Skip to content

Incungu ku Rugo cyangwa Ibiro NAS (Synology / QNAP): Guhagarika Encryption hamwe na UPnP Kumurika

Imibare yihutirwa itandukanye nigihugu. Uru rupapuro rukoresha 911, umubare kuri Amerika na Kanada. Ibindi bihugu byinshi bikoresha 112, 999, cyangwa undi mubare. Shakisha umubare wigihugu cyawe.

Kumva disiki zikomeye imbere muri Network-Yifatanije nububiko (NAS) ibikoresho (Synology DiskStation, QNAP Turbo NAS, TrueNAS, Asustor, TerraMaster, cyangwa Western Digital My Cloud) gukubita ubudahwema 100% ikoreshwa rya disiki mugihe ububiko busangiwe bwuzuye .deadbolt, .ech0raix, .qlocker, .7z, .lockbit, cyangwa .encrypt kwagura dosiye (cyangwa kubona ecran ya NAS y'urubuga rwa NAS yasimbujwe na Bitcoin incungu isabwa) ni ibintu byihutirwa byo kubika. Ibikoresho bya NAS ni intego zihesha agaciro kuri enterineti ikoreshwa na ransomware botnets (DeadBolt, Qlocker, eCh0raix / QNAPCrypt, AgeLocker, Chatterbox, na Akira) kubera ko NAS imwe idashizwemo akenshi ifata terabaýt 10 kugeza 100 yubuzima bwumuryango cyangwa ubucuruzi buciriritse mubuzima bwa digitale kandi bikunze kugaragara kumurongo wa interineti rusange nyirubwite atabimenye abinyujije kuri ** Router UPnP (Universal Plug and Play) Auto-Port-Imbere ** cyangwa umucuruzi serivise igicu-relay (myQNAPcloud, Synology QuickConnect, EZ-Internet). Mbere yo gukubita umugozi w'amashanyarazi ya AC hanze kurukuta, ugomba gufata icyemezo cyingenzi cyamasegonda 10-yububiko ukurikije niba NAS yawe ikoresha Copy-on-Andika snapshots (Btrfs cyangwa ZFS) cyangwa gakondo ya RAID; kubitari incansomware disiki ya array impanuka, baza NAS RAID array yataye agaciro, gutsindwa kwinshi, hamwe na ZFS / Btrfs kugarura, no kuri PC ishingiye kuri incansomware, reba malware, incungu, hamwe na spyware yanduye kimwe na kurinda ibikoresho bya home home nibikoresho bya IoT. Niba incansomware igira ingaruka kubikorwa byibitaro, serivisi zubutabazi bwa komini, cyangwa ibikorwa remezo byumutekano wumubiri, hamagara numero yihutirwa yawe (911 muri Amerika no muri Kanada, 112 hirya no hino mu muryango w’ubumwe bw’ibihugu by’Uburayi, 999 mubwongereza) cyangwa ubaze igitabo cyacu mpuzamahanga nimero yihutirwa.

