require victim interaction, it was said at the time.
Via: Tom's Hardware