Skip to content

Ivyuma vy’incungu ku NAS yo mu nzu canke yo mu biro (Synology/QNAP): Guhagarika ugushiramwo amakuru n’ugushirwa ahabona kwa UPnP

Igitigiri c'ivyihutirwa gitandukanye hakurikijwe igihugu. Iyi paji ikoresha 911, inomero ya Leta Zunze Ubumwe za Amerika na Canada. Ibindi bihugu vyinshi bikoresha 112, 999 canke uwundi mubare. Rondera umubare w'igihugu cawe.

Kumva ama hard drive ari mu bubiko bwawe bufatanye n'urubuga (NAS) igikoresho (Synology DiskStation, QNAP Turbo NAS, TrueNAS, Asustor, TerraMaster, canke Western Digital My Cloud) gutera ubudasiba ku 100 kw'ijana kw'ikoreshwa rya disiki mu gihe amadosiye asangiye yuzuye .deadbolt, .ech0raix, .qlocker, .7z, .lockbit, canke .encrypt file extensions (canke kubona urubuga rwawe rwa NAS rwo kwinjira mu rubuga rwawe rusubirijwe n’ugusaba incungu ya Bitcoin) ni ikintu gikomeye co kubika. Ivyo bikoresho vya NAS ni vyo bikoreshwa cane ku bikoresho vy’ubuhinga bwa none vy’ubuhinga bwa none (DeadBolt, Qlocker, eCh0raix / QNAPCrypt, AgeLocker, Chatterbox, na Akira) kubera ko NAS imwe idafise amabara akenshi ifata amaterabytes 10 gushika ku 100 y’ubuzima bwose bw’umuryango canke bw’ubucuruzi buto kandi akenshi igaragara ataco ihinduye kuri interineti ya bose ata nyirayo abimenye biciye ku Router UPnP (Universal Plug and Play) Ukwirungika-Ikivuko canke ibikorwa vy'ugutanga igicu (myQNAPcloud, Synology QuickConnect, EZ-Internet). Imbere y’uko ukura umugozi w’amashanyarazi wa AC mu ruhome, utegerezwa gufata ingingo ihambaye y’ubwubatsi y’amasegonda 10 ishingiye ku kuba NAS yawe ikoresha amafoto y’ugukopa ku kwandika (Btrfs canke ZFS) canke urutonde rwa RAID rwa kera; ku bijanye n'ugusenyuka kw'imirongo y'amadisiki atari aya ransomware, raba NAS RAID array yasenyutse, umuduga mwinshi warananiwe, n'ugusubirana kwa ZFS/Btrfs, no ku bijanye n’indwara ziterwa n’ibintu bikoreshwa kuri PC, raba . porogaramu mbi, porogaramu y'incungu, n'indwara y'ubutasi hamwe gukingira ama router yo muhira n'ibikoresho vya IoT. Nimba iyo porogarama y’incungu igira ingaruka ku bikorwa vy’ibitaro, ku bikorwa vy’ubutabazi vyihutirwa vy’igisagara, canke ku bikorwa remezo vy’umutekano wo ku mubiri, hamagara inomero y’ubutabazi bwihutirwa yo mu karere kawe (911 muri Leta Zunze Ubumwe za Amerika no muri Kanada, 112 mu bihugu vyose vy’Ubumwe bw’Uburaya, 999 mu Bwongereza) canke urabe ububiko bwacu bw’ibitabu mpuzamakungu . inomero z'ivyihutirwa.

