Ransomware min bɛ so walima biro kɔnɔ NAS (Synology/QNAP): Encryption ni UPnP Exposition jɔli¶

Disiki gɛlɛnw mɛnni i ka Network-Attached Storage kɔnɔ (NAS) minɛn (Synology DiskStation, . QNAP Turbo NAS, . TrueNAS, . Asustor, . TerraMaster, walima Western Digital My Cloud) ka to ka sɔgɔsɔgɔ ni disiki baarakɛcogo kɛmɛsarada la 100 ye k' a sɔrɔ foli jɛlenw bɛ fa ni .deadbolt, . .ech0raix, . .qlocker, . .7z, . .lockbit, walima .encrypt dosiyew janya (walima k’a ye ko i ka NAS ɛntɛrinɛti dondaw yɔrɔ bɛ bila Bitcoin kunmabɔnafolo ɲinini nɔ na) o ye marayɔrɔ kɔrɔtɔlenba ye. NAS minɛnw ye laɲini nafamaw ye ɛntɛrinɛti bɛɛ ka kunmabɔnafolo botnetw (DeadBolt, . Qlocker, . eCh0raix / . QNAPCrypt, . AgeLocker, . Chatterbox, ani Akira) bawo NAS kelen min ma patɔrɔn, a ka c' a la, o bɛ denbaya walima jagokɛyɔrɔ fitinin dɔ ka nizɛri ɲɛnamaya bɛɛ lajɛlen terabayiti 10 fo 100 minɛ, wa a ka teli ka bila foroba ɛntɛrinɛti la k'a sɔrɔ a tigi m'a dɔn Router UPnP (Universal Plug and Play) Auto-Port-Forwarding walima feerekɛlaw ka sankaba-relay baarakɛminɛnw (myQNAPcloud, . Synology QuickConnect, . EZ-Internet). Sani i ka AC kuran juru sama ka bɔ kogo la, i ka kan ka seginkanni nafama dɔ kɛ min bɛ kɛ sekɔndi 10 kɔnɔ, ka da a kan ni i ka NAS bɛ baara kɛ ni Copy-on-Write snapshots ye (Btrfs walima ZFS) walima laadala RAID sɛrɛkili dɔ; ni disiki sɛrɛkiliw tiɲɛna minnu tɛ ransomware ye, aw bɛ lajɛ NAS RAID sɛrɛkili tiɲɛna, drive caman dɛsɛra, ani ZFS/Btrfs seginni, ani PC-based ransomware banakisɛw kama, aw ye sɛbɛn ɲɛ malware, ransomware ani spyware banakisɛw ka fara o kan so kɔnɔ routeurw ni IoT minɛnw lakanani. Ni kunmabɔnafolo-porogaramu bɛ nɔ bila dɔgɔtɔrɔso baarakɛcogo la, minisiriso ka kɔrɔtɔko baarakɛyɔrɔw la, walima farikolo lakanani fɛɛrɛw la, i ka i ka sigida kɔrɔtɔko nimɔrɔ wele (911 Ameriki ni Kanada jamanaw na, . 112 Erɔpu tɔnba kɔnɔ, . 999 Angletɛri jamana na) walima ka an ka diɲɛnatigɛ gafe ɲɛbilasɛbɛn lajɛ kɔrɔtɔko nimɔrɔw.

