Ransomware i runga i te Kainga, Tari NAS ranei (Synology/QNAP): Whakamutua te Whakamunatanga me te Whakaaturanga UPnP¶

Te rongo i nga puku pakeke kei roto i to Rokiroki-Apitihanga Whatunga (NAS) taputapu (Synology DiskStation, QNAP Turbo NAS, TrueNAS, Asustor, TerraMaster, ranei Western Digital My Cloud) patupatu tonu i te 100 ōrau te whakamahi kōpae i te wā e whakakī ana ngā kōpaki tiritahi .deadbolt, .ech0raix, .qlocker, .7z, .lockbit, ranei .encrypt Ko nga toronga o nga konae (me te kite ranei i to mata takiuru paetukutuku NAS kua whakakapihia e te tono utu Bitcoin) he ohorere rokiroki tino nui. Ko nga taputapu NAS he tino whainga mo nga botnets ransomware ipurangi-whānui (DeadBolt, Qlocker, eCh0raix / QNAPCrypt, AgeLocker, Chatterbox, a Akira) na te mea ko te NAS kotahi karekau i papaki he maha nga wa e mau ana i te 10 ki te 100 terabytes o te oranga matihiko katoa o te whanau, pakihi iti ranei, a he maha nga wa ka kitea tika atu ki te ipurangi whanui me te kore e mohio te rangatira ma te ** Router UPnP (Universal Plug and Play) Tauranga-Whakamua-Aunoa** ranei te kaihoko ratonga-kapua (myQNAPcloud, Synology QuickConnect, EZ-Internet). I mua i to wetewete i te taura hiko AC mai i te pakitara, me whakarite e koe he whakatau hoahoanga 10-tuarua i runga i te mea kei te whakamahi to NAS i nga whakaahua kape-i-Tuhituhi (Btrfs ranei ZFS) he huinga RAID tuku iho ranei; mo nga tukinga huinga kōpae kore-ransomware, tirohia Kua whakahekehia te raupapa NAS RAID, he maha nga puku puku, me te whakaora ZFS/Btrfs, a mo nga mate ransomware e pa ana ki te PC, tirohia malware, ransomware, me te mate torotoro me te te whakapumau i nga pouara kaainga me nga taputapu IoT. Mēnā ka pā te ransomware ki ngā whakahaerenga hōhipera, ngā ratonga ohorere a te taone nui, te hanganga haumaru tinana ranei, waea atu ki to nama whawhati tata (911 i te United States me Canada, 112 puta noa i te Kotahitanga o Europi, 999 i roto i te United Kingdom) tirohia ranei to maatau raarangi mo te ao tau ohorere.