Ivyo ubikore ubu

  1. Kura Ethernet y'umubiri (RJ45 / 10GbE) umugozi w'uruja n'uruza uva inyuma ya NAS UBU BUNE, imbere yo gukora ku mugozi w'amashanyarazi:
  2. Gukuraho umugozi wa Ethernet bica bica igice c’itegeko n’ubugenzuzi c’umuterabwoba, bihagarika NAS gukuraho ibikoresho vy’ububiko bw’inyuma, kandi, bihambaye nk’ivyo, bica bihagarika ubwo nyene PC y’ibiro vyawe vyo gusangira NMBCIFS LAN yawe ku rubuga rwawe rw’ububiko (\\NAS\Share).
  3. Menya neza mu masegonda 15 nimba wogabanya ubushobozi canke wohagarika igikorwa co gushiramwo amakuru neza:
  4. Iciyumviro A: Ico gikoresho c’incungu kiriko kirakora KURI PC yo kuri LAN yawe kandi gipfutse amadosiye ya NAS kuri SMB/Mapped Network Drive: Gukura gusa umugozi wa NAS Ethernet mu ntambwe ya 1 waramaze guhagarika 100% vy’ugushiramwo amakuru kuri NAS. Siga NAS ifunguye kugira ngo RAID array yayo n’amadosiye yayo bigume bisukuye, hanyuma ugende ushire ukwayo ikibanza co gukoreramwo ca Windows/Mac canduye.
  5. Igishushanyo B: Igikoresho c'incungu kiriko kirakora ataco kivuze IMBERE muri sisitemu ikoresha ya NAS Linux ubwayo (DeadBolt, Qlocker, eCh0raix:
    • Niba uta ufise Btrfs canke ZFS amafoto yashobojwe (akarorero, ica kera ext4 volume) kandi ama drives ariko arasya cane uko NAS ipfuka kopi yawe yonyene y’amadosiye, kanda kandi ufate Buto y’Inguvu y’imbere ku NAS mu masegonda 5 gushika ku 10 kugira ngo uhagarike umuriro ukomeye ubwo nyene (canke ukureho umuriro wa DC/AC nimba buto idakora). Iminota yose NAS iguma ifunguye ireka CPU yayo igashiramwo izindi gigabytes 5 gushika kuri 20 z’amadosiye yawe.
    • Imburi ihambaye (Why DeadBolt & Qlocker victims must NOT reboot after recovery: Ivyiyumviro vy'incungu nk' Qlocker (iyijana amadosiye mu ijambobanga .7z ububiko bukoresha 7z) na DeadBolt rimwe na rimwe ugumana uburyo bwo gufungura canke imfunguruzo zo gufungura mu /tmp (RAM) canke gufata urubuga rwa UI (/home/httpd/index.html). Niba ugifise umuzi wa SSH wo mu karere wuguruye muri NAS, suzuma ps aux kandi /tmp imbere yo kuzima (raba Icigwa ca 2 kiri musi).
  6. Injira muri router yawe ya internet / uruhome rw'umuriro (192.168.1.1 / 192.168.0.1 / UniFi / pfSense / irembo rya ISP) ubwo nyene maze uzime UPnP (Universal Plug and Play) KANDI usibe amategeko yose yerekeye WAN Port Forwarding yerekana NAS yawe:
  7. Ivyiyumviro birenga 80 kw'ijana vy'indwara za NAS zo mu nzu no mu biro bitobito bishika kubera ko uwukoresha yafyonda kuri "Itunganya ry'Ikigobe / EZ-Internet / UPnP" mu gihe c'ugutegura kwa mbere, ivyo bikaba vyategetse mu gacerere urubuga rwo mu nzu gufungura TCP ports . 5000, 5001, 8080, 8443, 443, 22 (SSH), canke 445 (SMB) ataco ihinduye kuri interineti yose ya bose (Shodan.io / Censys).
  8. Guhagarika UPnP ubudasiba mu mitunganyirize ya WAN/NAT ya router yawe maze usibe itegeko ryose ryo gutuma port yerekana aderesi IP yo mu karere ka NAS.
  9. NTUTANGURE, ntusubire guhindura, canke ngo ukoreshe "Reset / Reinstall DSM canke QTS" ku bikoresho bikomeye imbere yo gusuzuma nimba ransomware yanyaze gusa igice ca OS canke umubare w'amakuru:
  10. Mu bitero nka DeadBolt, iyo porogaramu mbi ihindura kuri paji yo kwinjira ku rubuga rwa NAS (index.html) kugira ngo ugaragaze igitabu c'incungu c'ibarabara ryose kibuza gushika ku rubuga rw'ubuyobozi rwa QNAP/Synology, mbere n'igihe Btrfs / ZFS amafoto canke amadosiye manini manini y’amasanamu (arenga megabytes 20) aracari 100 kw’ijana ku bikoresho.
  11. Suzuma nimba NAS yawe ifise Btrfs (Synology Snapshot Replication), ZFS (TrueNAS / QuTS hero), canke LVM Amafoto yo ku rwego rw'ibarabara (QNAP Storage & Snapshots:
  12. Kuko Btrfs kandi ZFS amafoto asomwa gusa ku rwego rw'ububiko bwa dosiye (na Synology WORM / Amafoto adahinduka ntashobora no gukurwaho n'umuntu yahinduwe root admin account), ushobora kenshi gusubiza inyuma 100 kw’ijana vy’amadosiye yawe yasangiye mu masegonda 60 ata makuru atakaye kandi ata ncungu yishuwe.
  13. Imbere yo kwishura incungu iyo ari yo yose, menya neza ubwoko nyabwo bw’incungu ukoresheje ID Ransomware (id-ransomware.malwarehunterteam.com) na No More Ransom (nomoreransom.org:
  14. Ivyiyumviro vyinshi vy’incungu vya NAS (eCh0raix / QNAPCrypt, kare Qlocker biciye kuri photorec / qrescue gukuraho igiti, Muhstik, na SynoLocker) zifise uburyo bwo gukuraho urufunguzo rwa bose ku buntu canke uburyo bwo gukuraho urufunguzo rw’ubuhinga bwa none bwasohowe n’abashakashatsi b’abajejwe gukurikiza amategeko n’umutekano.

Danger

Kubera iki utegerezwa KWIGEZE ushira ahabona Synology DSM (ports 5000/5001), QNAP QTS (ports 8080/443), SSH (port 22), canke SMB (port 445) uhereye kuri interineti ya bose biciye ku Port Forwarding: Uburyo bwo gukoresha NAS y’abaguzi n’abatobato (DSM, QTS, QuTS hero, ADM, TOS) gukoresha PHP, C/CGI, na Python urubuga rw'ubuyobozi nk'uko root. Igihe cose ubugoyagoye bwo kwemeza-guca ku musi wa zero buvumbuwe muri porogaramu y'amafoto yubatswemwo (QNAP Photo Station, Music Station, Multimedia Console) canke CGI script, botnets zikora zicapura amaderesi yose ya IPv4 miliyaridi 4 kuri internet maze zigashiramwo amakuru yose yoherezwa ku port mu masaha 4 gushika kuri 12 y’ugutangazwa. Ugushika kure kuri NAS bitegerezwa gusa gushika biciye ku VPN ipfutse, itaremewe-itera amapakete (Urugero rw’umurizo, WireGuard, canke OpenVPN).

Igiti c'ingingo: ubwo nyene NAS ransomware gutoranya no gusubirana inzira

Koresha iyi nzira y’ibikorwa kugira ngo umenye nimba igitero cavuye kuri mudasobwa ya LAN canke kuri NAS, hanyuma uhitemwo uburyo bwo gusubirana butekanye:

flowchart TD
    Symptom["NAS itwara gusya ku 100% + Amadosiye yahinduwe izina (.deadbolt, .7z, .ech0raix, .lockbit) canke Urubuga UI rwerekana igicapo c'incungu"] --> PullLAN["INTAMBWE YA 1 (Mu masegonda 5): Kura Intsinga Zose za Ethernet Inyuma ya NAS"]

    PullLAN --> SourceCheck{"Mbega Incryption Yahagaze Igihe Wakuyeho Umugozi wa Ethernet wa NAS?"}

    SourceCheck -->|"EGO: Ibikorwa vya Disiki vyagabanutse bishika kuri Zero Igihe LAN Yakurwako"| SMBVector["ISOKO A: Ransomware Iriko Irakora Kuri PC ya Windows/Mac Ku Rubuga Rwawe Kandi Iriko Ishiramwo Amadosiye Asangiwe Kuri SMB"]

    SourceCheck -->|"OYA: Ama Hard Drive ya NAS Akomeza Gutera Ethernet Itarimwo (Canke Urupapuro rwo Kwinjira ku Rubuga rwa NAS Ubwarwo Rwasubiriwe n’Igicapo c’Incungu)"| DirectNAS["ISOKO B: Ivyuma bibiri vy’ubusuma biriko birakora ataco bimaze imbere muri NAS OS (Bikoreshwa biciye ku UPnP / Ivyambu vya WAN vyerekanwa 5000, 5001, 8080, 443, 22)"]

    SMBVector --> IsolatePC["Rondera & Ukureho PC yanduye kuri LAN yawe -> Gusubizaho amadosiye ya NAS yasangiwe kuva kuri Btrfs / ZFS / QNAP amafoto canke Hyper Backup"]