Aw bɛ o kɛ sisan¶

1. Aw bɛ Etɛrinɛti farikoloma sama (RJ45 / . 10GbE) rezo kabɔri(w) bɔra NAS kɔfɛ SISAN yɛrɛ, sani i ka maga kuran juru la:
2. Ni i ye Etɛrinɛti kabɔri(w) bɔ a la, o bɛ binkannikɛla ka SSH/HTTP cikan ni kunnafoni-falen-falen-sɛbɛn tigɛ o yɔrɔnin bɛɛ, ka NAS bali ka fɛnɲɛnamafagalan filananw telesarse, wa, o nafa ka bon o cogo kelen na, a bɛ tabali PC banakisɛ min bɛ i ka sigida biro LAN kan, o jɔ o yɔrɔnin bɛɛ la, a kana i ka NAS siri SMB/CIFS rezow tilayɔrɔw kan (\\NAS\Share).
3. A dɔn segin 15 kɔnɔ ni i bɛna kuran tigɛ walima ni i bɛna kodɔn baara jɔ ka saniya:
4. Senario A: Ransomware bɛ baara kɛ ON PC desktop i ka LAN kan ani ka NAS filew siri SMB/Mapped Network Drive kan: NAS Ethernet kabɔri samali dɔrɔn senfɛ 1nan na a ye 100% sirili jɔ kaban NAS kan. Aw bɛ NAS to a ka baara la walasa a ka RAID array ni filesystem ka to saniya la, ka taa Windows/Mac baarakɛyɔrɔ banakisɛ bɛ min na, o bɔ ɲɔgɔn na.
5. Sɛbɛn B: Ransomware binary bɛ ka baara kɛ ka ɲɛsin NAS Linux baarakɛminɛn yɛrɛ KƆNƆ (DeadBolt, . Qlocker, . eCh0raix):
   • Ni aw ye t sɔrɔ Btrfs walima ZFS snapshots enabled (misali la, kɔrɔlen dɔ ext4 volume) ani drivew bɛ ka sɔgɔsɔgɔ kosɛbɛ i n’a fɔ NAS bɛ i ka filenw kopi kelenpe siri, ka ɲɛfɛla Power Button farikoloma digi k’a minɛ NAS kan fo segin 5 fo 10 walasa ka fanga dabila teliya la teliya la (walima ka DC/AC kuran fiyɛli sama ni butɔni ma jaabi). NAS bɛ to ka baara kɛ miniti o miniti, o b’a to a ka CPU bɛ i ka dosiyew gigabayiti 5 fo 20 wɛrɛ siri.
   • Kɔlɔsili nafama (Why DeadBolt & Qlocker victims must NOT reboot after recovery): Ransomware suguyaw i n’a fɔ Qlocker (o min bɛ dosiyew Lasegin ka Kɛ password-protected ye .7z archives baara 7z) ani DeadBolt tuma dɔw la, aw bɛ encryption state walima decryption keys active mara /tmp (RAM) walima ka web UI binary (/home/httpd/index.html). Ni aw bɛ sigida SSH jusigilan da wulilen sɔrɔ hali bi ka don NAS kɔnɔ, aw bɛ a lajɛ ps aux ani /tmp sani aw ka kuran faga (aw ye sɛbɛn ɲɛ Fasa 2 lajɛ jukɔrɔ).
6. I ka don i ka ɛntɛrinɛti routeur / firewall kɔnɔ (192.168.1.1 / . 192.168.0.1 / UniFi / pfSense / ISP gateway) o yɔrɔnin bɛɛ ka OFF kɛ UPnP (Universal Plug and Play) ANI ka WAN Port Forwarding sariyaw bɛɛ bɔ yen minnu bɛ i ka NAS jira:
7. So ni biro fitininw NAS kunmabɔnafolo banakisɛw kɛmɛsarada la 80 ni kɔ bɛ kɛ bawo baarakɛla ye "Auto Router Configuration / EZ-Internet / UPnP" digi a sigicogo fɔlɔ senfɛ, o min ye so routeur bila a makun na ko a ka TCP portw da wuli 5000, . 5001, . 8080, . 8443, . 443, . 22 (SSH), walima 445 (SMB) ka ɲɛsin foroba ɛntɛrinɛti bɛɛ ma (Shodan.io / . Censys).
8. UPnP bali kudayi i ka routeur ka WAN/NAT sigicogo la ani ka port-forwarding sariya bɛɛ bɔ yen min bɛ NAS ka sigida IP adrɛsi jira.
9. AW KAN'a daminɛ, ka a labɛn kokura, walima ka "Reset / Reinstall DSM or QTS" baara disque durw kan sani aw ka a lajɛ ni kunmabɔnafolo ye OS tilayɔrɔba dɔrɔn walima data volume dɔrɔn minɛ:
10. Binkanniw na i n'a fɔ ** .DeadBolt**, porogaramu jugu in bɛ NAS ka ɛntɛrinɛti donyɔrɔ sɛbɛn (index.html) ka kunmabɔnafolo sɛbɛn dafalen jira min bɛ se ka don QNAP/Synology admin dashboard kɔnɔ, hali ni i ka jukɔrɔla Btrfs / . ZFS ja minnu bɛ kɛ walima wideyow filen belebelebaw (megabayiti 20 ni kɔ) bɛ hali bi kɛmɛsarada la 100 la disikiw kan.
11. A lajɛ ni aw ka NAS ye o kɛ Btrfs (Synology Snapshot Replication), . ZFS (TrueNAS / . QuTS hero), walima LVM Block-Level Snapshots (QNAP Storage & Snapshots):
12. Barisa Btrfs ani ZFS snapshots bɛ kalan dɔrɔn de la filesystem block layer (ani Synology) la WORM / Immutable Snapshots yɛrɛ tɛ se ka bɔ yen ni compromised ye root admin account), a ka c’a la, i bɛ se k’i ka foli jɛlenw kɛmɛsarada la 100 segin kɔ segin 60 kɔnɔ ni kunnafoni bɔnɛ zeru ye ani kunmabɔnafolo zeru sara.
13. Sanni i ka kunmabɔnafolo si sara, i ka kunmabɔnafolo suguya tigitigi dɔn min bɛ baara kɛ ni o ye ID Ransomware (id-ransomware.malwarehunterteam.com) ani No More Ransom (nomoreransom.org):
14. NAS ransomware suguya belebele damadɔ (eCh0raix / . QNAPCrypt, joona Qlocker fɛ photorec / . qrescue jirisunw bɔli, . Muhstik, ani SynoLocker) ka foroba decrypteurs fu walima forensic key-extraction methods sɔrɔ minnu bɔra sariya labatoli ni lakana ɲininikɛlaw fɛ.

--- .

Desizɔn jiri : NAS ransomware triage teliya la ani a seginni sira¶

Baara kɛ ni nin baarakɛcogo in ye walasa k’a dɔn ni binkanni in bɔra ɔridinatɛri LAN la walima ni a bɔra NAS kan, ani ka segin-ka-bɔnye fɛɛrɛ min ka fisa ni tɔw bɛɛ ye, o sugandi:

flowchart TD
    Symptom["NAS Drives Grinding at 100% + Files Renamed (.deadbolt, .7z, .ech0raix, .lockbit) walima Web UI bɛ Ransom Screen jira"] --> PullLAN["SEN 1 (Seginkanni 5 kɔnɔ): Aw bɛ Etɛrinɛti kabɔri bɛɛ bɔ NAS kɔfɛ"]

    PullLAN --> SourceCheck{"Yala Encryption ye NAS Ethernet Cable bɔ o yɔrɔnin bɛɛ la wa?"}

    SourceCheck -->|"ƆWƆ: Disiki baara bɛ jigin ka se zeru ma ni LAN bɔra fiyɛli la"| SMBVector["SOURCE A: Ransomware bɛ baara kɛ Windows/Mac PC kan i ka réseau kan ani ka foli jɛlenw siri SMB fɛ"]

    SourceCheck -->|"AYI: NAS disque durw bɛ taa a fɛ ka sɔgɔsɔgɔ ni Ethernet bɔra a la (Wali NAS Web Login Page yɛrɛ bilala Ransom Screen nɔ na)"| DirectNAS["SOURCE B: Ransomware Binary bɛ ka baara kɛ ka ɲɛsin NAS OS kɔnɔ (A bɛ baara kɛ ni UPnP / Exposed WAN Ports 5000, 5001, 8080, 443, 22 ye)"]

    SMBVector --> IsolatePC["Aw ye PC banakisɛ sɔrɔlen ɲini & ka a tigɛ aw ka LAN kan -> NAS Shared Folders Segin ka Bɔ Btrfs / ZFS / QNAP Snapshots walima Hyper Backup la"]