Mahia tenei inaianei¶

1. Toia te Itarangi tinana (RJ45 / 10GbE) (ngā) taura whatunga kei muri o te NAS I NAIANEI, i mua i te pa ki te taura hiko:
2. Ko te wetewete i te (ng) taura Ethernet ka wehe tonu i te huihuinga whakahau-a-whakahaere a te kaitukino SSH/HTTP, ka aukati i te NAS ki te tango i nga utu whakamunatanga tuarua, a, he mea nui ano, ** ka aukati tonu i te PC papamahi kua pangia ki to tari tari rohe ki te whakamuna i to NAS i runga i nga hea whatunga SMB/CIFS (\\NAS\Share)**.
3. Whakatauhia i roto i te 15 hēkona mena ka tapahia te hiko, ka aukati ranei i te mahi whakamunatanga:
4. Tauari A: Kei te rere te ransomware ki runga i te PC papamahi i runga i to LAN me te whakamuna i nga konae NAS ki runga i te Puku Whatunga SMB/Maherea: Toia noa te taura NAS Ethernet i te Hipanga 1 kua mutu te 100% o te whakamunatanga ki te NAS. Waiho te NAS kia noho ma tonu tana huinga RAID me tana punaha konae, ka wehe i te teihana mahi Windows/Mac kua pangia.
5. Tauari B: Ko te ransomware rua kei te mahi tika ki ROTO i te punaha whakahaere NAS Linux ake (DeadBolt, Qlocker, eCh0raix):
   • Mena kei a koe **kaore i a koe Btrfs ranei ZFS kua whakahohea nga whakaahua (hei tauira, he tawhito ext4 rōrahi) a kei te kaha te huri haere o nga puku i te wa e whakamuna ana e te NAS to kape anake o nga konae, pehia me te pupuri i te Patene Hiko o mua tinana i runga i te NAS mo te 5 ki te 10 hēkona kia kaha ai te whakakore i te hiko tere tere (ka toia ranei te mono hiko DC/AC mena karekau te paatene). Ia meneti ka mau tonu te hiko o te NAS ka taea e tana PTM te whakamuna i etahi atu 5 ki te 20 kikipaita o o konae.
   • He whakatupato nui (Why DeadBolt & Qlocker victims must NOT reboot after recovery): Ransomware riaka rite Qlocker (e nuku ana i nga konae ki te whakamarumaru-kupuhipa .7z pūranga whakamahi 7z) me DeadBolt i etahi wa ka mau ki roto i te ahua whakamunatanga kaha, i nga taviri wetemuna ranei /tmp (RAM) kahakina ranei te UI paetukutuku-rua (/home/httpd/index.html). Mena kei a koe tonu he anga pakiaka SSH rohe tuwhera ki te NAS, tirohia ps aux a /tmp i mua i te whakaweto (tirohia te Wāhanga 2 i raro nei).
6. Takiuru ki to pouara ipurangi / pātūahi (192.168.1.1 / 192.168.0.1 / UniFi / pfSense / ISP gateway) tonu ka whakaweto UPnP (Universal Plug and Play) KA mukua nga ture Whakamua Tauranga WAN katoa e tohu ana ki to NAS:
7. Neke atu i te 80 paiheneti o nga mate ransomware NAS i te kaainga me te tari iti ka pa mai na te mea i paatohia e te kaiwhakamahi te "Whakaaturanga Pouara Aunoa / EZ-Ipurangi / UPnP" i te wa o te tatūnga tuatahi, nana i whakahau te pouara kaainga ki te whakatuwhera ** tauranga TCP 5000, 5001, 8080, 8443, 443, 22 (SSH), ranei 445 (SMB)** tika ki te ipurangi whanui katoa (Shodan.io / Censys).
8. Monokia te UPnP i roto i nga tautuhinga WAN/NAT o to pouara ka mukua ia ture tuku tauranga e tohu ana ki te wahitau IP rohe o te NAS.
9. Kaua e arawhiti, whakahōputu, whakahaerehia ranei "Tautuhi / Whakahouhia te DSM, QTS ranei" i runga i nga puku pakeke i mua i te tirotiro mena ka kahakina e te ransomware te wehenga OS anake, te rahinga raraunga ranei:
10. I nga whakaeke penei DeadBolt, ka tuhirua te malware i te wharangi takiuru tukutuku NAS (index.html) ki te whakaatu i tetahi tuhipoka utu mata-katoa e aukati ana i te uru ki te papatohu kaiwhakahaere QNAP/Synology, ** ahakoa kei raro koe Btrfs / ZFS Ko nga whakaahua me nga konae ataata nui (neke atu i te 20 megabytes) kei te 100 paiheneti tonu kei runga i nga puku**.
11. Tirohia mena kei to NAS Btrfs (Synology Snapshot Replication), ZFS (TrueNAS / QuTS hero), ranei LVM Nga Whakaahua Taumata-Poraka (QNAP Storage & Snapshots):
12. No te mea Btrfs a ZFS he panui-anake nga whakaahua ki te paparanga paraka punaha konae (me Synology WORM / Kare e taea te whakakore i nga whakaahua kore e taea e tetahi kua taupatupatu root admin), ka taea e koe te huri whakamuri 100 ōrau o ō kōpaki tiritahi whakamunatia i roto i te 60 hēkona me te kore ngaronga raraunga me te utu kore utu.
13. I mua i te utu utu, tautuhia te riipene ransomware e whakamahia ana ID Ransomware (id-ransomware.malwarehunterteam.com) me No More Ransom (nomoreransom.org):
14. He maha nga momo ransomware NAS nui (eCh0raix / QNAPCrypt, moata Qlocker mā photorec / qrescue tangohanga rakau, Muhstik, a SynoLocker) he kaore he kaiwhakawhanake mo te iwi, he tikanga tango-ki-ki-a-matau ranei e whakaputaina ana e nga kai-whakahaere ture me nga kairangahau haumaru.

Rakau whakatau: te whakamatautau NAS ransomware me te ara whakaora¶

Whakamahia tenei rerengamahi ki te whakatau mena i ahu mai te whakaeke mai i te rorohiko LAN, i runga ranei i te NAS, ka kowhiria te tikanga whakaora haumaru:

flowchart TD
    Symptom["NAS Drives Grinding at 100% + Kōnae Whakaingoa Houtia (.deadbolt, .7z, .ech0raix, .lockbit) ranei Tukutuku UI Whakaatu Mata Whakaora"] --> PullLAN["STEP 1 (I roto i te 5 Hekona): Wewetehia nga taura Ethernet katoa mai i te tuara o te NAS"]

    PullLAN --> SourceCheck{"I whakamutua e te Whakamuna te Waea i Wewetehia e koe te taura NAS Ethernet?"}

    SourceCheck -->|"ĀE: Ko Te Mahi Kōpae i Whakataka ki te Kore I te Wetenga o LAN"| SMBVector["PUTANGA A: Kei te Rere te Ransomware i runga i te PC Windows/Mac i runga i to Whatunga me te Whakamuna i nga Kōpaki Tiriri ki runga i te SMB"]

    SourceCheck -->|"KO: Ko nga Puku Maamaa NAS Ka Tonu Ki Te Itarangi Kua Wetewete (Ko te wharangi Takiuru Tukutuku NAS I Whakakapihia e te Mata Utu)"| DirectNAS["PUTANGA B: Ko te Ransomware Binary kei te whakahaere tika i roto i te NAS OS (I whakamahia ma UPnP / Tauranga WAN Whakaatu 5000, 5001, 8080, 443, 22)"]