    DirectNAS -->SSHCheck{"Woba Ufise Igihe ca SSH co mu Karere Gikora (Canke Ni Qlocker Ikoresha 7z)?"}

    SSHCheck -->|"Ego (Qlocker / Uburyo bukora 7z)"| GrabPass["Gusuzuma ps aux | grep 7z kuri SSH kugira ngo ufate ijambobanga 7-Zip kuva ku murongo w'itegeko Args imbere yo kwica"]
    SSHCheck -->|"Nta SSH / Ibimenyetso vy'ugusya"| PowerOff["Fata buto y'amashanyarazi ya NAS amasegonda 5-10 kugira ngo uhagarike ubushobozi bukomeye bwo kuzima kugira ngo amadosiye atagira amakuru n'ahantu h'ubuntu bizigamwe"]

    GrabPass --> KillUPnP["INTAMBWE YA 2: Injira muri Router -> Guhagarika UPnP ubudasiba + Gukuraho amategeko yose yo gutuma amakuru ku nzira (5000, 5001, 8080, 443, 22)"]
    PowerOff --> KillUPnP
    IsolatePC --> KillUPnP

    KillUPnP --> RecoveryPath{"Ni ibihe bintu vyo gusubirana biri kuri NAS?"}

    RecoveryPath -->|"Btrfs / ZFS / QNAP Ububiko bw'amafoto y'ubu"| SnapRestore["Gusukura OS Igice / Firmware Update -> Gusubiza inyuma amadosiye yasangiwe ku gishushanyo c'imbere y'igitero"]
    RecoveryPath -->|"USB yo hanze / Igicu co hanze (Igicu c'inyuma / HBS 3)"| BackupRestore["Guhanagura & Gusubira kwubaka NAS kuri Firmware -> Kugarura Kuva ku Murongo/Igicu"]
    RecoveryPath -->|"Nta mafoto n'ivyo gusubiza inyuma"| ForensicCarve["Ivyuma bikoreshwa mu gusoma gusa -> Suzuma NoMoreRansom.org + Gukoresha PhotoRec / QRescue Gucapura Bitagenewe (Cane Birakora Kuri Qlocker)"]

Uko NAS Ransomware Imenagura: Ivyo Bitero Bibiri Bitera

Imbere y’uko usubira gushiramwo NAS yawe mu nzira y’urubuga rwawe, utegerezwa kumenya uwuhe muri izo nzira zibiri zitandukanye cane zo kwinjira yemereye ransomware ku bipimo vyawe vy’ububiko:

Imero Vector #1: Uburyo bwo gucungura Linux butaziguye kuri NAS (DeadBolt, Qlocker, eCh0raix, AgeLocker, Muhstik) Vector #2: PC-ku-NAS SMB Urubuga rwo Gusangira Porogaramu y'Incungu (LockBit, Akira, BlackCat, Phobos, Play)
Iyo malware iriko irakora hehe mu vy'ukuri? Ku buryo butaziguye kuri CPU yo mu mutima ya NAS na Linux OS (vyakoranijwe nk' x86_64 canke ARM64 Linux ELF ibiri canke inyandiko y’igikoko). Kuri PC canke Mac ya Windows yanduye ku rubuga rwawe rwo mu karere, ipfuka amadosiye ku nzira z'urubuga (Z:\) canke inzira za UNC (\\192.168.1.50\Public).
Uwo muterabwoba yinjiye gute? 1. Router UPnP / Gurungika ivyambu vy'amaboko bigaragaza ivyambu vy'ubuyobozi bwa NAS (8080, 443, 5000, 5001) canke SSH (22) ku WAN.
2. CGI / App Zero-Umunsi (QNAP Photo Station, Multimedia Console, HBS 3 Ivyemezo bikomeye CVE-2021-28799).
3. Gushiramwo ivyemezo / Brute Force ku konti ya admin idafise 2FA.		 Uwukoresha ku rubuga rwawe rwo mu nzu canke rw'ibiro yafunguye imeyili mbi, ivugurura ry'umucukumbuzi w'ibinyoma, canke yerekanye Remote Desktop (RDP port 3389) kuri PC yabo ya Windows, kandi iyo PC yari yabitse amakuru y’Isoma-Kwandika mu madosiye ya SMB ya NAS yawe.
Iki gitero coshobora gukuraho NAS zawe Btrfs / ZFS / LVM Amafoto? Ego, NIBA ifoto ari isanzwe (ishobora guhinduka): Kubera ko porogaramu mbi ya Direct-to-NAS ikora nk' root imbere muri NAS OS, imiryango nk’ DeadBolt kandi Qlocker kugerageza kwiruka lvremove canke gukuraho amafoto asanzwe, KIRETSE Idahinduka (WORM) Amafoto (Synology Immutable Snapshots / ZFS Hold), ivyo mbere root ntishobora gukuraho gushika igihe co kubika kirangiye. OYA. Kubera ko iyo ransomware iriko iravugana na NAS yawe gusa ku umurongo wo gusangira amadosiye ku rubuga rwa SMB, irafise uburenganzira bwo gukoresha console y’ubuyobozi bwa NAS canke umuyobozi w’amafoto yo ku rwego rw’ibarabara. Gwawe Btrfs, ZFS, n’Ibishushanyo vy’Ijwi rya QNAP biguma 100 kw’ijana bitakozweko.
Ni amadosiye ayahe ashobora gushirwa mu mfuruka? Kenshi bituma umuvuduko ugenda neza: nk'akarorero, DeadBolt gusa ipfuka ikilobytes 512 za mbere (524,288 bytes) ya dosiye yose canke isimbuka inzira zimwe zimwe za sisitemu, mu gihe Qlocker ikoresha NAS ubwayo yubatswemwo /usr/local/sbin/7z Ubuhinga bwo kwimurira amadosiye mato kurusha 100 MB mu kurindwa n'ijambobanga .7z ububiko (gukuraho dosiye y'umwimerere na unlink(), bituma ibibazwa bitagenewe disiki n' PhotoRec / QRescue birakora cane). Gushiramwo amadosiye ku rubuga biciye ku bikorwa vya SMB gusoma-kwandika-guhindura izina (slowest over 1GbE Wi-Fi/Ethernet, bisobanura gukurura umugozi w’urubuga hagati y’igitero bizigama amadosiye menshi).