Kora ubu

  1. ** Kurura Ethernet yumubiri (RJ45 / 10GbE) umuyoboro (umuyoboro) uva inyuma ya NAS NUBU, mbere yo gukora ku mugozi w'amashanyarazi **:
  2. Gucomeka umugozi wa Ethernet uhita uhita utera SSH / HTTP igaba igitero cyo kugenzura no kugenzura, guhagarika NAS gukuramo imizigo ya encryption ya kabiri, kandi, kimwe na ngombwa, ** ihita ihagarika PC ya desktop yanduye ku biro by’ibanze bya LAN kugira ngo uhishe NAS yawe ku migabane ya SMB / CIFS (\\NAS\Share) **.
  3. ** Menya mumasegonda 15 niba ugomba kugabanya ingufu cyangwa guhagarika uburyo bwo kugenzura neza **:
  4. ** Scenario A: Incungu ikora kuri PC ya desktop kuri LAN yawe no gushishoza dosiye ya NAS hejuru ya SMB / Mapped Network Drive **: Gukurura gusa umugozi wa NAS Ethernet muri Step 1 ** bimaze guhagarika 100% byibanga kuri NAS **. Kureka NAS ikoreshwa kugirango RAID array hamwe na sisitemu yububiko bigume bisukuye, hanyuma ujye gutandukanya akazi ka Windows / Mac yanduye.
  5. ** Scenario B: Ikibiri cy'incungu kirimo gukora mu buryo butaziguye imbere muri sisitemu y'imikorere ya NAS Linux ubwayo (DeadBolt, Qlocker, eCh0raix) **:
    • Niba ukora ** ntabwo ** ufite Btrfs cyangwa ZFS snapshots ishoboye (kurugero, mukuru ext4 ingano) hamwe na drives zirimo gusya cyane nkuko NAS ihishe kopi yawe yonyine ya dosiye, ** kanda hanyuma ufate imbere yumubiri wa Power Button kuri NAS kumasegonda 5 kugeza 10 kugirango uhatire amashanyarazi akomeye ako kanya ** (cyangwa gukurura amashanyarazi ya DC / AC niba buto idashubije). Buri munota NAS iguma ifite imbaraga kureka CPU ikabika andi gigabytes 5 kugeza kuri 20 ya dosiye yawe.
    • ** Ubuvumo bw'ingenzi (Why DeadBolt & Qlocker victims must NOT reboot after recovery) **: Incungu ya Ransomware nka Qlocker (yimura dosiye mukurinda ijambo ryibanga .7z ububiko ukoresheje 7z) na DeadBolt rimwe na rimwe komeza ibikorwa bya encryption leta cyangwa urufunguzo rwibanga muri /tmp (RAM) cyangwa gushimuta urubuga UI binary (/home/httpd/index.html). Niba ugifite ifunguye ryaho SSH imizi muri NAS, reba ps aux na /tmp mbere yo kuzimya (reba Icyiciro cya 2 hepfo).
  6. ** Injira muri enterineti ya enterineti / firewall (192.168.1.1 / 192.168.0.1 / UniFi / pfSense / ISP irembo) ako kanya hanyuma uhindure OFF UPnP (Universal Plug and Play) KANDI usibe WAN Port yose yohereza imbere yerekana NAS yawe **:
  7. Kurenga 80 ku ijana byurugo hamwe nu biro bito NAS ransomware yanduye bibaho kuko uyikoresha yakanze "Auto Router Configuration / EZ-Internet / UPnP" mugihe cyambere cyo gutangiza, cyategetse bucece router yo murugo gufungura ibyambu ** TCP 5000, 5001, 8080, 8443, 443, 22 (SSH), cyangwa 445 (SMB) ** kuri enterineti rusange (Shodan.io / Censys).
  8. Hagarika ** UPnP ** burundu mumikorere ya Wouter / NAT ya router yawe hanyuma usibe buri tegeko ryohereza ibyerekezo byerekana aderesi ya IP ya NAS.
  9. ** Ntugatangire, kuvugurura, cyangwa gukoresha "Kugarura / Gusubiramo DSM cyangwa QTS" kuri disiki zikomeye mbere yo gusuzuma niba incansomware yibye igice cya OS gusa cyangwa ingano yamakuru **:
  10. Mubitero nka DeadBolt, malware yandika urupapuro rwinjira rwa NAS (index.html) kwerekana kwerekana incamake yuzuye y'incungu ibuza kugera kuri QNAP / Synology admin dashboard, ** niyo mugihe cyawe Btrfs / ZFS snapshots cyangwa dosiye nini ya videwo (hejuru ya megabayiti 20) iracyari nziza 100 ku ijana kuri drives **.
  11. ** Reba niba NAS yawe ifite Btrfs (Synology Snapshot Replication), ZFS (TrueNAS / QuTS hero), cyangwa LVM Guhagarika-Urwego Snapshots (QNAP Storage & Snapshots) **:
  12. Kuberako Btrfs na ZFS snapshots irasomwa gusa kuri dosiye ya sisitemu yo guhagarika (na Synology WORM / Snapshots idahinduka ntishobora no gusibwa nabangamiwe root konte ya admin), ** urashobora gusubiza inyuma 100 ku ijana byububiko bwawe busangiwe mu masegonda 60 hamwe no gutakaza amakuru ya zeru hamwe nincungu zeru yishyuwe **.
  13. ** Mbere yo kwishyura incungu iyo ari yo yose, menya neza uburyo bw'incungu ukoresheje ID Ransomware (id-ransomware.malwarehunterteam.com) na No More Ransom (nomoreransom.org) **:
  14. Ibyinshi byingenzi bya NAS incungu (eCh0raix / QNAPCrypt, kare Qlocker Binyuze photorec / qrescue gukuramo ibiti, Muhstik, na SynoLocker) bafite ** kubanga rusange kubuntu cyangwa uburyo bwo gukuramo urufunguzo-rwoherejwe ** rwashyizwe ahagaragara nabashinzwe umutekano nabashakashatsi kumutekano.

Danger

** Impamvu utagomba na rimwe gushyira ahagaragara Synology DSM (ports 5000/5001), QNAP QTS (ports 8080/443), SSH (port 22), cyangwa SMB (port 445) mu buryo butaziguye kuri enterineti rusange binyuze kuri Port Imbere : Sisitemu ikora na SMB NAS (DSM, QTS, QuTS hero, ADM, TOS) kora ibintu bigoye PHP, C / CGI, na Python y'urubuga rwimikorere nka root. Igihe cyose zero-umunsi yo kwemeza-bypass intege nke zavumbuwe muma porogaramu yubatswe ()QNAP Photo Station, Music Station, Multimedia Console. Kugera kure kuri NAS bigomba ** gusa ** byonyine bibaho binyuze muri kodegisi, itemewe-ipaki-guta VPN ( Umurizo **, ** WireGuard **, cyangwa ** GufunguraVPN **).

Igiti cyemezo: ako kanya NAS incansware triage n'inzira yo kugarura

Koresha uru rugendo kugirango umenye niba igitero cyaturutse kuri mudasobwa ya LAN cyangwa kuri NAS, hanyuma uhitemo uburyo bwo kugarura umutekano:

flowchart TD
    Symptom["NAS Gutwara Gusya kuri 100% + Amadosiye Yahinduwe (.deadbolt, .7z, .ech0raix, .lockbit) cyangwa Urubuga UI Yerekana Incungu Yincungu."] --> PullLAN["INTAMBWE 1 (Mu masegonda 5): Kuramo insinga zose za Ethernet uhereye inyuma ya NAS"]

    PullLAN --> SourceCheck{"Encryption yahagaritse ako kanya Wacomye umugozi wa NAS Ethernet?"}

    SourceCheck -->|"YEGO: Igikorwa cya Disiki Yamanutse kuri Zeru Iyo LAN idacometse"| SMBVector["ISOKO A: Incungu ikora kuri PC ya Windows / Mac kuri Network yawe no Guhisha Ububiko Bisangiwe hejuru ya SMB"]

    SourceCheck -->|"NO"| DirectNAS["ISOKO B: Ikigega cya Ransomware Ikora mu buryo butaziguye Imbere ya NAS OS (Yashakishijwe binyuze kuri UPnP / Icyambu cya WAN cyashyizwe ahagaragara 5000, 5001, 8080, 443, 22)"]

    SMBVector --> IsolatePC["Shakisha & Hagarika PC Yanduye kuri LAN yawe -> Kugarura ububiko bwa NAS Bisangiwe Kuva Btrfs / ZFS / QNAP Snapshots cyangwa Hyper Backup"]

