Ransomware mo NAS ya kwa Gae kgotsa ya kwa Ofising (Synology/QNAP): Go Emisa go Tsenya Dikhoutu le go Tsenngwa ga UPnP¶

Go utlwa di-hard drive mo teng ga Polokelo ya gago e e Golagantsweng le Neteweke (NAS) sedirisiwa (Synology DiskStation, QNAP Turbo NAS, TrueNAS, Asustor, TerraMaster, kgotsa Western Digital My Cloud) go tswelela pele go dirisa disiki ka diperesente di le 100 fa ditsholadifaele tse di tlhakanetsweng di tlala ka .deadbolt, .ech0raix, .qlocker, .7z, .lockbit, kgotsa .encrypt dikatoloso tsa faele (kgotsa go bona skrini sa gago sa go tsena mo webong sa NAS se emisediwa ka tlhokego ya thekololo ya Bitcoin) ke maemo a tshoganyetso a a botlhokwa a polokelo. Didirisiwa tsa NAS ke dintlha tse di botlhokwa thata tsa di-botnet tsa ransomware tse di itirisang tsa inthanete yotlhe (DeadBolt, Qlocker, eCh0raix / QNAPCrypt, AgeLocker, Chatterbox, le Akira) ka gonne NAS e le nngwe e e sa patchiwang gantsi e tshola di-terabyte di le 10 go ya go di le 100 tsa botshelo jotlhe jwa dijithale jwa lelapa kgotsa jwa kgwebopotlana mme gantsi e tsenngwa ka tlhamalalo mo inthaneteng ya botlhe kwantle ga gore mong wa yone a lemoge ka Router UPnP (Universal Plug and Play) Go Fetisetsa Kwa Pele ka Boitiriso kgotsa ditirelo tsa go fetisetsa kwa marung tsa barekisi (myQNAPcloud, Synology QuickConnect, EZ-Internet). Pele ga o ntsha thapo ya motlakase wa AC mo leboteng, o tshwanetse go dira tshwetso e e botlhokwa ya metsotswana e le 10 ya go aga go ikaegilwe ka gore a NAS ya gago e dirisa dinepe tsa Copy-on-Write (Btrfs kgotsa ZFS) kgotsa thulaganyo ya RAID e e tlwaelegileng; go bona dithubego tsa thulaganyo ya disiki e e seng ya ransomware, leba NAS RAID array e senyegile, go palelwa ga go kgweetsa gantsintsi, le go boela ga ZFS/Btrfs, le go bona ditshwaetso tsa ransomware e e theilweng mo PC, bona . serweboleta se se kotsi, serweboleta sa thekololo, le tshwaetsego ya serweboleta sa ditlhodi mmogo le go sireletsa diroutara tsa mo gae le didirisiwa tsa IoT. Fa ransomware e ama ditiro tsa bookelo, ditirelo tsa tshoganyetso tsa mmasepala, kgotsa mafaratlhatlha a pabalesego ya mmele, leletsa nomoro ya tshoganyetso ya lefelo la lona (911 kwa United States le kwa Canada, . 112 go kgabaganya Yunione ya Yuropa, 999 kwa United Kingdom) kgotsa leba lenaane la rona la dibuka tsa boditšhabatšhaba dinomoro tsa tshoganyetso.

