Oh boy, QNAP NAS (opens in new tab) users can’t seem to catch a break, as they’ve been urged to patch up their endpoints immediately, again.
This time around, an unknown threat actor is on the hunt for vulnerable QNAP NAS devices to deploy the Deadbolt ransomware (opens in new tab) on.
Among the vulnerable devices are those running on the QTS 4.3.6 and QTS 4.1.1 operating systems. That would include the TS-x51 series, and the ST-x53 series, although it’s probably not limited to these two.
(opens in new tab)No decryptor
Those who end up attacked will see a warning right on the login page, demanding payment in Bitcoin in exchange for the decryption key. All of the files on the affected endpoint will be encrypted using the AES128 algorithm and will have the .deadbolt extension to their filenames.
At this time, we don’t know how high the ransom demand is.
Cybersecurity researcher Michael Gillespie has recently published a decryptor key for Deadbolt, but it seems that it only works for Windows devices. At this time, it would seem, the only way to recover the device is to actually pay the ransom.
That’s why, researchers are saying, it would be best not to get infected in the first place. That can be achieved, first and foremost, by applying the patch that’s already been made available by QNAP. Furthermore, the company urged NAS device (opens in new tab) owners to “avoid exposing their NAS to the Internet”.
> QNAP NAS owners are under attack once again (opens in new tab)
> QNAP NAS devices vulnerable to dangerous 'DirtyPipe' Linux bug (opens in new tab)
> QNAP extends support for older NAS devices amid surge in attacks (opens in new tab)
To that end, users are advised to block port forwarding on their home router, and to disable UPnP in the NAS control panel. Furthermore, they should turn off SSH and Telnet connections. Users can still access their NAS devices away from their home intranet by deploying a VPN, and using the myQNAPcloud Link app.
It’s been less than a month since QNAP urged users to patch against two vulnerabilities with a 9.8 severity score. The bugs can be used to perform low complexity attacks that don’t require victim interaction, it was said at the time.
- Never miss an update with the best patch management tools around (opens in new tab)
Via: Tom's Hardware (opens in new tab)