Icigwa ca 1: Gufunga Internet (Router UPnP, Port Forwarding, n’Ivyuma vy’Igicu)

Iyo usukuye canke usubijeho NAS yawe utafunze umwobo w’urubuga kuri router yawe, botnets zikora zicapura aderesi yawe ya IP ya bose zizosubira kwanduza NAS mu masaha makeyi umaze kuyigarura kuri internet. Ubanza kurangiza iyi nzira yo gufunga kuri router yawe:

  1. Injira muri Router yawe ya Internet / Console y'ubuyobozi bw'uruhome rw'umuriro:
  2. Gufungura umucukumbuzi kuri mudasobwa canke telefone isukuye maze ugende kuri IP y’irembo rya router yawe (mu bisanzwe 192.168.1.1, 192.168.0.1, 10.0.0.1, canke biciye kuri porogaramu yawe y'urusenga nka UniFi, Eero, Google Home, TP-Link Deco, ASUS Router, Netgear Nighthawk).
  3. Guhagarika UPnP (Universal Plug and Play) Ubudasiba:
  4. Ja kuri Ivyiza > NAT Gurungika / WAN / Urubuga > UPnP hanyuma uhindure UPnP ku OFF / Izimye.
  5. Kubera iki UPnP ni akaga cane ku bafise NAS: Iyo UPnP ikoreshejwe kuri router yawe, igikoresho cose kiri ku rubuga rwawe rwo mu karere (harimwo n'umuhinga wa NAS yawe "EZ-Internet" canke "Auto Router Configuration", canke porogarama mbi kuri televiziyo y'ubwenge) gishobora kohereza mu gacerere IGD (Internet Gateway Device) gusaba kuri router yawe uvuga ngo "Fungurira WAN Port y'inyuma 8080 na 5001 kuri IP yanje yo mu karere 192.168.1.50", unyura ku ruhome rwawe rw'umuriro utarigeze usaba ijambobanga rya router yawe.
  6. Gukuraho vyose bikoreshwa n'amaboko (Virtual Server) & DMZ Amategeko yerekana NAS:
  7. Genda kuri Ivyiza > Gurungika NAT > Gurungika Port (canke Servers Virtual) maze usibe itegeko ryose ry'ugutuma TCP canke UDP (80, 443, 5000, 5001, 8080, 8443, 21 FTP, 22 SSH, 873 guhuza, 445 SMB, 32400 Plex iyo bidakenewe) kuri IP yawe ya NAS.
  8. Suzuma Ivyiza > DMZ maze ugenzure ko DMZ Host idakora (gushiramwo IP ya NAS muri DMZ ya router bigaragaza ivyuho vyose 65.535 vya TCP na UDP vya NAS bica kuri internet ya bose).
  9. Suzuma uri hanze y'urubuga rwawe ko Zero NAS Ports zifunguye:
  10. Gusura shodan.io canke grc.com (ShieldsUP) canke ukoreshe isuzuma ry'ivyambu ku bijanye n'aderesi yawe ya IP ya WAN kugira ngo wemeze ko ivyicaro 5000, 5001, 8080, 8443, 443, na 22 ubu rero garuka Filtered / Stealth / Closed.

Icigwa ca 2: Gutoranya ivyihutirwa bishingiye ku ndwara (Qlocker, DeadBolt, eCh0raix)

Imbere y’uko uhanagura NAS canke uriha incungu, banza urabe ubwoko bwihariye bwa NAS ransomware bwateye igikoresho cawe. Buri muryango munini wa NAS ufise intege nke zidasanzwe zituma amakuru ashobora gusubirwamwo igice canke yose ataco yishuye:

1. Iyo Amadosiye Yawe Asubirizwa na .7z Ububiko (Qlocker kuri QNAP / Linux NAS)

Gute Qlocker ibikorwa: Aho kwandika moteri y’ubuhinga bwo gukingira amakuru, Qlocker ikoresha inyandiko ihamagara NAS ubwayo yubatswemwo 7-Zip (/usr/local/sbin/7z) binary kugira ngo ushire dosiye yose mu ijambobanga ry'ibanga .7z ububiko hanyuma ukoreshe Linux isanzwe rm (unlink) kuri dosiye y’umwimerere. - Ubuhinga bwo gutoranya #1 (Gufata Ijambobanga Live muri ps aux Imbere yo kuzima): Nimba Qlocker ni ubu iracariko irakora kuri NAS yawe kandi ushobora kwinjira mu karere uciye kuri SSH (ssh admin@nas-local-ip), ukoreshe iri tegeko ubwo nyene imbere yo kuzima: 

ps aux | grep 7z
Kuko Qlocker itanga ijambobanga ry'inyuguti 32 ku murongo w'itegeko ku 7z (7z a -p<THE_SECRET_PASSWORD_IS_RIGHT_HERE> -mhe=on ...), kwiruka ps aux | grep 7z mu gihe iriko irafatanya amadosiye icapa ijambobanga ry'ukuri ry'ugusobanura mu nyandiko rusangi ku mugaragaro wawe. Kopa ivyo -p... urudodo ubwo nyene: rufungura buri .7z dosiye kuri NAS yawe yose. - Ubuhinga bwo gutoranya #2 (Gugarura amadosiye y'umwimerere atahuye n' QRescue / PhotoRec Mbere n’inyuma y’ Qlocker Irangije): Kuko Qlocker irema igishasha .7z dosiye kandi ikora gusa nk'uko bisanzwe unlink() (rm) kugira ngo usibe ifoto yawe y'umwimerere, inyandiko, canke dosiye ya videwo, amadosiye yawe y'umwimerere atagira amakuru aracari mu bice bitagenewe ama hard drive. - Hagarika kwandika vyose kuri NAS ubwo nyene. - Fata hard drive ya USB yo hanze kuri NAS (canke uhuze RAID drives ku kibanza co gukoreramwo Linux) hanyuma ukoreshe PhotoRec (QRescue na QNAP & CGSecurity) kugira ngo ubaze amafoto yawe y’umwimerere atagiramwo amakuru, ama PDF, inyandiko z’ibiro, ama ZIP, n’amasanamu agororotse mu bice vya disiki bitagenewe.