    DirectNAS -->SSHCheck{"Ufite Igikorwa Cyibanze cya SSH Gufungura (Cyangwa ni Qlocker ikoresha 7z)?"}

    SSHCheck -->|"Yego (Qlocker / Igikorwa cya 7z)"| GrabPass["Kugenzura ps aux | grep 7z kuri SSH Gufata Plaintext 7-Zip Ijambobanga Kuva Kumurongo Umurongo Args Mbere yo Kwica"]
    SSHCheck -->|"Nta SSH / Ikizwi cyo Gusya Disiki"| PowerOff["Fata NAS Power Button 5-10 Amasegonda kugirango Uhatire Ako kanya Imbaraga Zikomeye kugirango Fayili idacapishijwe & Umwanya wubusa urabitswe"]

    GrabPass --> KillUPnP["INTAMBWE 2: Injira muri Router -> Hagarika UPnP Iteka + Siba Amategeko Yose yo Kohereza Icyambu (5000, 5001, 8080, 443, 22)"]
    PowerOff --> KillUPnP
    IsolatePC --> KillUPnP

    KillUPnP --> RecoveryPath{"Ni ubuhe butunzi bwo kugarura buriho kuri NAS?"}

    RecoveryPath -->|"Btrfs / ZFS / QNAP Guhagarika Snapshots Zihari"| SnapRestore["Sukura OS Igice / Kuvugurura Firmware -> Subiza inyuma Ububiko Bisangiwe Kuri Mbere yo Gutera Snapshot"]
    RecoveryPath -->|"Inyuma ya USB / Kurubuga Igicu Cyibitse (Hyper Backup / HBS 3)"| BackupRestore["Ihanagura & Wubake NAS kuri Firmware Yashizweho -> Kugarura Kuva kuri Offline / Igicu kibitse"]
    RecoveryPath -->|"Nta Snapshots & Nta bubiko"| ForensicCarve["Imashini ya Clone Isoma-Gusa -> Reba NoMoreRansom.org + Koresha IfotoRec / QRescue Igicapo kitagabanijwe (Cyane Cyane Kurwanya Qlocker)"]

Uburyo NAS Ransomware Yacitsemo: Ibice bibiri byibitero

Mbere yo gucomeka NAS yawe muguhindura imiyoboro yaho, ugomba kumenya imwe muribintu bibiri bitandukanye byinjira byemerera incungu kububiko bwawe:

Ikiranga Vector # 1: Direct-to-NAS Linux Ransomware (DeadBolt, Qlocker, eCh0raix, AgeLocker, Muhstik) Vector # 2: PC-kuri-NAS SMB Umuyoboro Mugabane Ransomware (LockBit, Akira, BlackCat, Phobos, Play)
** Mubyukuri malware ikorera he? ** ** Mu buryo butaziguye kuri NAS imbere muri CPU na Linux OS ** (yakozwe nka an x86_64 cyangwa ARM64 Linux ELF binary cyangwa shell inyandiko). ** Kuri Windows PC cyangwa Mac yanduye kuri rezo yawe yaho **, ihishe amadosiye kumurongo wa mape yashushanyije (Z:\) cyangwa inzira za UNC (\\192.168.1.50\Public).
** Igitero cyinjiye gute? ** 1. ** Inzira UPnP / Imfashanyigisho Imbere yohereza ** kwerekana ibyambu bya NAS (8080, 443, 5000, 5001) cyangwa SSH (22) kuri WAN.
2. ** CGI idashyizwe ahagaragara / Porogaramu Zeru-Umunsi ** (QNAP Photo Station, Multimedia Console, HBS 3 ibyangombwa bikomeye CVE-2021-28799).
3. ** Ibintu byemewe / Brute Force ** kurwanya konti ya admin idafite 2FA.		 Umukoresha murugo rwawe cyangwa mubiro byafunguye imeri mbi ya imeri, ivugurura rya mushakisha mpimbano, cyangwa Ibiro bya kure (RDP port 3389) kuri PC PC ya Windows, kandi iyo PC yari yarazigamye Gusoma-Kwandika ibyangombwa kububiko bwawe bwa SMB bwa NASB.
** Iki gitero gishobora gusiba NAS yawe Btrfs / ZFS / LVM Snapshots? ** ** Yego, NIBA ifoto isanzwe (mutable) **: Kuberako Direct-to-NAS malware ikora nkuko root imbere muri NAS OS, imirongo nka DeadBolt na Qlocker gerageza kwiruka lvremove cyangwa gusiba amashusho asanzwe, ** URETSE Kudahinduka (WORM) Snapshots (Synology Immutable Snapshots / ZFS Hold) **, ndetse niyo root ntishobora gusiba kugeza igihe cyo kugumana kirangiye. ** OY. Iwawe Btrfs, ZFS, na QNAP Volume Snapshots ikomeza ** 100 ku ijana idakorwaho **.
** Ni ayahe madosiye abikwa? ** Akenshi gutezimbere umuvuduko: kurugero, DeadBolt ihishe gusa ** ya mbere 512 kilobytes (524,288 bytes) ** ya buri dosiye cyangwa gusimbuka inzira zimwe za sisitemu, mugihe Qlocker ikoresha NAS yonyine yubatswe /usr/local/sbin/7z akamaro ko kwimura dosiye ntoya ya MB 100 mukurinda ijambo ryibanga .7z ububiko (gusiba dosiye yumwimerere hamwe unlink(), ituma ** mbisi itagabanijwe disiki ishushanya hamwe PhotoRec / QRescue byiza cyane **). Shishoza dosiye kurubuga ukoresheje SMB gusoma-kwandika-guhindura izina (slowest over 1GbE Wi-Fi/Ethernet, bivuze gukurura umuyoboro wa kabili hagati-igitero gikiza ubwinshi bwububiko bunini).