    DirectNAS -->SSHCheck{"Yala aw ye sigida SSH Session Active Open (Wali Qlocker bɛ baara kɛ ni 7z ye) wa?"}

    SSHCheck -->|"Ɔwɔ (Qlocker / 7z baarakɛcogo active) ."| GrabPass["Sɛgɛsɛgɛli kɛ ps aux | grep 7z kan SSH ka Plaintext 7-Zip Password Minɛ Ka Bɔ Command Line Args la Sani Killing Process"]
    SSHCheck -->|"No SSH / Unknown Strain Grinding Diskiw tɛ yen"| PowerOff["NAS Power Button minɛ Sekɔndi 5-10 walasa ka fanga di teliya la ka kuran gɛlɛn faga walasa Files Unencrypted & Free Space ka mara"]

    GrabPass --> KillUPnP["2nan : Don Router kɔnɔ -> UPnP bali kudayi + Port Forwarding sariyaw bɛɛ bɔ (5000, 5001, 8080, 443, 22)"]
    PowerOff --> KillUPnP
    IsolatePC --> KillUPnP

    KillUPnP --> RecoveryPath{"Segin nafolo jumɛnw bɛ NAS kan?"}

    RecoveryPath -->|"Btrfs / ZFS / QNAP Bloki jatebɔw bɛ yen"| SnapRestore["OS Partition / Firmware Update saniya -> Roll Back Shared Folders ka taa Pre-Attack Snapshot la"]
    RecoveryPath -->|"USB kɛnɛma / Sankaba kɔkanna lakanani (Hyper Backup / HBS 3) ."| BackupRestore["Wipe & Rebuild NAS kan Patched Firmware -> Segin ka bɔ Offline/Cloud Backup la"]
    RecoveryPath -->|"Snapshots tɛ & Backups tɛ yen"| ForensicCarve["Clone Drives Read-Only -> Check NoMoreRansom.org + Run PhotoRec / QRescue Carving min ma tila (Kɛrɛnkɛrɛnnenya la, a bɛ nɔ bɔ Qlocker kɛlɛli la)"]

--- .

NAS Ransomware bɛ kari cogo min na: Binkanni fɛnɲɛnamafagalan fila¶

Sani i k’i ka NAS don i ka sigida rezow switch kɔnɔ, i ka kan k’a dɔn dondaw vecteur fila minnu tɛ kelen ye pewu, jumɛn de ye sira di kunmabɔnafolo ma ka don i ka marayɔrɔ hakɛw la:

--- .

Dakun fɔlɔ: Ɛntɛrinɛti dabila (Router UPnP, . Port Forwarding, ani Sankaba Relays) .¶

N’i ​​y’i ka NAS saniya walima k’a lasegin a cogo kɔrɔ la k’a sɔrɔ i ma réseau dingɛ datugu i ka routeur kan, botnet otomatiki minnu bɛ i ka foroba IP adrɛsi sɛgɛsɛgɛ, olu bɛna NAS bana kokura lɛrɛ damadɔ kɔnɔ, u seginnen kɔ ɛntɛrinɛti kan. Aw bɛ nin réseau lockdown in dafa aw ka routeur kan fɔlɔ:

1. I ka don i ka Ɛntɛrinɛti Router / Firewall Admin Console kɔnɔ:
2. Navigatɛri da wuli ɔridinatɛri walima telefɔni saniyalen kan ani ka taa i ka routeur ka gateway IP la (a ka c’a la 192.168.1.1, . 192.168.0.1, . 10.0.0.1, walima i ka mesh router app fɛ i n’a fɔ UniFi, . Eero, . Google Home, . TP-Link Deco, . ASUS Router, . Netgear Nighthawk).
3. Ka lajɔ UPnP (Universal Plug and Play) Kudayi:
4. Aw bɛ taa Advanced > NAT Forwarding / WAN / Network > UPnP la ani ka UPnP wuli ka taa OFF / Disabled la.
5. Munna UPnP farati ka bon kosɛbɛ NAS tigiw ma: Ni UPnP dabɔra i ka routeur kan, minɛn o minɛn bɛ i ka sigida réseau kan (i ka NAS ka "EZ-Internet" walima "Auto Router Configuration" wizard fana sen bɛ o la, walima porogaramu jugu min bɛ telewisɔn hakilitigi kan) bɛ se ka cikan ci i makun na IGD (Internet Gateway Device) ɲinini kɛ i ka routeur la k'a fɔ ko "I ka kɛnɛma WAN Port 8080 ani 5001 da wuli n ka sigida IP 192.168.1.50" kan, k'i ka tasuma-fanga-yɔrɔ tɛmɛ k'a sɔrɔ i ma i ka routeur tɔgɔlasɛbɛn ɲini abada.
6. Ka Port Forwarding Manuel bɛɛ bɔ (Virtual Server) & . DMZ Sariya minnu bɛ NAS jira:
7. Aw bɛ taa Advanced > NAT Forwarding > Port Forwarding (walima Virtual Servers) la ani ka sariya bɛɛ bɔ TCP walima UDP portw cicogo la (80, . 443, . 5000, . 5001, . 8080, . 8443, . 21 FTP, 1999. 22 SSH, 1999. 873 rsync, 1999. 445 SMB, 1999. 32400 Plex ni mago tɛ) ka taa i ka NAS IP la.
8. Advanced > DMZ lajɛ ani k’a sɛgɛsɛgɛ ko DMZ Host is Disabled (ni NAS IP bila routeur ka DMZ kɔnɔ, o bɛ NAS ka TCP ni UDP port 65.535 bɛɛ jira foroba ɛntɛrinɛti kan).
9. Aw ye sɛgɛsɛgɛli kɛ ka bɔ aw ka réseau kɔkan ko Zero NAS Ports Dabɔra:
10. Ka taa bɔ shodan.io walima ** .grc.com (ShieldsUP)** walima ka port scan kɛ ka kɛɲɛ ni i ka foroba WAN IP ladɛrɛsi ye walasa ka o portw dafa 5000, . 5001, . 8080, . 8443, . 443, ani 22 sisan segin ** .Filtered / Stealth / Closed**.