2. Niba Igishushanyo Cawe co Kwinjira muri NAS Casubiriwe n’Igishushanyo DeadBolt Urupapuro rw'Incungu (.deadbolt dosiye)

Gute DeadBolt ibikorwa: 1. DeadBolt gusubirira /home/httpd/index.html (canke /home/httpd/cgi-bin/index.cgi) n’urupapuro rwayo bwite rw’ibiharuro bibiri/HTML rufata umucukumbuzi wawe w’urubuga igihe cose ugerageje gufungura urupapuro rwa QNAP QTS / Asustor ADM, rusaba Bitcoin mu guhindura urufunguzo rwo gusobanura rw’inyuguti 32 (rushikirizwa biciye ku ruzitiro rwa Bitcoin . OP_RETURN ugucuruza). 2. Uko wosubira ku rubuga rwawe rwa QNAP QTS / QuTS hero Admin Dashboard utatakaje amakuru yawe: - Ihitamwo A (Biciye muri SSH yo mu karere iyo ishobojwe): SSH muri NAS yo mu karere (ssh admin@<nas-ip>), guhagarika umunyaruyeri deadbolt igikorwa nimba kiriko kirakora, kandi ukoreshe inyandiko yo gusubizaho porogarama yemewe ya QNAP canke usubizeho ivy'umwimerere /home/httpd/index.html kuva ku ishusho ya ROM y'uburyo bwo gusoma gusa (/mnt/HDA_root/update_pkg/). - Ihitamwo B (Umuco w'umuyagankuba udafise disiki + Gusubira kwinjiza umuyagankuba): 1. Zima umuriro wa NAS. 2. Shira ama hard drive yose hanze n’amasentimetero 2 (inch 1) kugira ngo atandukanye n’inyuma (ushire umubare w’urutonde rwayo neza n’uruzitiro rw’umunyabugenegene). 3. Inguvu kuri NAS ata ama hard drive, urondere IP yayo biciye ku Qfinder Pro, iyo usabwe ku rubuga rwo gutegura, ushire ama drive mu bibanza vyayo nyavyo, hanyuma uhitemwo "Update Firmware gusa (Ugumye amakuru yose n'imiterere)" (ntiwigere ukanda "Initialize wipe Systems the drives, 3. Iciyumviro gihambaye co gusobanura amakuru y'abajejwe gukurikiza amategeko ku DeadBolt: Mu bikorwa bihujwe birongowe na Polisi y'Igihugu y'Ubuholandi (Politie), Uburayi (No More Ransom), na Abasubiza.nu, abajejwe gukurikiza amategeko barashoboye guhenda aba DeadBolt abakozi b’iterabwoba mu gihe c’amahera ya mempool spike mu kurekura imfunguruzo zirenga 150 zo gukuraho amakuru imbere y’uko amafaranga make y’abatera Bitcoin asubirwamwo biciye ku Replace-By-Fee. Isheke deadbolt.responders.nu kandi nomoreransom.org kugira ngo ubone nimba ivyiwe vyihariye DeadBolt urufunguzo rw’aderesi y’uwagirizwa rwafashwe n’abapolisi.

3. Niba Amadosiye Yawe Ahera mu 2019. .encrypt (eCh0raix / QNAPCrypt)

  • Amayaruka menshi y’ eCh0raix (QNAPCrypt) bakoresheje amakosa y'urufunguzo rwa AES canke bari bafise itegeko-n'ubugenzuzi bwabo (C2) urutonde rw’amakuru rwafashwe n’abashakashatsi mu vy’umutekano n’abajejwe gukurikiza amategeko.
  • Gusura nomoreransom.org hanyuma ushireko amadosiye abiri apfutse (canke inyandiko y’incungu README_FOR_DECRYPT.txt) kugira ngo ugerageze ubuntu Bitdefender / Nta yindi ncungu eCh0raix Decryptor imbere yo guhanagura ikintu cose.

Icigwa ca 3: Gusubizaho amadosiye yawe kuva Btrfs, ZFS, canke QNAP Amafoto mu masegonda 60

Niba NAS yawe yari yashizwemwo amakuru na Vector #2 (PC yandujwe n’incungu kuri LAN yawe ipfutse amadosiye asangiye kuri SMB), canke nimba wari ufise Immutable (WORM) Amafoto canke Amafoto ya LVM/Btrfs/ZFS atakozweko mu gihe c’igitero ca NAS gitaziguye, urashobora kugarura 100 kw’ijana vy’amadosiye yawe ubwo nyene:

1. Igikoresho co gukora amasanamu (DSM 7.x hamwe Btrfs Gusubiramwo ifoto)

  1. Mbere, suzuma ko PC yanduye iri kuri LAN yawe yacitse ku rubuga, hanyuma uhindure Synology DSM ku nkuru nshasha iri munsi ya Control Panel > Update & Restore.
  2. Gufungura Isubiramwo ry'amafoto imbere muri Synology DSM.
  3. Fyonda Gusubirana mu ruhande rw'ibubamfu.
  4. Hitamwo Dosiye yasangiwe (canke iSCSI LUN) hanyuma ukande Gusubirana.
  5. Gushakisha urutonde rw'amafoto yategekanijwe (GMT+...) hanyuma uhitemwo ifoto yafashwe ubwo nyene imbere y’uko ransomware encryption itangura (suzuma Igikorwa > Suzuma mbere kugira ngo ubone amadosiye ari muri iyo foto maze wemeze ko asukuye kandi ko ataco akora).
  6. Fyonda Igikorwa > Gusubiza kuri iyi foto (canke Clone n'izina rishasha nimba ushaka ko dosiye yashizwemwo amakuru idakozweko kugira ngo ubone ibimenyamenya vy'ubuhinga bw'amategeko mu gihe ubwo nyene ushiramwo kopi isukuye y'iyo dosiye yasangiwe).
  7. Kuko Btrfs ni Kopa-ku-Kwandika (CoW) filesystem, gusubiza inyuma dosiye y'amaterabyte 20 ku gishushanyo c'imbere y'igitero bifata amasegonda atarenga 10.