    SMBVector --> IsolatePC["Kimihia & Momotuhia te PC kua pangia i runga i to LAN -> Whakahokia nga Kōpaki Tiri NAS Mai i nga Btrfs / ZFS / QNAP Snapshots or Hyper Backup"]

    DirectNAS -->SSHCheck{"Kei a koe tetahi Wātū SSH Arohe Whakatuwhera (Ko Qlocker ranei kei te Rere 7z)?"}

    SSHCheck -->|"Ae (Qlocker / Active 7z Tukanga)"| GrabPass["Tirotiro ps aux | grep 7z i runga i te SSH ki te Hopu Kupuhipa 7-Zip Kupuhipa Mai i te Raina Whakahau Args I mua i te Tukatuka Whakamate"]
    SSHCheck -->|"Karekau he SSH / Kopae Miihini Riu Kaore e Mohiotia"| PowerOff["Puritia te Patene Hiko NAS mo te 5-10 Hekona ki te Whakawete i te Hia Maamaa Kia Whakamutua Nga konae Whakamuna me te Mokowā Kore Ka tiakina"]

    GrabPass --> KillUPnP["STEP 2: Takiuru ki Router -> Monokia UPnP Tuturu + Mukua Nga Ture Whakamua Tauranga (5000, 5001, 8080, 443, 22)"]
    PowerOff --> KillUPnP
    IsolatePC --> KillUPnP

    KillUPnP --> RecoveryPath{"He aha nga rawa whakaora kei runga i te NAS?"}

    RecoveryPath -->|"Btrfs / ZFS / QNAP Poraka Hopu whakaahua kei reira"| SnapRestore["Maemaa te Wehewehenga OS / Whakahou Whakahou -> Huri Whakamuri i nga Kōpaki Tiriri ki te Whakaahua o mua i te whakaeke"]
    RecoveryPath -->|"USB o waho / Pūrua Kapua waho (Pūrua Hiper / HBS 3)"| BackupRestore["Ūkui & Hangaia ano te NAS ki runga i te Roopu Whakapaipai -> Whakaora Mai i te Tuimotu/Kapua Pūrua"]
    RecoveryPath -->|"Karekau he whakaahua me te kore he taapiri"| ForensicCarve["Puku Clone Panui-anake -> Tirohia NoMoreRansom.org + Whakahaere PhotoRec / QRescue Whakairo Kore I Toha (Tino Rawa Ki Qlocker)"]

Me pehea te pakaru o te NAS Ransomware: Ko nga Vectors whakaeke e rua¶

I mua i to whakauru i to NAS ki roto i to whakawhiti whatunga rohe, me mohio koe ko wai o nga vectors urunga rereke e rua i whakaaetia te ransomware ki o pukapuka rokiroki:

Wāhanga 1: Whakaweto i te Whakaaturanga Ipurangi (Router UPnP, Port Forwarding, me nga Kapua Relay)¶

Mena ka horoi koe, ka whakaora ranei i to NAS me te kore e kati i te kohao whatunga i runga i to pouara, ko nga botnets aunoa e matawai ana i to wahitau IP whanui ka pangia ano te NAS i roto i nga haora o te whakahoki mai i te ipurangi. Whakaotia tenei raka whatunga i to pouara tuatahi:

1. Takiuru ki roto i to Pouara Ipurangi / Papatohu Whakahaere Pātūahi:
2. Whakatuwheratia he kaitirotiro i runga i te rorohiko ma, waea ranei ka whakatere ki te keti IP o to pouara (te tikanga 192.168.1.1, 192.168.0.1, 10.0.0.1, ma to taupānga pouara mata penei UniFi, Eero, Google Home, TP-Link Deco, ASUS Router, Netgear Nighthawk).
3. ** Monokia UPnP (Universal Plug and Play) Tuturu**:
4. Whakatere ki ** Arā Atu > NAT Whakamua / WAN / Whatunga > UPnP** ka takahuri UPnP ki OFF / Monokia.
5. He aha UPnP he tino kino mo nga kaipupuri NAS: Ina whakahohea te UPnP i runga i to pouara, ka taea e tetahi taputapu kei runga i to whatunga rohe (tae atu ki te ruānuku "EZ-Internet" o te NAS, "Whakaaturanga Pouara Aunoa", he kino ranei i runga i te pouaka whakaata atamai) IGD (Internet Gateway Device) tono ki to pouara me kii "Whakatuwherahia te Tauranga WAN waho 8080 me te 5001 ki taku IP rohe 192.168.1.50", maataki i to papangaahi me te kore tono mo to kupuhipa pouara.
6. Mukua Katoa te Whakamua Tauranga Tauranga (Virtual Server) & DMZ Nga Ture e tohu ana ki te NAS:
7. Haere ki te ** Arā Atu Anō > Whakamua NAT > Tauranga Whakamua (Tūmau Mariko ranei)** ka mukua nga ture tuku whakamua TCP, UDP ranei tauranga (80, 443, 5000, 5001, 8080, 8443, 21 FTP, 22 SSH, 873 rsync, 445 SMB, 32400 Plex ki te kore e hiahiatia) ki to NAS IP.
8. Tirohia Advanced > DMZ ka manatoko e DMZ Host is Disabled (te whakatakoto i te NAS IP ki roto i te DMZ o te pouara ka kitea nga tauranga 65,535 TCP me te UDP o te NAS ki te ipurangi whanui).
9. Whakamanahia mai i waho o to Whatunga kei te tuwhera nga Tauranga Zero NAS:
10. Tirohia shodan.ioranei grc.com (ShieldsUP) ranei whakahaere he tauranga karapa ki to wahitau IP WAN tūmatanui hei whakaū i aua tauranga 5000, 5001, 8080, 8443, 443, a 22 inaianei hoki mai Filtered / Stealth / Closed.