--- .

Dakun 2nan : Kɔrɔtɔko sɛgɛsɛgɛli min bɛ kɛ ni suguya kɛrɛnkɛrɛnnenw ye (Qlocker, . DeadBolt, . eCh0raix) .¶

Sani i ka NAS ko walima ka kunmabɔnafolo sara, i k’a lajɛ NAS kunmabɔnafolo suguya kɛrɛnkɛrɛnnen min ye i ka minɛn gosi. NAS denbayaba kelen-kelen bɛɛ bɛ ni fɛɛrɛko barikantanya kɛrɛnkɛrɛnnenw ye minnu b’a to kunnafoniw bɛ se ka sɔrɔ yɔrɔ dɔ walima u bɛɛ lajɛlen na k’a sɔrɔ u ma sara:

1. Ni I ka Filenw tun bɛ fɛn wɛrɛw nɔ na .7z Archives (Qlocker kan QNAP / Linux NAS) .¶

Cogo min na Qlocker baara kɛtaw : Sani i ka sɛbɛnni kɛ ni kriptografu motɛri ye min bɛ kɛ ka kɛɲɛ ni mɔgɔw sago ye, . Qlocker bɛ sɛbɛnnibolo dɔ boli min bɛ NAS yɛrɛ ka fɛn dilannenw wele ** .7-Zip (/usr/local/sbin/7z)** binary walasa ka dosiye kelen-kelen bɛɛ sɛgɛsɛgɛ ka kɛ tɔgɔlasɛbɛn ye min lakananen don .7z archive (dakun) ka sɔrɔ ka Linux normal (Linux normal) baara rm (unlink) dosiye fɔlɔ kan. - Triage Trick #1 (Ka Password minɛ Live in kɔnɔ ps aux Sani ka Kuran Dabila): Ni Qlocker bɛ sisan hali bi i ka NAS kan ani i bɛ se ka don sigida la SSH fɛ (ssh admin@nas-local-ip), aw bɛ nin cikan in kɛ o yɔrɔnin bɛɛ sani aw ka kuran faga:

ps aux | grep 7z

2. Ni I ka NAS Login Screen tun b’a nɔ na DeadBolt Kunmabɔnafolo ɲɛ (.deadbolt dosiyew) .¶

Cogo min na DeadBolt baara minnu bɛ kɛ: 1. DeadBolt bɛ bila a nɔ na /home/httpd/index.html (walima /home/httpd/cgi-bin/index.cgi) n’a yɛrɛ ka binary/HTML ɲɛ ye min b’i ka ɛntɛrinɛti-navigatɛri minɛ tuma o tuma n’i y’a ɲini ka QNAP QTS / Asustor ADM dashboard da wuli, ka Bitcoin ɲini ka kɛɲɛ ni 32-hex-character master decryption key (min bɛ di on-chain Bitcoin fɛ OP_RETURN jagokɛcogo). 2. Cogo min na i bɛ se ka don i ka QNAP QTS / QuTS hero Admin Dashboard la kokura k’a sɔrɔ i ma i ka dataw tunun: - Sugandili A (Via Local SSH ni a dabɔra): SSH don NAS kɔnɔ sigida la (ssh admin@<nas-ip>), ka namaratɔw dabila deadbolt baara kɛ ni a bɛ baara la, ani ka QNAP ka firimiwɛri seginni sɛbɛn ofisiyali baara walima ka a fɔlɔ lasegin /home/httpd/index.html ka bɔ kalan dɔrɔn sitɛmu ROM ja la (/mnt/HDA_root/update_pkg/). - Sugandili B (Firmware Flash sans disiki + Hot-Plug Reinsertion): 1. NAS ka kuran faga. 2. Aw bɛ disiki gɛlɛnw bɛɛ bɔ kɛnɛma ni santimɛtɛrɛ 2 ye walasa u ka tigɛ ka bɔ kɔkanna-minɛn na (aw ka u ka bay order jate ka ɲɛ ni pentikɛla ka kaseti ye fɔlɔ). 3. NAS ni disiki gɛlɛnw tɛ, i k’a IP sɔrɔ Qfinder Pro fɛ, n’i y’a ɲini i fɛ setup screen kan, i ka disikiw wuli ka segin u ka yɔrɔ tigitigiw la, ka "Update Firmware Only (Keep All Data and Settings)" sugandi (i kana "Initialize System" digi abada, o min bɛ disikiw ko). 3. Nafama Sariya labatoli Decryption Note kan DeadBolt: 1. . Baara jɛlenw kɔnɔ minnu ɲɛmɔgɔya tun bɛ Holande jamana polisiw bolo (Politie), Erɔpɔli (No More Ransom), ani Responders.nu, sariyatigiw ye se sɔrɔ ka lafili DeadBolt bagabagali kɛbagaw mempool sara jiginni waati la ka master decryption keys 150 ni kɔ bɔ sanni binkannikɛlaw ka Bitcoin jagokɛtaw ka ban Replace-By-Fee fɛ. Waritasɛbɛn deadbolt.responders.nu ani nomoreransom.org k’a lajɛ ni i ka kɛrɛnkɛrɛnnenya la DeadBolt victim address key minɛna polisiw fɛ.

3. Ni Aw ka Filenw bɛ Ban .encrypt (eCh0raix / . QNAPCrypt) .¶

• San damadɔw ye... eCh0raix (QNAPCrypt) tun bɛ baara kɛ ni AES kilisi bɔcogo dafabali ye walima u tun b' u ka cikan-ni-kɔlɔsili (C2) kunnafonidilan min minɛna lakana ɲininikɛlaw ni sariyatigiw fɛ.
• Ka taa bɔ nomoreransom.org ani ka dosiye fila sirilenw bila (walima kunmabɔnafolo sɛbɛn README_FOR_DECRYPT.txt) ka Bitdefender / NoMoreRansom fu kɔrɔbɔ eCh0raix Decryptor ka sɔrɔ ka fɛn o fɛn ko.