2. NAS ya QNAP (QTS Amafoto y'urugero rwa LVM & QuTS hero ZFS Amafoto)

  1. Igihe intwari ya QTS/QuTS imaze gushirwako ibipande no kwitandukanya na WAN, fungura Ububiko n'Ibishushanyo.
  2. Genda kuri Ububiko > Ububiko/Amafoto, uhitemwo Igitabo cawe gikomeye, Igitigiri Gito, canke Dosiye ya ZFS Shared Dosiye, hanyuma ukande Umucungerezi w'Ifoto (ikimenyetso ca kamera).
  3. Hitamwo ifoto ya nyuma isukuye yafashwe imbere y'igihe c'igitero.
  4. Suzuma igiti c’amadosiye kiri imbere mu gice c’iburyo kugira ngo ugenzure ko amadosiye yawe ataco akoze, hanyuma ukande Revert Volume Snapshot (canke uhitemwo amadosiye yose hanyuma ukande Restore kugira ngo wandike amadosiye yashizwemwo gusa).

3. NAS y'ukuri (CORE / SCALE ku ZFS) n'Ivyateye (ZFS / Btrfs)

  • Ku vy'ukuriNAS (ZFS): Genda kuri Ububiko > Amafoto (canke Ukurinda amakuru > Ibikorwa vy'amafoto bigenda bihinduka), urondere amafoto asukuye (tank/share@auto-2026-10-31_12-00), hanyuma ukande Rollback (canke ukoreshe ifoto mu rutonde rw'amakuru rushasha zfs clone tank/share@auto-2026-10-31_12-00 tank/share_recovered rero ntuzokwigera utakaza amafoto mashasha yo hagati).

Icigwa ca 4: Gukomeza NAS yawe kugira ngo ntizosubire gushirwa mu mfuruka (Urutonde rw'ingingo 7)

Amakuru yawe amaze gusubirana, shira mu ngiro aya mategeko indwi y’itegeko ry’ugutunganya ku gikoresho cawe ca Synology, QNAP, TrueNAS, canke Asustor imbere yo gusubira kuyifatanya n’urubuga:

  • 1. Ntukigere urungika Port iyo ari yo yose iri kuri Router yawe kuri NAS yawe: Koresha Tailscale canke WireGuard VPN Ahubwo:
  • Shiraho Tailscale yemewe ivuye mu kigo ca Synology / Ikigo ca porogarama ya QNAP (canke ukoreshe Server ya VPN ya WireGuard yubatswe muri router yawe).
  • Tailscale irema zero-imiterere, urunganwe-ku-urunganwe WireGuard rwuzuye urusenga rw'urusenga (100.x.y.z) hagati ya telefone yawe, laptop yawe, na NAS yawe ifise zero zifunguye kuri firewall ya router yawe yo muhira. Ushobora gushika ku mafoto yawe ya NAS, amadosiye, n’ibarabara ry’ubuyobozi uri aho hose kw’isi mu gihe NAS yawe iguma 100% itaboneka ku bikoresho bipima internet nka Shodan.
  • 2. Guhagarika Ivyubatswemwo mburabuzi admin Konti kandi ureme umuyobozi yitwa 2FA:
  • Synology DSM na QNAP QTS zompi zirungikwa zifise konti y’imbere yitwa admin (UID 1024 canke UID 0). Ubuhinga bwikora butera inyundo izina ry'ukoresha admin 24/7.
  • Rema konti nshasha y'umuyobozi ifise izina ry'ukoresha ridasanzwe, winjire muri iyo konti nshasha, uje kuri Igice c'ubugenzuzi > Umukoresha n'Itsinda (canke Abakoresha), hanyuma Uzimye ivya kera admin konti.
  • Gufungura Ivyemezo vy'Ibintu 2 vy'Itegeko (OTP / Passkey / Approve Sign-in) ku makonti yose y'abarongozi.
  • 3. Gufungura Ibidahinduka (WORM) Amafoto (7-to-14-Day Retention Lock:
  • Ku Synology DSM 7.2+: Gufungura Gusubiramwo amafoto > Amafoto > Amategeko > Urutonde, ushoboze amafoto y'umusi ku musi, hanyuma usuzume "Shoboza amafoto adahinduka" n'igihe co kurinda imisi 7 gushika kuri 14. Naho umusuma yokwiba ijambobanga ryawe ry’umuzi canke akakoresha ubugoyagoye bwa kernel muri DSM, nta n’umwe (nta n’umwe root) ishobora gukuraho Igishushanyo Idahinduka gushika isaha y'imisi 7 y'ibikoresho irangiriye.
  • Ku QNAP QuTS intwari / QTS: Gutegura Igishushanyo c'Igishushanyo canke ushoboze WORM (Write Once, Read Many) amategeko yo kubika ku migabane y'ububiko, kandi urabe neza ko "Ikibanza co kubika amafoto" gishoboka.
  • 4. Guhagarika uruhusha rwo gusangira urubuga rwa SMB (Least Privilege) Rero Infection ya Laptop Ntishobora Gupfuka NAS Yose:
  • Ntukigere ukora ikarita y'umukuru wawe wa NAS admin ivyemezo biri imbere muri Windows dosiye y'umugenzuzi (\\NAS\) ku bikoresho vya misi yose.
  • Rema konti y'umukoresha atari umuyobozi kugira ngo ubone dosiye buri musi, hanyuma ushireho ububiko bwawe/amafoto yawe (akarorero, 2010-2025 Family Photos Archive) ku Gusoma-Gusa (ro) ku bakoresha desktop ku musi ku musi kugira ngo iyo PC y’umunyamuryango w’umuryango ifashe ransomware, PC ishobora gusoma izo dosiye ariko ntishobora kuzipfuka canke kuzihindura.
  • 5. Gufungura uruhome rw'umuriro rwubakiwe muri NAS (Allow LAN + Tailscale Subnets Only) & Ukwibuza:
  • Imbere Igikoresho co kugenzura Synology > Umutekano > Uruhome rw'umuriro (canke QNAP QuFirewall), rema itegeko rikomeye ry'urutonde rw'ibintu vyemewe ryemerera amahuzwa gusa kuva ku rubuga rwawe rwa LAN rwo mu karere (192.168.1.0/24) n'urubuga rwawe rw'umurizo/VPN (100.64.0.0/10), ikurikiwe n'itegeko ryo hasi ryashizweho kuri Kwanka Vyose. Naho umuntu yohindukira mu mpanuka . UPnP n'aho woba uriko urasubira kuri router, akayunguruzo k'amapakete k'imbere ka NAS kazotera amapakete yose ya internet ya bose ubwo nyene.
  • 6. Guhagarika SSH (Port 22) na Telnet (Port 23) Igihe Utariko Uratorera umuti Ingorane:
  • Siga SSH ihinduwe OFF imbere Igikoresho co Gucungera > Terminal & SNMP mu gihe c'ibikorwa bisanzwe vya misi yose; gusa uyihindure mu minota 10 ukeneye kugira ngo ukore igikorwa c'umurongo w'amabwirizwa, hanyuma uyizimye.
  • 7. Gukomeza Ivy'Ukuri "3-2-1" Ivy'Umuyaga / Igicu Idahinduka (Hyper Backup / HBS 3:
  • Kurikira ivyacu ububiko bwa mudasobwa na 3-2-1 ubuyobozi bwo gusubizaho ivyago: gutunganya Synology Hyper Backup canke QNAP Hybrid Backup Sync (HBS 3) kugira ngo ushire amakuru y’ijoro, amakuru y’inyuma y’umukiriya ku hard drive ya USB yo hanze ushobora gukuraho canke ku Object-Locked (S3 Object Lock Compliance Mode) indobo y'igicu (Backblaze B2, Wasabi, canke AWS S3) ukoresheje imfunguruzo za API zibujijwe zo kwongerako gusa.