Dira se jaanong¶

1. Goga Ethernet ya mmatota (RJ45 / 10GbE) thapo ya neteweke go tswa kwa morago ga NAS GONE JAANONG, pele ga o ama thapo ya motlakase:
2. Go ntsha thapo ya Ethernet mo polakeng ka bonako go kgaola thulaganyo ya taelo le taolo ya SSH/HTTP e e dirisanang ya motlhasedi, go emisa NAS go laisolola di-payload tsa bobedi tsa go tsenya tshedimosetso, mme, se se botlhokwa ka go lekana, go emisa ka bonako PC ya desekethopo e e tshwaetsegileng mo ofising ya gago ya lefelo leo NMBCIFS neteweke LAN ya gago go tswa mo encry (\\NAS\Share).
3. Tlhomamisa mo metsotswaneng e le 15 gore a o tla kgaola motlakase kgotsa o emise thulaganyo ya go tsenya khoutu ka botlalo:
4. Boemo A: Ransomware e sebetsa MO PC ya desekethopo mo LAN ya gago mme e tsenya difaele tsa NAS mo godimo ga SMB/Mapped Network Drive: Go goga fela thapo ya NAS Ethernet mo Kgatong 1 e setse e emisitse 100% ya go tsenya tshedimosetso mo NAS. Tlogela NAS e tshubilwe gore thulaganyo ya yone ya RAID le tsamaiso ya difaele di nne di le phepa, mme o ye go kgaoganya seteishene sa tiro sa Windows/Mac se se tshwaetsegileng.
5. Boemo B: Binary ya ransomware e dira ka tlhamalalo MO TENG ga tsamaiso ya tiriso ya NAS Linux ka boyone (DeadBolt, Qlocker, eCh0raix):
   • Fa o sa na Btrfs kgotsa ZFS dinepe tse di kgontshitsweng (ka sekai, tsa bogologolo ext4 bophahamo ba modumo) le di-drive di sila ka mafolofolo ha NAS e pata khopi ya hao e le nngwe feela ya difaele, ** tobetsa mme o tshware Konopo ya Matla ya pele ya mmele ho NAS bakeng sa metsotswana e 5 ho isa ho e 10 ho qobella ho tima matla a thata hang-hang ** (kapa hula polaka ya matla ya DC / AC haeba konopo e sa arabele). Motsotso mongwe le mongwe NAS e nna e tshubilwe e letla CPU ya yone go tsenya di-gigabyte tse dingwe di le 5 go ya go di le 20 tsa difaele tsa gago.
   • Tlhagiso e e botlhokwa (Why DeadBolt & Qlocker victims must NOT reboot after recovery): Mefuta ya serweboleta sa thekololo se se tshwanang le Qlocker (e e sutisetsang difaele go nna tse di sireleditsweng ka nomoro ya sephiri .7z diakhaefe di dirisa 7z) le DeadBolt ka dinako tse dingwe boloka boemo jo bo dirang jwa go tsenya khoutu kgotsa dinotlolo tsa go ntsha khoutu mo /tmp (RAM) kgotsa go tsaya ka dikgoka UI ya webo (/home/httpd/index.html). Fa o sa ntse o na le kgapetla ya modi wa SSH ya selegae e e bulegileng mo NAS, tlhola ps aux le /tmp pele o tima motlakase (bona Kgato 2 fa tlase).
6. Tsena mo routereng ya gago ya inthanete / lebota la molelo (192.168.1.1 / 192.168.0.1 / UniFi / pfSense / kgoro ya ISP) ka bonako mme o TIME UPnP (Universal Plug and Play) MME o phimole melao yotlhe ya WAN Port Forwarding e e supang NAS ya gago:
7. Diperesente di feta 80 tsa ditshwaetso tsa ransomware ya NAS ya kwa gae le kwa diofising tse dinnye di diragala ka gonne modirisi a ne a tobetsa "Thulaganyo ya Router e e Itirisang / EZ-Inthanete / UPnP" ka nako ya go rulaganya la ntlha, e e neng ya laela router ya kwa gae ka tidimalo gore e bule di-port tsa TCP . 5000, 5001, 8080, 8443, 443, 22 (SSH), kgotsa 445 (SMB) ka tlhamalalo go inthanete yotlhe ya botlhe (Shodan.io / Censys).
8. Thibela UPnP ruri mo dipeakanyong tsa WAN/NAT tsa router ya gago mme o phimole molao mongwe le mongwe wa go fetisetsa pele wa port o o supang aterese ya IP ya selegae ya NAS.
9. O SE KE wa simolola, wa fometa gape, kgotsa wa dirisa "Seta / Tsenya DSM kgotsa QTS gape" mo di-hard drive pele ga o tlhatlhoba gore a ransomware e tsere fela karolo ya OS kgotsa bolumu ya tshedimosetso:
10. Mo ditlhaselong tse di jaaka DeadBolt, serweboleta se se kotsi se kwalolola tsebe ya go tsena mo webong ya NAS (index.html) go bontsha ntlha ya thekololo e e tletseng mo sekirining e e thibelang go tsena mo dashebotong ya botsamaisi jwa QNAP/Synology, le fa Btrfs / ZFS dinepe kgotsa difaele tse dikgolo tsa bidio (tse di fetang dimegabyte di le 20) di sa ntse di sa senyega ka diperesente di le 100 mo di-drive.
11. Tlhola gore a NAS ya gago e na le Btrfs (Synology Snapshot Replication), ZFS (TrueNAS / QuTS hero), kgotsa LVM Ditshwantsho tsa Maemo a Boloko (QNAP Storage & Snapshots):
12. Ka gonne Btrfs le ZFS dinepe di buisiwa fela mo llageng ya boloko ya tsamaiso ya difaele (le Synology WORM / Ditshwantsho tse di sa fetogeng ga di kgone le go phimolwa ke sedirisiwa se se tsenngwang mo kotsing root akhaonto ya tsamaiso), gantsi o ka busetsa morago diperesente di le 100 tsa ditsholadifaele tsa gago tse di tsenngwang mo metsotswaneng e le 60 ka tatlhegelo ya tshedimosetso ya lefela le thekololo ya lefela e e duetsweng.
13. Pele ga o duela thekololo epe, supa mofuta wa ransomware o dirisa ID Ransomware (id-ransomware.malwarehunterteam.com) le No More Ransom (nomoreransom.org):
14. Mefuta e le mmalwa e megolo ya ransomware ya NAS (eCh0raix / QNAPCrypt, go sa le gale Qlocker ka photorec / qrescue go ntsha dikutu, Muhstik, le SynoLocker) di na le di-decryptor tsa mahala tsa setšhaba kgotsa mekgwa ya go ntsha dinotlolo tsa forensiki tse di gatisitsweng ke babatlisisi ba tiragatso ya molao le ba tshireletso.