Icyiciro cya 1: Guhagarika Kumurongo wa interineti (Router UPnP, Port Forwarding, hamwe n'ibicu byerekana)

Niba usukuye cyangwa ugarura NAS yawe udafunze umwobo wa neti kuri router yawe, botnets zikoresha zikoresha aderesi ya IP rusange izongera kwanduza NAS mumasaha make nyuma yo kuyagarura kumurongo. Uzuza iyi rezo ya enterineti kuri router yawe mbere:

  1. ** Injira muri enterineti yawe ya enterineti / Umuyobozi wa Firewall ya Firewall **:
  2. Fungura mushakisha kuri mudasobwa cyangwa terefone isukuye hanyuma uyohereze kuri IP ya enterineti ya enterineti (mubisanzwe 192.168.1.1, 192.168.0.1, 10.0.0.1, cyangwa ukoresheje mesh router yawe ya porogaramu nka UniFi, Eero, Google Home, TP-Link Deco, ASUS Router, Netgear Nighthawk).
  3. ** Hagarika UPnP (Universal Plug and Play) Iteka **:
  4. Kujya kuri ** Iterambere> Iterambere rya NAT / WAN / Umuyoboro> UPnP ** hanyuma uhindure ** UPnP kuri OFF / Abamugaye **.
  5. ** Kuki UPnP ni akaga cyane kubafite NAS **: Iyo UPnP ishoboye kuri router yawe, igikoresho icyo aricyo cyose kumurongo waho (harimo na "EZ-Internet" ya NAS yawe cyangwa "Wizard ya Auto Router", cyangwa malware kuri TV ifite ubwenge) irashobora kohereza bucece an IGD (Internet Gateway Device) saba router yawe uvuga * "Fungura hanze ya WAN Port 8080 na 5001 kuri IP yanjye yaho 192.168.1.50" *, ukuraho firewall yawe utarinze gusaba ijambo ryibanga rya router.
  6. ** Siba Imfashanyigisho zose zoherejwe ()Virtual Server) & DMZ Amategeko Yerekana NAS **:
  7. Jya kuri ** Iterambere> Iterambere rya NAT> Kohereza ibyambu (cyangwa Serveri Virtual) ** hanyuma usibe amategeko yose yohereza ibyambu bya TCP cyangwa UDP (80, 443, 5000, 5001, 8080, 8443, 21 FTP, 22 SSH, 873 rsync, 445 SMB, 32400 Hindura niba bidakenewe) kuri NAS IP yawe.
  8. Reba ** Iterambere> DMZ ** hanyuma urebe ko ** DMZ Host yamugaye ** (gushyira NAS IP muri DMZ ya router yerekana ibyambu byose 65,535 TCP na UDP bya NAS kuri enterineti rusange).
  9. ** Kugenzura Hanze y'urusobe rwawe ko ibyambu bya Zeru Zeru byafunguwe **:
  10. Sura shodan.io cyangwa **grc.com (ShieldsUP) ** cyangwa ukoreshe icyuma gisikana kuri aderesi rusange ya WAN IP kugirango wemeze ibyo byambu 5000, 5001, 8080, 8443, 443, na 22 garuka Filtered / Stealth / Closed.

Icyiciro cya 2: Imyitozo yihariye yihutirwa (Qlocker, DeadBolt, eCh0raix)

Mbere yo guhanagura NAS cyangwa kwishyura incungu, banza ugenzure ibintu byihariye bya NAS incansware yibikoresho byawe. Buri muryango munini wa NAS ufite intege nke za tekiniki zituma igice cyangwa cyuzuye cyo kugarura amakuru utishyuye:

1. Niba dosiye zawe zarasimbuwe .7z Ububiko (Qlocker kuri QNAP / Linux NAS)

Nigute Qlocker imirimo: Aho kwandika moteri yihariye ya cryptographic, Qlocker ikoresha inyandiko ihamagarira NAS ubwayo yubatswe muri **7-Zip (/usr/local/sbin/7z) ** binary kugirango ugabanye buri dosiye mubanga ryibanga ririnzwe .7z archive hanyuma ikore Linux isanzwe rm (unlink) kuri dosiye y'umwimerere. - ** Amayeri yo Gutwara # 1 (Gufata Ijambobanga Live ps aux Mbere yo Kuzimya) **: Niba Qlocker ni * kuri ubu iracyakora * kuri NAS yawe kandi urashobora kwinjira mugace ukoresheje ** SSH (ssh admin@nas-local-ip) **, koresha iri tegeko ako kanya mbere yo kuzimya: 

ps aux | grep 7z
Kuberako Qlocker Itambutsa ijambo ryibanga 32 ryibanga ryibanga kumurongo wateganijwe kuri 7z (7z a -p<THE_SECRET_PASSWORD_IS_RIGHT_HERE> -mhe=on ...), kwiruka ps aux | grep 7z mugihe irimo gukusanya dosiye ** icapa neza ijambo ryibanga ryibanga ryibanga ryanditse neza kuri ecran yawe. ** Wandukure -p... umugozi ako kanya: ifungura ** buri .7z dosiye ** kuri NAS yawe yose. - ** Amayeri yo Gutwara # 2 (Kugarura Idosiye Yumwimerere idafunze hamwe QRescue / PhotoRec Ndetse na Nyuma Qlocker Irangiza) **: Kuberako Qlocker Kurema * Gishya * .7z dosiye kandi ikora gusa bisanzwe unlink() (rm) gusiba ifoto yawe yumwimerere, inyandiko, cyangwa dosiye ya videwo, ** dosiye yawe yumwimerere idafite ibanga iracyicaye mubice bitagabanijwe bya disiki zikomeye **. - Hagarika inyandiko zose kuri NAS ako kanya. - Ongeraho USB ikomeye ya disiki yo hanze kuri NAS (cyangwa uhuze disiki ya RAID kumurimo wa Linux) hanyuma ukore **PhotoRec (QRescue na QNAP & CGSecurity) ** gushushanya amafoto yawe yumwimerere adafunze, PDF, inyandiko zo mu biro, ZIP, na videwo neza bivuye muri disiki zitagabanijwe.