Wāhanga 2: Te Whakatairanga Ohotata Tauwhāiti (Qlocker, DeadBolt, eCh0raix)¶

I mua i to muru i te NAS me te utu utu ranei, tirohia ko tehea momo ransomware NAS kua pa ki to taputapu. Kei ia whanau NAS nui nga ngoikoretanga hangarau motuhake e taea ai te whakaora i nga waahanga, i te katoa ranei o nga raraunga me te kore utu:

1. Mēnā I Whakakapia ō Kōnae ki .7z Pūranga (Qlocker i runga i te QNAP / Linux NAS)¶

Pehea Qlocker mahi: Engari ki te tuhi i tetahi miihini cryptographic ritenga, Qlocker ka whakahaere i tetahi tuhinga e kii ana i te NAS ake 7-Zip (/usr/local/sbin/7z) rua hei kōpeke i ia kōnae ki roto i te parenga kupuhipa .7z pūranga ka whakahaere i te Linux noa rm (unlink) i runga i te konae taketake. - ** Triage Triage #1 (Te hopu i te Kupuhipa Live in ps aux I mua i te Whakaweto): Mehemea Qlocker kei kei te rere tonu i runga i to NAS ka taea e koe te takiuru ki te takiwa ma te SSH (ssh admin@nas-local-ip), whakahaeretia tenei tono i mua tonu i te whakaweto:

ps aux | grep 7z

2. Mena I Whakakapia To Mata Takiuru NAS e te DeadBolt Whārangi utu (.deadbolt kōnae)¶

Pehea DeadBolt mahi: 1. DeadBolt whakakapi /home/httpd/index.html (ranei /home/httpd/cgi-bin/index.cgi) me tana ake wharangi-rua/HTML e kahaki ana i to kaitirotiro paetukutuku i nga wa katoa ka ngana koe ki te whakatuwhera i te papatohu QNAP QTS / Asustor ADM, me te tono Bitcoin hei utu mo te kii wetemuna rangatira 32-hex-tohu (ka tukuna ma te mekameka Bitcoin. OP_RETURN tauwhitinga). 2. Me pehea te whakahoki ano ki to QNAP QTS / QuTS hero Admin Dashboard me te kore e ngaro o raraunga: - Kōwhiringa A (Mā te SSH Paetata mēnā ka whakahohea): SSH ki te NAS ā-rohe (ssh admin@<nas-ip>), mutu te nauhea deadbolt te tukanga ki te rere, me te whakahaere i te tuhinga whakaora firmware mana a QNAP, te whakaora ranei i te mea taketake /home/httpd/index.html mai i te ahua ROM punaha panui-anake (/mnt/HDA_root/update_pkg/). - Kōwhiringa B (Kokopae Firmware Kohiko + Hoa-Hoa Whakauru Anō): 1. Whakawetohia te NAS. 2. Peia atu nga puku maro ki waho ma te 2 henimita (1 inihi) kia momotuhia mai i te waka rererangi o muri (taatahia te ota kokoru me te rīpene a te kaipeita i te tuatahi). 3. Te hiko i runga i te NAS kare he puku mārō, kimihia tana IP mā Qfinder Pro, ka akiakihia i runga i te mata tatūnga wera-monohia nga puku ki roto i o ratou kokoru tika, ka kowhiri "Whakahou Firmware Anake (Pupuri Raraunga Katoa me Tautuhinga)" (kaua rawa e pawhiria "Initialize System", ka muru i nga puku). 3. Ko te Panui Whakamunatanga Ture Nui i runga DeadBolt: I roto i nga mahi whakarite e arahina ana e te Te Pirihimana Motu o Tatimana (Politie), Europi (No More Ransom), me Responders.nu, i pai te tinihanga a te hunga whakahaere ture DeadBolt Ko nga kaiwhakaari whakatuma i te wa o te utu o te Mempool ka piki ake ki te tuku ** neke atu i te 150 nga taviri wetemunatanga matua** i mua i te whakakorenga o nga whakawhitiwhitinga Bitcoin iti-utu a nga kaiwhaiwhai ma te Whakakapi-Ma-Utu. Takitaki deadbolt.responders.nu a nomoreransom.org kia kite mena kei to motuhake DeadBolt Ko te kī wāhitau pārurenga i mauhia e ngā pirihimana.

3. Mēnā Ka Mutu ō Kōnae .encrypt (eCh0raix / QNAPCrypt)¶

• He maha nga reanga o eCh0raix (QNAPCrypt) i whakamahi i te takenga matua AES kohakore, i whai mana ranei (C2) te pātengi raraunga i mauhia e nga kairangahau haumaru me nga ture.
• Tirohia nomoreransom.org ka tuku ake i nga konae whakamunatia e rua (te tuhipoka utu ranei README_FOR_DECRYPT.txt) ki te whakamatautau i te Bitdefender / NoMoreRansom koreutu eCh0raix Decryptor i mua i te muru i tetahi mea.