Setlhare sa tshwetso: tsela ya go tlhopha ransomware ya NAS ka bonako le go e busetsa¶

Dirisa kelelo eno ya tiro go bona gore a tlhaselo e simolotse mo khomphuteng ya LAN kgotsa ka tlhamalalo mo NAS, mme o tlhophe mokgwa o o babalesegileng thata wa go boela mo mannong:

flowchart TD
    Symptom["NAS e Kgweetsa go Sila ka 100% + Difaele tse di Bidiwang Bošwa (.deadbolt, .7z, .ech0raix, .lockbit) kgotsa UI ya Webo e Bontsha Sekerini sa Thekololo"] --> PullLAN["KGATO 1 (Mo Metsotswaneng e le 5): Polaka Dikheibole Tsotlhe Tsa Ethernet Go tswa Kwa Morago ga NAS"]

    PullLAN --> SourceCheck{"A go Tsenya Dikhoutu go Emisitse ka bonako fela fa o ntsha thapo ya Ethernet ya NAS mo polakeng?"}

    SourceCheck -->|"EE: Tiro ya Diseke e wetse kwa tlase go nna lefela fa LAN e Kgakololwa"| SMBVector["MOTSWEDI A: Ransomware e Dira mo PC ya Windows/Mac mo Netewekeng ya Gago le go Tsenya Ditsholadifaele tse di Abelanwang mo SMB"]

    SourceCheck -->|"NNYAA: Di-Hard Drive tsa NAS di Tswelela Di Thunya Fa Ethernet e sa Tsenngwa mo Polakeng (Kgotsa Tsebe ya go Tsena mo Webo ya NAS ka Boyone e ne ya Emisediwa ka Sekerini sa Thekololo)"| DirectNAS["MOTSWEDI B: Binary ya Ransomware e Diragatsa ka Tlhamalalo mo Teng ga NAS OS (E Dirisiwa Botlhaswa ka UPnP / Dikou tsa WAN tse di Bontshitsweng 5000, 5001, 8080, 443, 22)"]

    SMBVector --> IsolatePC["Batla le go Kgaoganya PC e e Tshwaetsegileng mo LAN ya Gago -> Busetsa Ditsholadifaele tse di Abelanwang tsa NAS go tswa mo Ditshwantshong tsa Btrfs / ZFS / QNAP kgotsa Hyper Backup"]

    DirectNAS -->SSHCheck{"A o na le Thulaganyo ya SSH ya Selegae e e Dirang e e Butsweng (Kgotsa A ke Qlocker e e Dirang 7z)?"}