2. Niba NAS Ifashayinjira rya NAS Yasimbuwe na DeadBolt Urupapuro rw'incungu (.deadbolt dosiye)

Nigute DeadBolt imirimo: 1. DeadBolt Gusimbuza /home/httpd/index.html (cyangwa /home/httpd/cgi-bin/index.cgi. OP_RETURN gucuruza). 2. ** Nigute ushobora gusubira muri QNAP QTS / QuTS intwari Admin Dashboard utabuze amakuru yawe **: - ** Ihitamo A (Binyuze kuri SSH yaho niba bishoboka) **: SSH muri NAS mugace (ssh admin@<nas-ip>), hagarika ikigoryi deadbolt inzira niba ikora, hanyuma ukore QNAP yemewe ya software yo kugarura inyandiko cyangwa kugarura umwimerere /home/httpd/index.html uhereye kuri sisitemu isomwa gusa ROM ishusho (/mnt/HDA_root/update_pkg/). - ** Ihitamo B (Flash Diskless Firmware Flash + Gushyushya-Gucomeka) : 1. Zimya NAS. 2. Shyira disiki zose zikomeye kuri santimetero 2 (santimetero 1) kugirango batandukana inyuma yindege ( nimero yabo bayitondere neza hamwe na kaseti yabanje **). 3. Imbaraga kuri NAS * idafite * disiki zikomeye, shakisha IP yayo ukoresheje ** Qfinder Pro **, mugihe ubajijwe kuri ecran ya ecran ishyushye-shyira disiki mumurongo wabyo neza, hanyuma uhitemo ** "Kuvugurura Firmware Yonyine (Gumana Data na Igenamiterere))" ** (ntuzigere ukanda * "Gutangiza Sisitemu" *, ihanagura drives). 3. ** Icyangombwa Cyingenzi cyo kubahiriza amategeko Icyitonderwa kuri DeadBolt**: Mubikorwa bihujwe biyobowe na ** Polisi yigihugu yu Buholandi (Politie) **, ** Uburayi (No More Ransom) **, na ** Abashubije.nu **, abashinzwe umutekano bashutse neza DeadBolt Abakinnyi b'iterabwoba mugihe cy'amafaranga ya mempool yiyongereye kurekura ** urufunguzo rwo hejuru rwibanga rurenga 150 ** mbere yuko ibicuruzwa byibasiye amafaranga make ya Bitcoin byahagaritswe hakoreshejwe Replace-By-Fee. Reba deadbolt.responders.nu na nomoreransom.org kugirango urebe niba umwihariko wawe DeadBolt urufunguzo rw'ahohotewe rwafashwe n'abapolisi.

3. Niba dosiye zawe zirangiye .encrypt (eCh0raix / QNAPCrypt)

  • Ibisekuru byinshi eCh0raix (QNAPCrypt) yakoresheje urufunguzo rwa AES rufite amakosa cyangwa afite itegeko-no-kugenzura (C2) base base yafashwe nabashakashatsi bashinzwe umutekano no kubahiriza amategeko.
  • Sura nomoreransom.org hanyuma wohereze dosiye ebyiri zifunze (cyangwa inoti y'incungu README_FOR_DECRYPT.txt) kugerageza ubuntu ** Bitdefender / NoMoreRansom eCh0raix Decryptor ** mbere yo guhanagura ikintu cyose.

Icyiciro cya 3: Kugarura dosiye yawe kuva Btrfs, ZFS, cyangwa QNAP Snapshots mumasegonda 60

Niba NAS yawe yashizwemo na ** Vector # 2 (PC yanduye incansomware kuri LAN yawe ihishe ububiko busangiwe hejuru ya SMB) **, cyangwa niba ufite ** Immutable (WORM) Snapshots ** cyangwa idakozweho ** LVM / Btrfs / ZFS Snapshots ** mugihe cya NAS itaziguye, urashobora kugarura 100% byamadosiye yawe ako kanya:

1. Disiki ya Sinologiya (DSM 7.x hamwe na Btrfs Kwisubiramo)

  1. Ubwa mbere, genzura ko PC yanduye kuri LAN yawe itandukanijwe numuyoboro, hanyuma uvugurure Synology DSM kugeza kumasohoro aheruka munsi ya ** Panel Igenzura> Kuvugurura & Kugarura **.
  2. Fungura pake ya ** Snapshot Replication ** imbere muri Synology DSM.
  3. Kanda ** Recovery ** kuruhande rwibumoso.
  4. Hitamo ibanga ** Ububiko Bwisangiwe ** (cyangwa iSCSI LUN) hanyuma ukande ** Kugarura **.
  5. Kurikirana urutonde rwibishushanyo mbonera (GMT+...) hanyuma uhitemo ifoto yafashwe ** ako kanya mbere yuko encryption ya incansomware itangira ** (reba ** Igikorwa> Gushakisha ** banza urebe amadosiye ari muri iyo foto hanyuma wemeze ko afite isuku kandi adafunze).
  6. Kanda ** Igikorwa> Kugarura kuriyi shusho ** (cyangwa ** Clone hamwe nizina rishya ** niba ushaka kugumisha ububiko bwibanga butabonetse kubimenyetso byubucamanza mugihe uhita ushyiraho kopi isukuye yububiko busangiwe).
  7. Kuberako Btrfs ni Gukopera-Kwandika (CoW.