--- .

Dakun 3nan: I ka Filenw seginni ka bɔ Btrfs, . ZFS, walima QNAP Ja minnu bɛ kɛ Sekɔndi 60 kɔnɔ¶

Ni i ka NAS tun sirilen don Vector #2 fɛ (PC min bɛ ni ransomware ye i ka LAN kan min bɛ foli jɛlenw siri SMB fɛ) fɛ, walima ni Immutable (WORM) Snapshots walima LVM/Btrfs/ZFS Snapshots minnu ma maga u la NAS binkanni tilennen senfɛ, i bɛ se k’i ka filenw kɛmɛsarada la 100 lasegin o yɔrɔnin bɛɛ:

1. Sinoloji Disiki-Station (DSM 7.x ni Btrfs Snapshot Replication) .¶

1. Fɔlɔ, i k’a lajɛ ni PC banakisɛ min bɛ i ka LAN kan, o tigɛra ka bɔ réseau la, ani ka Synology DSM kuraya ka kɛɲɛ ni bɔko laban ye Control Panel > Update & Restore kɔnɔ.
2. Snapshot Replication foroko da wuli Synology DSM kɔnɔ.
3. Recovery digi kininbolo fan fɛ.
4. Folder shared min sirilen don, o sugandi (walima iSCSI LUN) ani ka Recover digi.
5. Aw ye ja bolodalenw lisɛli lajɛ (GMT+...) ani ka ja min ta o yɔrɔnin bɛɛ sanni kunmabɔnafolo sirili ka daminɛ o sugandi (aw ye Action > Browse lajɛ fɔlɔ walasa ka o ja kɔnɔ dosiyew lajɛ fɔlɔ ani k’a jira k’u saniyalen don ani ko u ma siri).
6. Action > Restore to this snapshot (walima Clone with a new name digi n’i b’a fɛ ka foli sirilen to a ma maga a la walasa ka kiritigɛlaw ka daliluw sɔrɔ k’a sɔrɔ i bɛ foli jɛlen kopi saniyalen dɔ wuli o yɔrɔnin bɛɛ).
7. Barisa Btrfs ye Kopi-ni-Sɛbɛn ye (CoW) filesystem, ka foli jɛlen dɔ lasegin kɔfɛ min bɛ se terabayti 20 ma ka taa ja la min bɛ kɛ ka kɔn binkanni ɲɛ, o bɛ segin 10 bɔ.

2. QNAP NAS (QTS Block-Level LVM Snapshots & Bamako, Mali. QuTS hero ZFS Snapshots (Ja minnu bɛ kɛ)¶

1. Ni QTS/QuTS jagokɛla ye patch ani isolated ka bɔ WAN la, Storage & Snapshots da wuli.
2. Aw bɛ taa Storage > Storage/Snapshots la, ka aw ka Thick Volume, Thin Volume, walima ZFS Shared Folder min tɔɔrɔlen don, o sugandi, ka Snapshot Manager (kamera taamasiyɛn) digi.
3. Ja saniyalen laban min tara ka kɔn binkanni waati taamasiyɛn ɲɛ, o sugandi.
4. Aw bɛ foli jiri lajɛ kininbolo kɔnɔ walasa k’a dɔn ko aw ka dosiyew ma tiɲɛ, o kɔ aw bɛ Revert Volume Snapshot digi (walima foli bɛɛ sugandi ka Restore digi walasa ka dosiye sirilenw dɔrɔn sɛbɛn).

3. TiɲɛNAS (CORE / . SCALE kan ZFS) ani Unraid (ZFS / . Btrfs) .¶

• TrueNAS kan (ZFS): Taga Storage > Snapshots (walima Data Protection > Periodic Snapshot Tasks), ja saniyalen ɲini (tank/share@auto-2026-10-31_12-00), ka Rollback digi (walima ka ja in clone ka kɛ dataset kura ye zfs clone tank/share@auto-2026-10-31_12-00 tank/share_recovered o la i tɛ bɔnɛ abada cɛmancɛ ja kuraw la).

--- .

Dakun 4nan: Ka i ka NAS gɛlɛya walasa a kana se ka siri tugun abada (The 7-Point Checklist) .¶

Ni i ka kunnafoniw sɔrɔla kokura, i ka nin labɛncogo sariya wolonwula wajibiyalenw waleya i ka Synology, QNAP, TrueNAS walima Asustor minɛn kan sani i k’u don ɛntɛrinɛti la kokura:

• 1. Aw kana Port si bila abada i ka routeur kan ka taa i ka NAS la: Baara kɛ ni o ye Tailscale walima WireGuard VPN No na:
• Tailscale foroko ofisiyali sigi ka bɔ Synology Package Center / QNAP App Center la (walima i ka routeur kɔnɔ WireGuard VPN Server min bɛ a kɔnɔ, o baara).
• Tailscale bɛ zeru-labɛnni, ɲɔgɔndan WireGuard sirilen mesh tunnel (100.x.y.z) i ka telefɔni, i ka ɔridinatɛri, ani i ka NAS cɛ ni zeru da wulilen don i ka so routeur firewall kan. I bɛ se ka don i ka NAS fotow, dosiyew, ani admin screen la ka bɔ diɲɛ yɔrɔ bɛɛ la k’a sɔrɔ i ka NAS tora 100% yebali ye ɛntɛrinɛti skanɛrɛw fɛ i n’a fɔ Shodan.
• 2. Built-In Default (Dɔ̀gɔya-yɔrɔ-ko) bali admin Jatebla ani ka Administrateur tɔgɔla ladamu dɔ Dabɔ ni Wajibiya 2FA ye:
• Synology DSM ni QNAP QTS fila bɛɛ bɛ ci ni jatebɔsɛbɛn ye min tɔgɔ ye ko ** .admin** (UID 1024 walima UID 0). Brute-force bots otomatikiw bɛ baarakɛla tɔgɔ minɛ ni marifa ye admin 24/7.
• Aw ye ɲɛmɔgɔ ka jatebɔsɛbɛn kura dabɔ ni baarakɛla tɔgɔ kɛrɛnkɛrɛnnen ye, ka don ni o jatebɔsɛbɛn kura ye, ka taa Control Panel > User & Group (or Users), ani Disable the default admin jatebɔsɛbɛn.
• Aw bɛ Facteur 2-Facteur obligatoire (OTP / . Passkey / . Approve Sign-in) ka ɲɛsin ɲɛmɔgɔ ka jatew bɛɛ ma.
• 3. A’ ye ON Immutable (WORM) Ja minnu bɛ kɛ ( .7-to-14-Day Retention Lock):
• Synology DSM 7.2+ kan: Aw bɛ Snapshot Replication > Snapshots > Settings > Schedule da wuli, ka don o don jatebɔw daminɛ, ani ka "Enable immutable snapshots" lajɛ ni lakanani waati ye 7 fo tile 14. Hali ni hakɛri dɔ y’i ka root password sonya walima ka kernel vulnerability dɔ nafa DSM kɔnɔ, mɔgɔ si (hali root) bɛ se ka Immutable Snapshot dɔ bɔ yen fo tile 7 fɛnɲɛnamafagalan waati ka ban.
• QNAP QuTS hero / QTS kan: Snapshot Replica Vault dɔ labɛn walima ka WORM (Write Once, Read Many) mara sariyaw kan backup shares kɔrɔlenw kan, ani ka a lajɛ ko "Reserve Snapshot Space" bɛ baara la.
• 4. SMB Réseau Share yamaruyaw dantigɛ (Least Privilege) O la, Ordinatɛri Infection tɛ Se ka NAS bɛɛ Encrypt:
• Aw kana aw ka NAS ka matigi karti abada admin seereyaw Windows File Explorer kɔnɔ (\\NAS\) don o don ɔridinatɛriw kan.
• Baarakɛla ka jatebɔsɛbɛn jɔnjɔn dɔ dabɔ min tɛ ɲɛmɔgɔ ye don o don dosiyew sɔrɔli kama, ani k’i ka archive/photo folderw sigi sen kan (misali la, 2010-2025 Family Photos Archive) ka Kalan-Dɔrɔn (ro) don o don tabali baarakɛlaw ye walasa ni denbaya kɔnɔmɔgɔ dɔ ka Windows PC ye kunmabɔnafolo minɛ, PC ka se k’o foli ninnu kalan nka a tɛ se k’u siri walima k’u sɛmɛntiya.
• 5. NAS Built-In Firewall (Allow LAN + Tailscale Subnets Only) & Auto-Block: Bamako, Mali.
• Synology Control Panel > Security > Firewall (walima QNAP QuFirewall) kɔnɔ, allowlist sariya gɛlɛn dɔ dabɔ min bɛ sira di jɛɲɔgɔnyaw ma ka bɔ i ka sigida LAN subnet dɔrɔn na (192.168.1.0/24) ani i ka Tailscale/VPN subnet (100.64.0.0/10), o kɔfɛ, duguma sariya dɔ bɛ sigi sen kan Deny All. Hali ni mɔgɔ dɔ y’a yɛrɛ wuli bala la UPnP ka segin routeur kan, NAS yɛrɛ ka kɔnɔna pake filɛri bɛna foroba ɛntɛrinɛti pake bɛɛ fili o yɔrɔnin bɛɛ.
• 6. SSH (Port 22) ani Telnet (Port 23) Ni a ma gɛlɛyaw ɲɛnabɔ kosɛbɛ:
• Aw bɛ SSH to a OFF la Control Panel > Terminal & SNMP kɔnɔ don o don baara kɛcogo nɔgɔman na; dɔrɔn k’a wuli miniti 10 kɔnɔ i mago bɛ minnu na walasa ka cikan baara dɔ kɛ, o kɔ i k’a da kinin fɛ ka segin a kan.
• 7. "3-2-1" lakika min bɛ fiɲɛ bila / min tɛ se ka Changé Sankaba Backup (Hyper Backup / . HBS 3):
• Aw ka tugu an ka ɔridinatɛri kɔkannakow ani 3-2-1 balawu lasegincogo gafe: ka Synology labɛn Hyper Backup walima QNAP Hybrid Backup Sync (HBS 3) ka sufɛla sirilenw, kiliyan fan fɛ deduplicated backups gɛrɛ kɛnɛma USB disque dur la i bɛ min bɔ farikolo la walima ka taa Object-Locked (S3 Object Lock Compliance Mode) sankaba bulon (Backblaze B2, . Wasabi, walima AWS S3) ka baara kɛ ni API dantigɛlenw ye minnu bɛ fara ɲɔgɔn kan dɔrɔn.

--- .

Sigidaw ka kɔrɔtɔko nimɔrɔw ani baaradaw ka sariyaw¶

Ransomware binkanni minnu bɛ NAS minɛnw laɲini, olu bɛ sɛgɛsɛgɛ jamana ka ɛntɛrinɛti juguya baaradaw fɛ diɲɛ fan bɛɛ, minnu bɛ decryption keys minɛlenw marayɔrɔw mara (No More Ransom) ani ka kojugubakɛlaw ka fɛnsɔrɔsiraw nɔfɛtaama :