Wāhanga 3: Whakaora i ō Kōnae mai Btrfs, ZFS, ranei QNAP Ko nga whakaahua i roto i te 60 Hekona¶

Mēnā i whakamuna tō NAS e Vector #2 (he PC kua pangia e te ransomware i runga i to LAN e whakamuna ana i nga kōpaki tiritahi ki runga i te SMB), mena he Immutable (WORM) Ko nga Whakaahua, ko nga LVM/Btrfs/ZFS Snapshots ranei i te whakaekenga tika a NAS, ka taea e koe te whakahoki i te 100 paiheneti o au konae tonu:

1. Synology Disk Station (DSM 7.x me Btrfs Hopu whakaahua)¶

1. Tuatahi, manatokohia kua momotuhia te PC kua pangia ki to LAN mai i te whatunga, ka whakahou i te Synology DSM ki te tukunga hou i raro i te ** Paewhiri Mana > Whakahou me te Whakaora**.
2. Whakatuwheratia te kete Snapshot Replication kei roto Synology DSM.
3. Pāwhiritia Whakaora i te paetaha maui.
4. Tīpakohia te Kōpaki Tirihi kua whakamunatia (ranei iSCSI LUN) ka paato i te Whakaora.
5. Tirotiro te rarangi o nga whakaahua kua whakaritea (GMT+...) ka kowhiri i te whakaahua i tangohia ** i mua tonu i te tiimata o te whakamunatanga ransomware** (tirohia Mahi > Tirotiro i te tuatahi ki te arokite i nga konae kei roto i taua whakaahua me te whakau he ma, kaore ano kia whakamunatia).
6. Patohia te Mahi > Whakahokia ki tenei whakaahua (ranei ** Clone me te ingoa hou** mena kei te pirangi koe ki te pupuri i te kōpaki whakamuna kia kaua e pa ki nga taunakitanga a te hunga tirotiro i te wa e mau tonu ana he kape ma o te kōpaki tiritahi).
7. No te mea Btrfs he kape-i-tuhi (CoW) te punaha konae, ka huri whakamuri i te kōpaki tiritahi 20-terabyte ki te whakaahua i mua i te whakaekenga ka iti ake i te 10 hēkona**.

2. QNAP NAS (QTS Nga Whakaahua LVM Taumata-Poraka & QuTS hero ZFS Whakaahua)¶

1. Kia papakihia te toa QTS/QuTS ka wehea mai i te WAN, whakatuwheratia Storage & Snapshots.
2. Haere ki te ** Rokiroki> Rokiroki/Snapshots**, tīpakohia tō rōrahi Mātotoru, Rōrahi Angiangi, Kōpaki Tiri ZFS rānei, ka paato i te Kaiwhakahaere Whakaahua (te tohu kāmera).
3. Tīpakohia te whakaahua maa whakamutunga i tangohia i mua i te tohu wa whakaeke.
4. Tirotiro i te rakau kōpaki kei roto i te pihanga matau ki te manatoko kei te mau tonu o konae, katahi ka paato i te Whakahokia te Whakaahua Rōrahi (ka kowhiria ranei nga kōpaki katoa ka paato i te Whakaora ki te tuhirua i nga konae whakamunatia anake).

3. TrueNAS (CORE / SCALE i runga ZFS) me te Unraid (ZFS / Btrfs)¶

• I te TrueNAS (ZFS): Haere ki te Storage > Snapshots (ranei Raraunga Tiaki > Nga Mahi Hopu Puputanga Waa), kimihia te whakaahua ma (tank/share@auto-2026-10-31_12-00), ka paato i te Whakahoki (whakakohia ranei te whakaahua ki tetahi huingararaunga hou zfs clone tank/share@auto-2026-10-31_12-00 tank/share_recovered kia kore koe e ngaro i nga whakaahua takawaenga hou ake).

Wāhanga 4: Whakapakeke i to NAS Kia kore ai e whakamunatia ano (Te Rarangi Arowhai 7)¶

Kia ora ake o raraunga, whakamahia enei ture whirihoranga e whitu ki runga i to taputapu Synology, QNAP, TrueNAS, Asustor ranei i mua i te hono ano ki te whatunga:

• 1. Kaua rawa e Whakamua i tetahi Tauranga i runga i to Pouara ki to NAS: Whakamahia Tailscale ranei WireGuard VPN Engari:
• Tāutahia te mōkihi Tailscale whaimana mai i te Synology Package Center / QNAP App Center (whakahaere ranei i te WireGuard VPN Server i roto i to pouara).
• Hangaia e Tailscale he whirihoranga-kore, hoa-ki-hoa WireGuard whakamunatia te kauhanga mata (100.x.y.z) i waenga i to waea, to pona, me to NAS kaore he tauranga tuwhera i runga i to papaahi pouara kaainga. Ka taea e koe te uru atu ki o whakaahua NAS, konae konae me te mata whakahaere mai i nga waahi katoa o te ao i te wa e noho tonu ana to NAS 100% e kore e kitea e nga kaitirotiro ipurangi penei Shodan.
• 2. Monokia te Taunoa Hanga-roto admin Kaute me te Waihangatia he Kaiwhakahaere Whakaingoa Ritenga me te 2FA Manaha:
• Ko te Synology DSM me te QNAP QTS te kaipuke me tetahi kaute taunoa ko admin(UID 1024 ranei UID 0). Ko nga karetao-a-aunoa ka patu i te ingoa kaiwhakamahi admin 24/7.
• Waihangahia he kaute kaiwhakahaere hou me te ingoa kaiwhakamahi ahurei, takiuru me taua kaute hou, haere ki Paawhiri Mana > Kaiwhakamahi & Rōpū (Kaiwhakamahi ranei), ka Whakakorea te taunoa admin pūkete.
• Whakakāhia Mandatory 2-Factor Authentication (OTP / Passkey / Approve Sign-in) mo nga kaute kaiwhakahaere katoa.
• 3. Whakakā Kore Whakarereke (WORM) Whakaahuatanga (7-to-14-Day Retention Lock):
• I runga i te Synology DSM 7.2+: Whakatuwheratia Snapshot Replication > Snapshots > Settings > Schedule, whakaahei i nga whakaahua o ia ra, ka tirohia "Whakahohehia nga whakaahua kore huri" me te wa whakamarumaru o 7 ki te 14 ra. Ahakoa ka tahae te kaikorero i to kupuhipa pakiaka, ka whakamahi ranei i te whakaraeraetanga kernel i roto i te DSM, kaore he tangata (kaore ano root) ka taea te muku i tetahi Whakaahua Whakarereke kia pau ra ano te karaka taputapu 7 ra.
• I runga i QNAP QuTS hero / QTS: Whirihorahia he Snapshot Replica Vault ka taea ranei WORM (Write Once, Read Many) kaupapa here pupuri i runga i nga hea taapiri tino nui, me te mohio kei te whakahohea te "Rahui Mokowhiti Whakaahua".
• 4. Whakawhāitihia nga Whakaaetanga Tiri Whatunga SMB (Least Privilege) No reira kare e taea e te Mate Pona te Whakamuna te NAS Katoa:
• Kaua rawa e mahere te rangatira o to NAS admin nga tohu kei roto i te Windows File Explorer (\\NAS\) i runga rorohiko o ia ra.
• Waihangahia he kaute kaiwhakamahi kore-kaiwhakahaere mo te uru ki nga konae i ia ra, ka whakarite i o kōpaki puranga/whakaahua (hei tauira, 2010-2025 Family Photos Archive) ki Pānui-anake (ro) mo nga kaiwhakamahi papamahi o ia ra, mena ka mau te PC Windows o tetahi mema o te whanau ki te ransomware, ka taea e te PC te panui i aua kōpaki engari kaore e taea te whakamuna, te whakarereke ranei.
• 5. Whakakāhia te NAS i Roto i te Paeahi (Allow LAN + Tailscale Subnets Only) & Paraka-Aunoa:
• Ki roto Synology Control Panel > Security > Firewall (ranei QNAP QuFirewall), hangahia he ture rarangi whakaahei kia taea ai nga hononga mai i to kupengaroto LAN rohe (192.168.1.0/24) me to kupengaroto Tailscale/VPN (100.64.0.0/10), ka whai i te ture raro kua whakatakotoria ki Whakakahore Katoa. Ahakoa ka huri pohehe te tangata UPnP ka hoki mai ano ki te pouara, ko te tātari putea a-roto a te NAS ka taka tonu ia mokete ipurangi whanui.
• 6. Monokia SSH (Port 22) me Telenet (Port 23) Ki te kore e kaha ki te rapu raru:
• Waiho SSH ka huri OFF ki roto ** Paewhiri Mana > Terminal & SNMP** i te wa e mahi noa ana ia ra; takahuri noa mo nga meneti 10 e hiahia ana koe ki te whakahaere i tetahi mahi raina whakahau, katahi ka huri whakamuri.
• 7. Kia mau ki te "3-2-1" Tikanga-a-rangi / Pūrua Kapua Whakarereke (Hyper Backup / HBS 3):
• Whaia to maatau nga taapiri rorohiko me te 3-2-1 aratohu whakaora kino: whirihora Synology Hyper Backup QNAP ranei Hybrid Backup Sync (HBS 3) ki te pana i te po whakamunatia, te taha-kiritaki i nga taapiri kua whakakorehia ki tetahi pukupuku USB o waho ka wetekina e koe, ki tetahi Anoa-Maukati (S3 Object Lock Compliance Mode) peere kapua (Backblaze B2, Wasabi, ranei AWS S3) ma te whakamahi i nga taviri API taapiri-anake.