2. QNAP NAS (QTS Guhagarika-Urwego LVM Snapshots & QuTS hero ZFS Snapshots)

  1. Intwari QTS / QuTS imaze guterwa no gutandukanywa na WAN, fungura ** Ububiko & Snapshots **.
  2. Jya kuri ** Ububiko> Ububiko / Snapshots **, hitamo ingano yawe yibyibushye, Umubyimba muto, cyangwa Ububiko busangiwe na ZFS, hanyuma ukande ** Snapshot Manager ** (igishushanyo cya kamera).
  3. Hitamo ifoto yanyuma isukuye yafashwe mbere yigihe cyo gutera.
  4. Shakisha ububiko bwigiti imbere mumurongo wiburyo kugirango umenye neza ko dosiye zawe zidahwitse, hanyuma ukande ** Subiza Volume Snapshot ** (cyangwa hitamo ububiko bwose hanyuma ukande ** Restore ** kugirango wandike dosiye zifunze gusa).

3. TrueNAS (CORE / SCALE ku ZFS) no kudatinya (ZFS / Btrfs)

  • ** Kuri TrueNAS (ZFS) **: Jya kuri ** Ububiko> Snapshots ** (cyangwa ** Kurinda Data> Ibikorwa bya Snapshot Periodic **), shakisha ifoto isukuye (tank/share@auto-2026-10-31_12-00), hanyuma ukande ** Gusubira inyuma ** (cyangwa ukoreshe ifoto kuri dataset nshya zfs clone tank/share@auto-2026-10-31_12-00 tank/share_recovered ntushobora rero gutakaza ibishya bishya bifata amashusho).

Icyiciro cya 4: Gukomera NAS yawe kugirango idashobora na rimwe kongera gushishoza (Urutonde 7-Ingingo)

Amakuru yawe amaze kugarurwa, shyira mu bikorwa aya mategeko arindwi ateganijwe kuri Synology yawe, QNAP, TrueNAS, cyangwa ibikoresho bya Asustor mbere yo kuyihuza numuyoboro:

  • ** 1. Ntuzigere Uhereza Icyambu cyose kuri Router yawe kuri NAS: Koresha Tailscale cyangwa WireGuard VPN Ahubwo **:
  • Shyiramo pake yemewe ya ** Tailscale ** ivuye muri Synology Package Centre / QNAP App Centre (cyangwa ukoreshe router yawe yubatswe muri ** WireGuard VPN Server **).
  • Umurizo urema zeru-iboneza, urungano-rwungano rwa WireGuard rwabitswe mesh tuneli (100.x.y.z) hagati ya terefone yawe, mudasobwa igendanwa, na NAS ** hamwe na zeru zifunguye kuri home router firewall **. Urashobora kubona amafoto yawe ya NAS, dosiye, hamwe na ecran ya admin aho ariho hose kwisi mugihe NAS yawe igumye 100% itagaragara kuri scaneri ya enterineti nka Shodan.
  • ** 2. Hagarika Byubatswe-Mburabuzi admin Konti no Kurema Custom Yitwa Administrator ufite itegeko 2FA **:
  • Byombi Synology DSM na QNAP QTS ubwato hamwe na konti isanzwe yitwa admin (UID 1024 cyangwa UID 0). Automatic brute-force bots inyundo ukoresha admin 24/7.
  • Kora konti-nshyashya yubuyobozi ifite izina ryumukoresha wihariye, injira hamwe niyi konti nshya, jya kuri ** Igenzura rishinzwe> Umukoresha & Itsinda (cyangwa Abakoresha) **, na ** Hagarika ibisanzwe admin konte **.
  • Komeza kuri ** Gutegekwa 2-Kwemeza Ibintu (OTP / Passkey / Approve Sign-in) ** kuri konti zose zabayobozi.
  • ** 3. Zingurura Ibidahinduka (WORM) Snapshots (7-to-14-Day Retention Lock) **:
  • Kuri ** Synology DSM 7.2 + **: Fungura ** Kwisubiramo Snapshot> Snapshots> Igenamiterere> Gahunda **, ushoboze gufata amashusho ya buri munsi, hanyuma urebe ** "Gushoboza amashusho adahinduka" ** hamwe nigihe cyo kurinda ** iminsi 7 kugeza 14 **. Nubwo hacker yibye ijambo ryibanga ryumuzi cyangwa agakoresha intege nke za DSM, ** ntamuntu (ntanubwo root) irashobora gusiba Snapshot idahinduka ** kugeza isaha yibikoresho byiminsi 7 irangiye.
  • Kuri ** QNAP QuTS intwari / QTS **: Hindura ** Snapshot Replica Vault ** cyangwa ushoboze ** AKAZI (Write Once, Read Many) ** politiki yo kugumana kumigabane ikomeye yo kugarura ibintu, kandi urebe neza ko ** "Ikibanza cya Snapshot Umwanya" ** ishoboye.
  • ** 4. Gabanya Urubuga rwa SMB Gusangira Uruhushya (Least Privilege) Rero Laptop Yanduye Ntishobora Guhisha NAS yose **:
  • Ntuzigere ushushanya umutware wa NAS admin ibyangombwa imbere muri Windows File Explorer (\\NAS\) kuri mudasobwa zigendanwa za buri munsi.
  • Kora konte isanzwe itari iy'abakoresha kugirango ubone dosiye ya buri munsi, hanyuma ushire ububiko / ububiko bwububiko (urugero, 2010-2025 Family Photos Archive) kuri ** Soma-Gusa (ro) ** kubakoresha desktop ya buri munsi kugirango niba Windows PC yumuryango ifashe incansomware, PC irashobora gusoma ubwo bubiko ariko ** ntishobora kubobora cyangwa kubihindura **.
  • ** 5. Zingurura NAS Yubatswe muri Firewall (Allow LAN + Tailscale Subnets Only) & Auto-Block **:
  • Imbere ** Igenzura rya Synologiya> Umutekano> Firewall ** (cyangwa ** QNAP QuFirewall **), shiraho itegeko ryemewe ryemerera guhuza ** gusa uhereye kumurongo wa LAN waho (192.168.1.0/24) n'umurizo wawe / VPN subnet (100.64.0.0/10) **, hakurikiraho itegeko ryo hasi ryashyizwe kuri ** Guhakana Byose **. Nubwo umuntu yahindukira kubwimpanuka UPnP gusubira kuri router, NAS yonyine ya packet y'imbere muyungurura izagusha buri paki ya enterineti rusange ako kanya.
  • ** 6. Hagarika SSH (Port 22) na Telnet (Port 23) Iyo Atari Gukemura Ikibazo Cyane **:
  • Kureka ** SSH ** yahindutse ** OFF ** imbere ** Panel Igenzura> Terminal & SNMP ** mugihe gisanzwe cya buri munsi; gusa uyihindure kuminota 10 ukeneye gukora umurongo wumurongo wakazi, hanyuma uzimye inyuma.
  • ** 7. Komeza Ukuri "3-2-1" Ikirere Cyuzuye / Igicu kidahinduka (Hyper Backup / HBS 3) **:
  • Kurikiza ibyacu kubika mudasobwa hamwe nuyobora 3-2-1: Kugena Synology Hyper Backup cyangwa QNAP Hybrid Backup Sync (HBS 3) gusunika nijoro byabitswe, umukiriya-uruhande rwigabanije kugarukira kuri ** disiki ya USB yo hanze ya disiki ucomeka kumubiri ** cyangwa kuri ** Ikintu gifunze (S3 Object Lock Compliance Mode) ** indobo yibicu (Backblaze B2, Wasabi, cyangwa AWS S3) ukoresheje urufunguzo rwibanze rwa API gusa.