• Amerika ni Kanada:
• Kɔrɔtɔko ɲɛnamaya-Lakanali tiɲɛni: Dial 911 ni kunmabɔnafolo ye kɛnɛyako walima farikolo lakanani siraw tiɲɛ.
• CISA & FBI ka Ɛntɛrinɛti kan kojugubakɛlaw ka kiritigɛso (IC3): NAS kunmabɔnafolo kanpaɲiw fɔ (DeadBolt, . Akira, . LockBit, . Qlocker) la ** .stopransomware.gov**, ic3.gov, walima ka CISA wele telefɔni 1-844-Say-CISA (1-844-729-2472).
• Canada ka Centre for Cyber Security & RCMP: Laseli kɛra cyber.gc.ca (1-833-CYBER-88) walima Kanada ka nanbarako kɛlɛli yɔrɔ.
• Royaume-Uni:
• Kɔrɔtɔko baarakɛlaw: Dial 999 (walima 101 ka ɲɛsin polisiw ma minnu tɛ kɔrɔtɔko ye).
• Action Fraud & NCSC: Ransomware ko kɛlenw fɔ actionfraud.police.uk walima ka ** wele .0300 123 2040** (24/7 sibɛri ko kɛlenw layini ɲɛnama). Jagokɛyɔrɔ fitininw ni dɛmɛnjɛkuluw bɛ se ka NCSC Cyber Incident Response (ncsc.gov.uk) dakun.
• Erɔpu jamanaw ka tɔnba:
• Kɔrɔtɔko baarakɛlaw: Dial 112 UE jamanaw bɛɛ kɔnɔ.
• Europol Erɔpu Sibɛri juguya ɲɛmɔgɔso (EC3) & . NoMoreRansom.org: Sɛgɛsɛgɛli ** .nomoreransom.org** (min maralen bɛ Hollande jamana polisiw fɛ, Europol ani jɛɲɔgɔnw ka baarakɛda minnu fɛ) ka ɲɛsin NAS kunmabɔnafolo decryption keys minɛlenw ma, ani ka kunnafoni di i ka jamana CSIRT ni Data Protection Authority ma (DPA sanga 72 kɔnɔ ni mɔgɔ yɛrɛ ka kunnafoniw bɔra kɛnɛ kan walima ni u tununna GDPR kɔnɔ).
• Ɔsitarali ni Zelande kura:
• Kɔrɔtɔko baarakɛlaw: Dial 000 Ɔsitarali jamana na walima 111 Nuwɛlika jamana na.
• Ɔsitarali jamana ka Sibɛri Lakanali yɔrɔ (ACSC): Aw bɛ 24/7 Ransomware Hotline wele 1300 CYBER1 (1300 292 371) walima ka kunnafoni di ** .cyber.gov.au**.
• CERT NZ: Laseli kɛ cert.govt.nz.
• Endi ni Azi Pasifiki:
• Endi jamana (CERT-In & Sibɛri juguya dɛmɛnsira): Dial 1930 walima ka kunnafoni di cybercrime.gov.in ani incident@cert-in.org.in.
• Tayiwani (TWCERT/CC, Synology, QNAP, ani Asustor PSIRTw ka so kɔnɔ): Aw bɛ feerekɛlaw lakanani ko kɛlenw tikitiw di QNAP PSIRT ma (service.qnap.com) walima Sinoloji PSIRT (synology.com/en-global/security/advisory).

--- .

Ɲininkali minnu bɛ kɛ tuma caman na¶

Ransomware ye n ka QNAP walima Synology NAS bana cogo di k’a sɔrɔ n ma deli ka phishing link si digi ani n ka ɔridinatɛriw saniyalen don pewu?¶

Aw ka NAS banana ka bɔ foroba ɛntɛrinɛti la k’a sɔrɔ a ma maga aw ka ɔridinatɛriw la. Wala i ka ɛntɛrinɛti routeur tun bɛ UPnP (`Universal Plug and Play`) . a dabɔra (ka sira di NAS ka "Auto Router Configuration / EZ-Internet / myQNAPcloud" fɛɛrɛ ma ka portw da wuli makun na 8080 ye, . 443. Bamako, Mali, . 5000 ye, . 5001 ye, walima 22. Ɲɛjirali dɔw i ka tasuma-fanga-minɛn kan), walima i ye port dɔ ci i bolo fɛ walasa ka se i ka dosiyew ma yɔrɔjan fɛ. Botnet otomatiki bɛ to ka foroba IP ladɛrɛsi bɛɛ sɛgɛsɛgɛ ɛntɛrinɛti kan ani ka nafa sɔrɔ fɛnw na minnu ma labɛn walima minnu barika ka dɔgɔ admin daɲɛ dogolenw NAS ɛntɛrinɛti yɔrɔw kan minnu bɛ kɛnɛ kan.

Ne bɛ se k’a dɔn cogo di ko kunmabɔnafolo bolila ka ɲɛsin ne ka NAS OS kɔnɔ vs. ne ka Windows ɔridinatɛri dɔ kan réseau share dɔ kan?¶

Aw ye taamasiyɛn saba lajɛ: Fɔlɔ, ni... NAS web administration dondaw yɔrɔ yɛrɛ ye kunmabɔnafolo sɛbɛn dɔ bila a nɔ na (i n’a fɔ DeadBolt ye), walima ni NAS dɔrɔn de ye filenw siri k’a sɔrɔ i ka ɛntɛrinɛti kan PC bɛɛ saniyalen don, o porogaramu jugu bɛ baara kɛ NAS Linux OS kɔnɔ k’a ɲɛsin a yɛrɛ ma. Filanan, da wuli NAS Jɛɲɔgɔnya sɛbɛn / SMB Filenw cili sɛbɛn (Synology kɔnɔ Log Center (Jɛkulu min bɛ wele ko Log Center). walima QNAP QuLog Centre (Centre de QuLog) ye): n’i ye sigida LAN IP ladɛrɛsi ye (i n’a fɔ 192.168.1.24. Bamako, Mali) ka teliya ba tan ni tan kɛ Sɛbɛnni / Tɔgɔ caman cili / Bɔ opereli kɛra ka ban SMB ye, o kɔfɛ ɔridinatɛri at 192.168.1.24. Bamako, Mali ye minɛn bananen ye min bɛ i ka NAS siri ɛntɛrinɛti kan.