Nga nama ohorere a rohe me nga tikanga umanga¶

Ko nga whakaekenga Ransomware e aro ana ki nga taputapu NAS e tirotirohia ana e nga umanga mahi ipurangi a-motu puta noa i te ao, e pupuri ana i nga putunga o nga taviri wetemuna kua mau (No More Ransom) me te whai i nga hanganga taihara:

• Te Hononga o Amerika me Kanata:
• Hure ohorere te ora-Haumaru mate: Waea 911 mena ka whakararu te ransomware i nga punaha hauora me nga punaha haumaru tinana.
• CISA & FBI Internet Crime Complaint Center (IC3): Pūrongo NAS ransomware kaupapa (DeadBolt, Akira, LockBit, Qlocker) i stopransomware.gov, ic3.gov, waea atu ranei ki a CISA i 1-844-Say-CISA (1-844-729-2472).
• Canadian Center for Cyber Security & RCMP: Ripoata i cyber.gc.ca(1-833-CYBER-88) ranei te Canadian Anti-Fraud Centre.
• United Kingdom:
• Ratonga Ohotata: Waea 999 (ranei 101 mo nga pirihimana kore ohorere).
• Hini Mahi me te NCSC: Ripoata i nga maiki ransomware i actionfraud.police.uk waea mai ranei 0300 123 2040 (24/7 ora ipurangi maiki raina). Ka taea e nga pakihi iti me nga umanga atawhai te korero ki te NCSC Cyber Incident Response (ncsc.gov.uk) tomokanga.
• Uniana Pākehā:
• Ratonga Ohotata: Waea 112 puta noa i nga whenua mema EU katoa.
• Europol European Cybercrime Centre (EC3) & NoMoreRansom.org: Taki nomoreransom.org (e pupuritia ana e nga Pirihimana a-Motu o Tatimana, Europol, me nga tari hoa) mo nga taviri wetemunatanga ransomware NAS, me te tuku korero ki to CSIRT motu me te Mana Tiaki Raraunga (DPA i roto i nga haora 72 mena ka whakakorehia nga raraunga whaiaro, ka ngaro ranei i raro i te GDPR).
• Ahitereiria me Aotearoa:
• Ratonga Ohotata: Waea 000 i Ahitereiria ranei 111 kei Aotearoa.
• Te Pokapū Haumaru Haumaru o Ahitereiria (ACSC): Waea atu ki te Waea Hotline 24/7 Ransomware i 1300 CYBER1 (1300 292 371) me ripoata ranei i cyber.gov.au.
• CERT NZ: Pūrongo i cert.govt.nz.
• India me Ahia-Kiwa:
• India (CERT-In & Waea Awhina Cyber Crime): Waea 1930 ranei ripoata i cybercrime.gov.in me incident@cert-in.org.in.
• Taiwan (TWCERT/CC, te mana o te kainga o Synology, QNAP, me Asustor PSIRTs): Tukuna tika nga tikiti maiki haumarutanga kaihoko ki QNAP PSIRT (service.qnap.com) ranei Synology PSIRT (synology.com/en-global/security/advisory).

Pātai auau¶

I pehea te ransomware i pangia e taku QNAP, Synology NAS ranei i te mea kaore au i paato i tetahi hononga hītinihanga ka ma katoa aku rorohiko?¶

I pangia to NAS mai i te ipurangi whanui me te kore e pa ki o rorohiko. Kei to pouara ipurangi UPnP (`Universal Plug and Play`) kua whakahohea (whakaaetia te waahanga "Whakawhiringa Pouara Aunoa / EZ-Internet / myQNAPcloud" ki te whakatuwhera wahangu i nga tauranga 8080, 443, 5000, 5001, ranei 22 i runga i to papangaahi), i tukuna ranei e koe he tauranga kia uru atu ki o konae. Ko nga botnets aunoa ka tirotiro tonu i nga wahitau IP katoa i runga i te ipurangi me te whakamahi i nga whakaraeraetanga kaore ano kia pakaruhia, he ngoikore ranei. kaiwhakahaere kupuhipa i runga i nga atanga tukutuku NAS kua kitea.

Me pehea ahau e mohio ai mena i rere tika te ransomware ki roto i taku NAS OS me tetahi o aku rorohiko Windows i runga i te tiritahi whatunga?¶

Titiro ki nga tohu e toru: Tuatahi, mena ko te Ko te mata takiuru whakahaere tukutuku a NAS ano i whakakapihia e te utu utu (penei Patuamate), mena ka whakamunatia e te NAS nga konae i te wa e ma ana nga PC katoa i runga i to whatunga, ka mahia te kino kino ki roto tonu i te NAS Linux OS. Tuarua, whakatuwheratia te Rangitaki Hononga NAS / Rangitaki Whakawhiti Kōnae SMB (i roto i te Synology Pokapū Rangitaki QNAP ranei Pokapū QuLog): ki te kite koe i tetahi wahitau IP LAN rohe (penei 192.168.1.24) e mahi ana i nga mano tini o te tere Tuhia / Whakaingoa ano / Mukua kua mutu nga mahi SMB, katahi te rorohiko i 192.168.1.24 Ko te taputapu pangia e whakamuna ana i to NAS i runga i te whatunga.