Inomero z'ivyihutirwa zo mu karere n'amategeko y'ibigo

Ibitero vy’ubuhinga bwa none bitera ibikoresho vya NAS biratohozwa n’ibigo vy’igihugu bijejwe ubugizi bwa nabi bwo kuri Internet kw’isi yose, ivyo bikaba bibungabunga ububiko bw’imfunguruzo zo gukuraho amakuru zafashwe (No More Ransom) no gukurikirana ibikorwa remezo vy’ubugizi bwa nabi:

  • Leta Zunze Ubumwe za Amerika na Canada:
  • Ubuzima-Umutekano w'Ivyihutirwa: Hamagara 911 iyo ransomware ihungabanya ubuvuzi canke uburyo bwo kwirinda umubiri.
  • Ikigo ca CISA & FBI kijejwe gutanga ikirego c'ubugizi bwa nabi kuri Internet (IC3): Raporo y'amasekeza y'incungu ya NAS (DeadBolt, Akira, LockBit, Qlocker) kuri stopransomware.gov, ic3.gov, canke uhamagare CISA kuri 1-844-Say-CISA (1-844-729-2472).
  • Ikigo ca Canada kijejwe umutekano wo kuri internet na RCMP: Raporo kuri cyber.gc.ca (1-833-CYBER-88) canke Ikigo ca Canada kirwanya ubusuma.
  • Ubwami bw'Ubwongereza:
  • Ibikorwa vyihutirwa: Hamagara 999 (canke 101 ku bapolisi batagira ivyihutirwa).
  • Ibikorwa vy'ubuhendanyi & NCSC: Raporo y'ivyashikiye ransomware kuri actionfraud.police.uk canke hamagara 0300 123 2040 (24/7 umurongo w’ibintu bishika kuri internet). Ubucuruzi buto buto n’imiryango y’abagiraneza barashobora kurondera Inyishu y’Ibibazo vyo kuri Internet ya NCSC (ncsc.gov.uk) urugi.
  • Ubumwe bw'Uburayi:
  • Ibikorwa vyihutirwa: Hamagara 112 mu bihugu vyose bigize Umuryango w’Ubumwe bw’Uburayi.
  • Ikigo c'Uburayi kijejwe ubugizi bwa nabi ku mbuga ngurukanabumenyi (EC3) & NoMoreRansom.org: Suzuma nomoreransom.org (itunganywa na Polisi y’Igihugu y’Ubuholandi, Europol, n’ibigo bifatanya) ku mfunguruzo zo gukuraho amakuru y’incungu za NAS zafashwe, maze ubimenyeshe ikigo c’igihugu cawe CSIRT n’Ikigo kijejwe gukingira amakuru (DPA mu masaha 72 iyo amakuru y’umuntu yacitse canke yatakaye hakurikijwe GDPR).
  • Ostraliya na Nouvelle-Zélande:
  • Ibikorwa vyihutirwa: Hamagara 000 muri Australiya canke 111 muri Nouvelle-Zélande.
  • Ikigo ca Australiya kijejwe umutekano wo kuri internet (ACSC: Hamagara ku murongo w'ubuhinga bwa none 24/7 kuri 1300 CYBER1 (1300 292 371) canke raporo kuri cyber.gov.au.
  • ICEMEZO NZ: Raporo kuri cert.govt.nz.
  • Ubuhinde na Aziya-Pasifike:
  • Ubuhinde (CERT-In & Umurongo w'ubufasha ku bugizi bwa nabi bwo kuri interineti): Hamagara 1930 canke raporo kuri cybercrime.gov.in na incident@cert-in.org.in.
  • Tayiwani (TWCERT/CC, ububasha bwo mu rugo bwa Synology, QNAP, na Asustor PSIRTs): Wohereze amatike y’ibintu vy’umutekano w’abaguzi ku QNAP PSIRT (service.qnap.com) canke Ivy'Imirongo PSIRT (synology.com/en-global/security/advisory).

Ibibazo bikunda kubazwa

NAS yawe yanduye directement kuri internet ya bose ataco ikora kuri mudasobwa zawe. Canke umurongo wawe wa interineti wari ufise UPnP (`Universal Plug and Play`) n'ubushobozi (kwemerera NAS "Itunganywa ry'Ibarabara ry'Ibarabara / EZ-Internet / myQNAPcloud" gufungura mu gacerere ivyicaro 8080, 443, 5000, 5001, canke 22 ku ruhome rwawe), canke wararungitse n'amaboko port kugira ngo ushikire amadosiye yawe uri kure. Ivyuma vy’ubuhinga bwa none biguma bipima aderesi IP yose ya bose iri kuri interineti maze bikakoresha ubugoyagoye butabonetse canke ubugoyagoye . umuyobozi amajambobanga ku rubuga rwa NAS rwerekanwa.

Nomenya gute nimba iyo ransomware yariko iragenda ataco ihinduye imbere muri NAS OS yanje canke kuri imwe muri mudasobwa zanje za Windows ku bijanye n’ugusangira urubuga?