Inomero zihutirwa zo mukarere hamwe na protocole yikigo

Ibitero bya Ransomware byibasiye ibikoresho bya NAS birakorwaho iperereza ninzego zigihugu zicyaha cyikoranabuhanga ku isi hose, zibika ububiko bwimfunguzo zafashwe (No More Ransom) no gukurikirana ibikorwa remezo by'ubugizi bwa nabi:

  • ** Amerika na Kanada **:
  • ** Ibihe byihutirwa byubuzima-Umutekano **: Hamagara 911 niba incansomware ihungabanya ubuvuzi cyangwa sisitemu yumutekano.
  • ** Ikigo CISA & FBI Ikigo Cyitotombera ()IC3) **: Menyesha NAS ubukangurambaga bwa ransomware (DeadBolt, Akira, LockBit, Qlocker) kuri stopransomware.gov, ic3.gov, cyangwa uhamagare CISA kuri **1-844-Say-CISA (1-844-729-2472) **.
  • ** Ikigo cya Kanada gishinzwe umutekano wa cyber & RCMP **: Raporo kuri cyber.gc.ca (1-833-CYBER-88) cyangwa ** Ikigo cyo muri Kanada gishinzwe kurwanya uburiganya **.
  • ** Ubwongereza **:
  • ** Ibikorwa byihutirwa **: Hamagara 999 (cyangwa 101 kubapolisi badasanzwe).
  • ** Ibikorwa by'uburiganya & NCSC **: Menyesha ibyabaye incungu kuri actionfraud.police.uk cyangwa uhamagare 0300 123 2040 (24/7 umurongo wa cyber umurongo). Ubucuruzi buciriritse n’abagiraneza barashobora kugisha inama ** NCSC Cyber Incident Response (ncsc.gov.uk) ** portal.
  • ** Umuryango w’ubumwe bw’ibihugu by’i Burayi **:
  • ** Ibikorwa byihutirwa **: Hamagara 112 mu bihugu byose bigize Umuryango w’ubumwe bw’ibihugu by’Uburayi.
  • ** Ikigo cy’iburayi cy’iburayi (EC3) & NoMoreRansom.org**: Reba nomoreransom.org.DPA mugihe cyamasaha 72 niba amakuru yihariye yarasibwe cyangwa yatakaye munsi ya GDPR).
  • ** Ositaraliya na Nouvelle-Zélande **:
  • ** Ibikorwa byihutirwa **: Hamagara 000 muri Ositaraliya cyangwa 111 muri Nouvelle-Zélande.
  • ** Ikigo gishinzwe umutekano wa cyber muri Ositaraliya (ACSC) **: Hamagara umurongo wa telefone ya Ransomware 24/7 kuri **1300 CYBER1 (1300 292 371) ** cyangwa raporo kuri cyber.gov.au.
  • ** CERT NZ **: Raporo kuri cert.govt.nz.
  • ** Ubuhinde na Aziya-Pasifika **:
  • ** Ubuhinde (CERT-In & Helpline ya Cyber Icyaha) **: Hamagara 1930 cyangwa raporo kuri cybercrime.gov.in na incident@cert-in.org.in.
  • ** Tayiwani (TWCERT/CC, ububasha bwo murugo bwa Synology, QNAP, na Asustor PSIRTs) **: Tanga amatike yibyago byabacuruzi kuri ** QNAP PSIRT (service.qnap.com) ** cyangwa ** Synology PSIRT (synology.com/en-global/security/advisory) **.

Ibibazo bikunze kubazwa

Nigute incansomware yanduye QNAP cyangwa Synology NAS mugihe ntigeze nkanda kumurongo uwo ari wo wose wa fishing kandi mudasobwa zanjye zifite isuku rwose?