Na te aha DeadBolt whakamuna anake te timatanga o aku ataata nui, konae raraunga raraunga ranei, ka taea tonu e au te purei, te whakatika ranei i etahi konae kua whakamunatia?¶

Hei whakamuna i te tekau terabytes o te rokiroki NAS i mua i te kitenga o te rangatira kei te huri haere nga puku pakeke me te kumea i te mono, he uaua penei Patuamate whakamuna anake te tuatahi 512 kiropaita (`524,288 bytes`) o ia kōnae me te taapiri i te .deadbolt toronga, ka waiho nga toenga gigabytes o te konae kaore i pa ki roto i nga tuhinga noa. I te ngaronga o te 512 KB tuatahi ka ngaro katoa nga tuhinga iti me nga whakaahua JPEG, kōnae ataata maha-kipaita nui (`.mp4`, `.mov`, `.mkv`), te rīpene kāmera mata, me etahi whakaahua kōpae miihini mariko (`VMDK`/`VHDX`) he maha nga wa ka taea te whakatika i nga raraunga SQL mā te whakawhiti i tētahi pane ipu whaimana (`moov` ngota) mai i tetahi atu ataata i tuhia me te kamera ano e whakamahi ana i nga taputapu penei unuhanga.

Ko Synology QuickConnect ranei myQNAPcloud Link he haumaru ki te waiho ki te whakawetohia e ahau te pouara UPnP me te Tauranga Whakamua?¶

Na te UPnP pouara me te tuku whakamua tauranga a-ringa kua whakaweto katoatia, ko nga ratonga reera ki waho penei i te Synology Rere Hono Tere a myQNAPcloud Hononga he tino haumaru ake i nga tauranga WAN tuwhera na te mea kaore e whakatuwherahia nga tauranga whakarongo ki to papaahi pouara. Heoi, ka whakaatu tonu ratou i to mata takiuru NAS (`DSM` / `QTS` te kaikawe motuhēhēnga tukutuku) ki te tangata e mohio ana, e matapae ana ranei i a koe `QuickConnect ID`. Mo te tino haumarutanga, whakawetohia te urunga rei a te iwi ki te atanga whakahaere me te whakamahi Tauine hiku ranei WireGuard VPN engari, me whakamotuhēhēhia te taputapu cryptographic i mua Ka taea e te paatete HTTP kotahi te toro atu ki to tuumau paetukutuku NAS.

Me utu e ahau te utu Bitcoin mo DeadBolt, Qlocker, ranei eCh0raix mena karekau he taapiri me te kore whakaahua?¶

Nga tari whakahaere ture (`FBI`, `CISA`, `Europol`, `NCSC`) e tino tohutohu ana kia kaua e utu utu na te mea ka utua e te utu nga roopu taihara me te kore he taurangi ka mahi te tuhinga wetemuna aunoa a te kaitukino me te kore e pakaru nga konae. I mua i te whakaaro ki te utu: (1) Whakaahuahia, tiakina ranei nga puku kia kore ai koe e kino ake, (2) Tirohia **`nomoreransom.org`** me **`deadbolt.responders.nu`** ki te kite mehemea kua kapohia e te hunga whakahaere ture te ki matua mo to riu, (3) Mo **`Qlocker`**, rere **`PhotoRec` / `QRescue`** i runga i te mokowā kōpae kare i tohatohahia (e whakaora ana i te 60% ki te 90% o nga mea taketake kua mukua mo te kore utu), me te (4) Mo te nui `.mp4`/`.mov` nga ataata i patua e te whakamunatanga pane-waahanga, te hanga ano o te pane whakamatautau me te `untrunc`.

Nga kaiarahi e pa ana¶

• Malware, ransomware, me te mate torotoro: te pupuri tonu me te whakaora
• Te whakamarumaru i nga pouara kaainga me nga taputapu IoT
• Kua whakahekehia te raupapa NAS RAID, he maha nga puku puku, me te whakaora ZFS/Btrfs
• Nga taapiri rorohiko, te rautaki 3-2-1, me te whakaora i nga aitua
• Kore-ra te whakamahi i te papaki ohorere me te wehenga taputapu mutunga-ora
• Ko nga nama ohorere ma te whenua

Nga puna me nga aratohu whai mana¶

• Pokapü Haumaru Haumaru me te Hanganga Hangarau (CISA) & Federal Bureau of Investigation (FBI) (StopRansomware.gov): Matohi mo te Rokiroki-Apitihanga Whatunga (NAS) Ko nga taputapu kua tohua e DeadBolt, Qlocker, eCh0raix, me Akira Ransomware.
• Europol European Cybercrime Centre (EC3) & Pirihimana National Dutch (Politie) (NoMoreRansom.org): Operation DeadBolt Key Seizure, eCh0raix Decryptor Repository, and Ransomware Mitigation Guidelines.
• QNAP Product Security Incident Response Team (QNAP PSIRT) me te Poari Tohutohu Haumarutanga Synology: Nga Panui Hangarau mo te Whakakore i te Pouara UPnP, Te Whakaora i nga Kaitohu Whakahaere kua kahakina, QRescue (PhotoRec) Whakaora Kore i tohatohahia, me te Whakahohe i te Whakahuri WORM Whakaahuatanga.
• Pokapū Haumaru Haumaru Motu (NCSC) (United Kingdom): Whakaitihia te Malware me te Ransomware i runga i te Rokiroki Whatunga me nga taputapu Tari Iti.