Raba ibimenyetso bitatu: Ica mbere, nimba . NAS urubuga rwo kwinjira mu gicapo ubwaco ryasubiriwe n’agapapuro k’incungu (nk’aka Umugozi wapfuye), canke nimba NAS gusa ifise amadosiye yashizwemwo amakuru mu gihe PC yose iri ku rubuga rwawe isukuye, iyo porogarama mbi ikoreshwa ataco ihinduye imbere muri NAS Linux OS. Ubwa kabiri, fungura . Igitabo c'ihuriro rya NAS / Igitabo co kwimurira dosiye ya SMB (mu vy'Ivy'Imirongo Ikigo c'inyandiko canke QNAP Ikigo ca QuLog): iyo ubonye aderesi IP ya LAN yo mu karere (nk' 192.168.1.24) gukora ibihumbi mirongo vy’ibikorwa vyihuta . Wandike / Guhindura izina / Gukuraho ibikorwa ku SMB, hanyuma mudasobwa iri ku . 192.168.1.24 ni igikoresho canduye gipfuka NAS yawe ku rubuga.

Kubera iki DeadBolt gusa gushiramwo intango y’amadosiye yanje manini ya videwo canke y’urutonde rw’amakuru, kandi noba nshobora gukina canke gusanasana amadosiye yashizwemwo igice?

Kugira ngo umuntu ashobore gupfuka ama terabytes mirongo y’ububiko bwa NAS imbere y’uko nyen’ivyo bikoresho abona ko ama hard drive ariko arasya maze agakuraho umugozi, imitsi nk’iyo Umugozi wapfuye Gushiramwo gusa ikilobaiti 512 za mbere (`524,288 bytes`) ya buri dosiye hanyuma wongereko .urufunguzo rwo gupfa extension, isiga gigabytes zisigaye za dosiye zitakozweko mu nyandiko rusangi. Naho gutakaza 512 KB ya mbere bisambura burundu inyandiko ntoyi n’amafoto ya JPEG, amadosiye manini y'amasanamu y'ama gigabyte menshi (`.mp4`, `.mov`, `.mkv`), amasanamu y’ivyo bikoresho, be n’amashusho amwamwe yo kuri disiki y’imashini (`VMDK`/`VHDX`) canke amakuru ya SQL akenshi arashobora gusanurwa . mu gutera umutwe w'ikibindi ufise akamaro (`moov` atom) bivuye ku yindi videwo yafashwe n’iyo kamera nyene hakoreshejwe ibikoresho nk’ivyo gukuraho.

Na router UPnP n'ugurungika imbere ku nzira y'amaboko vyazimye burundu, ibikorwa vyo guhanahana amakuru hanze nka Synology Guhuza vuba kandi Ihuza ry'igicu canjeQNAP ni vyiza cane kuruta ivyuho vya WAN vyuguruye kuko ntibifungura ivyuho vyo kwumviriza ku ruhome rw’umuriro rwa router yawe. Ariko rero, baracagaragaza igicapo cawe co kwinjira muri NAS (`DSM` / `QTS` urubuga rwo kwemeza) ku muntu wese azi canke ategekanya ivyawe `QuickConnect ID`. Kugira ngo ubone umutekano mwinshi, guhagarika uburenganzira bwo gukoresha amakuru ya bose ku kigaragaza umuyobozi maze ukoreshe Umurizo canke VPN y'umurinzi ahubwo, bisaba kwemeza igikoresho c'ibanga imbere ipakete imwe ya HTTP irashobora mbere gushika kuri server yawe y'urubuga rwa NAS.

Mbega nokwishura incungu ya Bitcoin ku DeadBolt, Qlocker, canke eCh0raix iyo nta backups mfise kandi nta mafoto mfise?

Inzego zijejwe gukurikiza amategeko (`FBI`, `CISA`, `Europol`, `NCSC`) barahanura cane ko umuntu adashobora kwishura incungu kubera ko ivyo kwishura bifasha amashirahamwe y’abagizi ba nabi kandi nta cizigiro bifise c’uko inyandiko y’ugukuraho amakuru y’uwo muterabwoba izokora ata madosiye yononekaye. Imbere y’uko wiyumvira kwishura: (1) Fata ishusho canke uzigame ama drive kugira ngo ntushobore gutuma ibintu bikomera kuruta, (2) Suzuma **`nomoreransom.org`** na **`deadbolt.responders.nu`** kugira ngo barabe nimba abajejwe gukurikiza amategeko bamaze gufata urufunguzo nyamukuru rw’umubabaro wawe, (3) Kubera **`Qlocker`**, kwiruka **`PhotoRec` / `QRescue`** ku mwanya utagenewe kuri disiki (uwukunda gusubiza 60% gushika ku 90% vy’ibintu vy’umwimerere vyasimbujwe ku buntu), na (4) Ku bintu binini . `.mp4`/`.mov` amasanamu yakubiswe n'ububiko bw'umutwe w'igice, kugerageza umutwe wo gusubira kwubaka n' `untrunc`.

Inyobora zifitaniye isano

Amasoko n'ubuyobozi buzwi

  • Ikigo kijejwe umutekano wo kuri Internet n’ibikorwa remezo (CISA) & Ibiro vya Leta Zunze Ubumwe za Amerika vy'Iperereza (FBI) (StopRansomware.gov): Imburi ku bubiko bufatanye n'urubuga (NAS) Ivyo bikoresho vy’ubuhinga bwa none bikoreshwa na DeadBolt, Qlocker, eCh0raix, na Akira Ransomware.
  • Ikigo c’Uburayi kijejwe ubugizi bwa nabi bwo kuri Internet (EC3) & Polisi y'igihugu y'Ubuholandi (Politie) (NoMoreRansom.org): Igikorwa kijanye n'ugufata urufunguzo rwa DeadBolt, ububiko bw'ibikoresho vya eCh0raix, n'amabwirizwa yo guhagarika ubusuma bwa Ransomware.
  • Ishirahamwe ry'Igihugu ryitaho Ivyago vy'Umutekano w'Ibicuruzwa vya QNAP (QNAP PSIRT) & Inama y'Impanuro y'Umutekano ya Synology: Ivyerekeye Ubuhinga bwo Guhagarika Router UPnP, Gusubizaho Amakonsole y'Ubuyobozi Yanyazwe, QRescue (PhotoRec) Gusubirana bitagenewe, no Gushoboza Ibidahinduka WORM Amafoto.
  • Ikigo c'igihugu kijejwe umutekano wo kuri Internet (NCSC) (Ubwongereza): Gugabanya ubumara bwa Malware na Ransomware ku bubiko bw'urubuga n'ibikoresho bitobito vyo mu biro.