NAS yawe yanduye biturutse kuri enterineti rusange idakora kuri mudasobwa yawe. Router yawe ya enterineti yari ifite UPnP (`Universal Plug and Play`) ishoboye (kwemerera NAS "Iboneza Imodoka / EZ-Internet / myQNAPcloud" ibiranga gufungura ibyambu bucece 8080, 443, 5000, 5001, cyangwa 22 kuri firewall yawe), cyangwa wakohereje intoki icyambu kugirango ugere dosiye yawe kure. Botnets yikora ikomeza gusikana aderesi ya IP rusange kuri enterineti kandi ikoresha intege nke zidatunganijwe cyangwa intege nke admin ijambo ryibanga kumurongo wa NAS igaragara.

Nabwirwa n'iki ko incungu yatanzwe muri NAS OS na NAS imwe muri mudasobwa yanjye ya Windows hejuru y'urusobe?

Reba ibipimo bitatu: Icya mbere, niba i Ubuyobozi bwa NAS bwinjira bwinjira ubwabwo yasimbujwe inoti y'incungu (nka Yamazaki), cyangwa niba gusa NAS yarahishe dosiye mugihe buri PC kuri neti yawe isukuye, malware ikorerwa imbere muri NAS Linux OS. Icya kabiri, fungura NAS Ihuza Log / SMB Idosiye Iyimurwa (muri Sinologiya Ikigo Cyinjira cyangwa QNAP Ikigo cya QuLog): niba ubona aderesi ya IP ya LAN (nka 192.168.1.24) gukora ibihumbi mirongo byihuse Andika / Guhindura izina / Gusiba ibikorwa birangiye SMB, hanyuma mudasobwa kuri 192.168.1.24 ni igikoresho cyanduye kibanga NAS yawe kumurongo.

Kuki? DeadBolt gusa shishoza intangiriro ya videwo nini nini cyangwa dosiye yububiko, kandi ndashobora gukina cyangwa gusana dosiye zifunze igice?

Kugirango uhishe terabaýt icumi zububiko bwa NAS mbere yuko nyirayo abona disiki zikomeye zisya kandi zikurura plug, imirongo nka Yamazaki shishoza gusa ubanza 512 kilobytes (`524,288 bytes`) ya buri dosiye hanyuma wongereho i .deadbolt kwaguka, usize gigabytes zisigaye za dosiye idakozweho inyandiko isanzwe. Mugihe gutakaza 512 yambere KB isenya inyandiko nto namafoto ya JPEG, amadosiye manini ya gigabyte menshi (`.mp4`, `.mov`, `.mkv`), amashusho ya kamera mbisi, hamwe namashusho yimashini ya disiki (`VMDK`/`VHDX`) cyangwa SQL base base irashobora gusanwa kenshi muguhindura imitwe yemewe ya kontineri (`moov` atom) kuva kurindi videwo yafashwe na kamera imwe ukoresheje ibikoresho nka idahwitse.

Hamwe na router UPnP hamwe nintoki yoherejwe imbere yazimye burundu, serivise zo hanze zisohoka nka Synology Umuyoboro wihuse na myQNAPIhuza bifite umutekano cyane kuruta gufungura ibyambu bya WAN kuko bidafungura ibyambu byo gutegera kuri firewall yawe. Ariko, baracyerekana ecran yawe ya NAS (`DSM` / `QTS` urubuga rwo kwemeza umukoresha) kubantu bose bazi cyangwa bakeka ibyawe `QuickConnect ID`. Kubwumutekano ntarengwa, hagarika kumugaragaro relay kumurongo wa admin no gukoresha Umurizo cyangwa WireGuard VPN ahubwo, bisaba kwemeza ibikoresho byemewe mbere paki imwe ya HTTP irashobora no kugera kuri seriveri ya NAS.

Nkwiye kwishyura incungu ya Bitcoin DeadBolt, Qlocker, cyangwa eCh0raix niba nta backups mfite kandi nta snapshots?

Inzego zishinzwe kubahiriza amategeko (`FBI`, `CISA`, `Europol`, `NCSC`) gutanga inama cyane yo kwirinda incungu kuko amafaranga yo kwishyura syndicates yubugizi bwa nabi kandi nta garanti yerekana ko uwanditse igitero cyabigenewe azakora nta ruswa yangiritse. Mbere yo gutekereza kwishura: (1) Ishusho cyangwa kubika drives kugirango udashobora gukora ibintu nabi, (2) Reba **`nomoreransom.org`** na **`deadbolt.responders.nu`** kugirango urebe niba abashinzwe umutekano bamaze gufata urufunguzo rwibanze kubibazo byawe, (3) Kuri **`Qlocker`**, kwiruka **`PhotoRec` / `QRescue`** kumwanya wa disiki itagabanijwe (ikunze kugarura 60% kugeza 90% yumwimerere wasibwe kubusa), na (4) Kuri nini `.mp4`/`.mov` videwo yakubiswe igice-umutwe wibanga, ikizamini cyumutwe wongeyeho `untrunc`.

Kuyobora

Inkomoko nubuyobozi

  • Ikigo gishinzwe umutekano n’ibikorwa remezo (CISA) & Biro nkuru yiperereza (FBI) ((StopRansomware.gov): * Imenyesha kububiko-bufatanije nububiko (NAS) Ibikoresho Byerekanwe na DeadBolt, Qlocker, eCh0raix, na Akira Ransomware *.
  • Ikigo cy’Uburayi Cybercrime Centre (EC3) & Polisi y'igihugu y'Ubuholandi (Politie) ((NoMoreRansom.org).
  • QNAP Itsinda ryibisubizo byumutekano (QNAP PSIRT. QRescue (PhotoRec) Kugarura kutagabanijwe, no Gushoboza kudahinduka WORM Snapshots *.
  • Ikigo cy'igihugu gishinzwe umutekano wa cyber (NCSC) (Ubwongereza): * Kugabanya Malware na Ransomware Kubika Umuyoboro hamwe nibikoresho bito byo mu biro *.