Mun na o kɛra DeadBolt n ka videyo walima database file belebelebaw daminɛ dɔrɔn de siri, ani yala hali bi n bɛ se ka file sirilenw tulon kɛ walima k’u dilan wa?¶

Walasa ka NAS marayɔrɔ terabayiti tan tan siri sani a tigi ka disque durw sɔgɔsɔgɔ ani ka plug sama, strains like DeadBolt ye dɔrɔn encrypt the fɔlɔ kilobayiti 512 (`524,288 bytes`) . ka dosiye kelen-kelen bɛɛ la ani ka fara a kan .deadbolt ye janya, ka dosiye gigabayiti tɔw to u ma maga sɛbɛnni gansan kɔnɔ. K’a sɔrɔ KB 512 fɔlɔ bɔnɛni bɛ sɛbɛn misɛnninw ni JPEG fotow tiɲɛ pewu, videyo fiyɛli belebelebaw minnu bɛ gigabayiti caman sɔrɔ (`.mp4`, . `.mov`, . `.mkv`), kamera raw ja, ani masin virtuel disiki ja dɔw (`VMDK`/ .`VHDX`) walima SQL kunnafonidilanw bɛ se ka dilan tuma caman na ni minɛn kuncɛcogo ɲuman dɔ cili ye (`moov` atom) ka bɔ wideyow wɛrɛ la min minɛna ni kamera kelen ye ni baarakɛminɛnw ye i n’a fɔ untrunc (baarakɛbaliya)..

Ni Synology ye QuickConnect walima myQNAPcloud Link safe ka to enabled ni n ye routeur UPnP ni Port Forwarding faga?¶

Ni routeur UPnP ani manual port forwarding (port forwarding) dabilalen don pewu, outbound relay services i n’a fɔ Synology QuickConnect Relay (Relay) min bɛ wele ko QuickConnect ani myQNAPcloud Ladɛrɛsi bɛ lakana kosɛbɛ ka tɛmɛ WAN dakun dafalenw kan bawo u tɛ lamɛnni dakunw da wuli i ka routeur firewall kan. Nka, u bɛ i ka NAS dondaw jira hali bi (`DSM` / . `QTS` web authentication handler) ka di mɔgɔ o mɔgɔ ma min bɛ i ka `QuickConnect ID`. Walasa ka lakana caman sɔrɔ, i ka foroba relay sɔrɔli bali ka don admin interface la ani ka baara kɛ ni a ye Kɔnɔnafili walima WireGuard VPN ye o nɔ na, min bɛ kriptografiki minɛnw tiɲɛni de wajibiya ka kɔn o ɲɛ HTTP pake kelen bɛ se ka se hali i ka NAS ɛntɛrinɛti baarakɛyɔrɔ la.

Yala ne ka kan ka Bitcoin kunmabɔnafolo sara o la wa DeadBolt, . Qlocker, walima eCh0raix ni n tɛ ni backups ye ani ni snapshots tɛ n bolo?¶

Sariya labatoli baaradaw (`FBI`, . `CISA`, . `Europol`, . `NCSC`) bɛ ladilikan di kosɛbɛ kunmabɔnafolo sarali ma bawo wari sarali bɛ jurumukɛlaw ka tɔnw musakaw di, wa a tɛ garanti si ta ko binkannikɛla ka otomatiki decryption script bɛna baara kɛ k’a sɔrɔ a ma dosiyew tiɲɛ. Sani i ka wari sarali jateminɛ: (1) I ka disiki ja walima k’u mara walasa i kana ko juguya, (2) Aw ye ** lajɛ .`nomoreransom.org`** ani ** .`deadbolt.responders.nu`** k’a lajɛ ni sariyatigiw ye master key minɛ kaban i ka strain kama, (3) For ** .`Qlocker`**, boli **`PhotoRec` / . `QRescue`** disiki yɔrɔ min ma tila (min bɛ to ka 60% fo 90% sɔrɔ fɔlɔ minnu bɔra yen fu), ani (4) For large `.mp4`/ .`.mov` wideyow minnu gosira ni partial-header encryption ye, test header reconstruction ni `untrunc`.

--- .

Gafe minnu bɛ tali kɛ o ko la¶

• Malware, ransomware ani spyware banakisɛ: a kunbɛnni teliya la ani a lasegincogo
• So routeurw ni IoT minɛnw lakanani
• NAS RAID sɛrɛkili tiɲɛna, drive caman dɛsɛra, ani ZFS/Btrfs seginni
• Ɔridinatɛriw ka kɔpiw, 3-2-1 fɛɛrɛ, ani balawu lasegincogo
• Zero-day exploit kɔrɔtɔko patching ani ɲɛnamaya laban minɛnw isolation
• Kɔrɔtɔko nimɔrɔw ka kɛɲɛ ni jamana ye

--- .

Sosow ani ɲɛmɔgɔyaso ka bilasiralikan¶

• Sibɛri lakanani ni fɛnsɔrɔsiraw lakanani baarada (CISA) & Fɛdɛrali ka sɛgɛsɛgɛli biro (FBI) ( ) ( ) .StopRansomware.gov): Alert on Réseau-Attaché Storage (NAS) Minɛn minnu laɲininen don DeadBolt, Qlocker, eCh0raix ani Akira Ransomware fɛ.
• Europol Erɔpu Sibɛri juguya yɔrɔ (EC3) & Hollande jamana polisiw (Politie) ( ) ( ) .NoMoreRansom.org): Operation DeadBolt Key Seizure, eCh0raix Decryptor Repository, ani Ransomware nɔgɔyali laadilikanw.
• QNAP ka fɛn dilannenw lakanani ko kɛlenw jaabi jɛkulu (QNAP PSIRT) & Synology Lakanali Ladilikanjɛkulu: Fɛɛrɛbɔsɛbɛn minnu bɛ Router UPnP bali, ka Admin Consoles Hijacked Recovery, QRescue (PhotoRec) Segin-ka-bɔnye min ma tila, ani Enabling Immutable WORM Snapshots (Ja minnu bɛ kɛ ɲɔgɔn fɛ*.
• Jamana ka Sibɛri Lakanali yɔrɔ (NCSC) (Royaume-Uni): Ka porogaramu juguw ni Ransomware nɔgɔya réseau marayɔrɔ ni biro minɛn fitininw kan.