    SSHCheck -->|"Ee (Qlocker / Thulaganyo ya 7z e e Dirang)"| GrabPass["Tlhatlhoba ps aux | grep 7z mo SSH go Tshwara Mokwalo o o Tlhamaletseng 7-Zip Nomoro ya Sephiri Go tswa mo Args ya Mola wa Taelo Pele ga Thulaganyo ya go Bolaya"]
    SSHCheck -->|"Ga go na SSH / Didiseke tsa go Sila tsa Mofuta o o sa Itsiweng"| PowerOff["Tshwara Konopo ya Maatla ya NAS Metsotswana e le 5-10 go Pateletsa go Tima Maatla ka Bonako gore Difaele tse di sa Patelediwang le Sebaka se se Lokologileng di Bolokwe"]

    GrabPass --> KillUPnP["KGATO 2: Tsena mo Router -> Thibela UPnP Ruri + Phimola Melao Yotlhe ya go Fetisetsa Pele ya Boemakepe (5000, 5001, 8080, 443, 22)"]
    PowerOff --> KillUPnP
    IsolatePC --> KillUPnP

    KillUPnP --> RecoveryPath{"Ke Dithoto dife tsa Pusetso tse di leng teng mo NAS?"}

    RecoveryPath -->|"Ditshwantsho tsa Boloko jwa Btrfs / ZFS / QNAP"| SnapRestore["Phepafatsa Karolo ya OS / Ntšhwafatso ya Serweboleta -> Busetsa Ditsholadifaele tse di Abelanwang kwa Setshwantshong sa Pele ga Tlhaselo"]
    RecoveryPath -->|"USB ya kwa ntle / Bekapo ya kwa ntle ga Lefelo (Bekapo ya Hyper / HBS 3)"| BackupRestore["Phimola le go Aga Sešwa NAS mo Serweboleteng se se Patched -> Busetsa go tswa mo Bekapong ya Offline/Mo Marung"]
    RecoveryPath -->|"Ga go na Dinepe le Dibekapo"| ForensicCarve["Dikgweetso tsa Klone tse di Buisiwang Fela -> Tlhola NoMoreRansom.org + Tsamaisa PhotoRec / QRescue Go Betla go go sa Abelwang (Go Atlega Segolobogolo Kgatlhanong le Qlocker)"]

Kafa NAS Ransomware e Thubang ka Gone: Diphetogo Tse Pedi Tsa Tlhaselo¶

Pele o tsenya NAS ya gago gape mo switšhing ya neteweke ya gago ya selegae, o tshwanetse go itse gore ke efe ya divector tse pedi tse di farologaneng gotlhelele tsa go tsena e e letleletseng ransomware mo dibolumong tsa gago tsa polokelo:

Kgato 1: Go Tima go Dirisa Inthanete (Router UPnP, Port Forwarding, le Di-Relay tsa kwa Marung)¶

Fa o phepafatsa kgotsa o busetsa NAS ya gago kwantle ga go tswala phatla ya neteweke mo router ya gago, di-botnet tse di itirisang tse di sekasekang aterese ya gago ya IP ya botlhe di tla tshwaetsa NAS gape mo diureng di se kae morago ga go e busetsa mo inthaneteng. Feleletsa go tswalelwa ga neteweke mo router ya gago pele:

1. Tsena mo Router ya gago ya Inthanete / Khosole ya Botsamaisi jwa Lebota la Molelo:
2. Bula sebatli mo khomphuteng kgotsa mo founong e e phepa o bo o ya kwa IP ya gateway ya router ya gago (gantsi 192.168.1.1, 192.168.0.1, 10.0.0.1, kgotsa ka app ya gago ya mesh router jaaka UniFi, Eero, Google Home, TP-Link Deco, ASUS Router, Netgear Nighthawk).
3. Thibela UPnP (Universal Plug and Play) Ruri:
4. Tsamaela kwa E e Gatetseng Pele > Go Fetisetsa Pele ga NAT / WAN / Neteweke > UPnP o bo o fetola UPnP go TIMA / E thibetswe.
5. Goreng UPnP e kotsi thata mo go beng ba NAS: Fa UPnP e kgontshitswe mo router ya gago, sediriswa sepe fela se se mo netewekeng ya gago ya selegae (go akaretsa le wizate ya "EZ-Inthanete" kgotsa "Thulaganyo ya Router ya Boitiriso" ya NAS ya gago, kgotsa serweboleta se se kotsi mo TV e e botlhale) se ka romela . IGD (Internet Gateway Device) kopo go router ya gago e re "Bula WAN Port ya kwa ntle 8080 le 5001 go IP ya me ya selegae 192.168.1.50", o fapoga lebota la gago la molelo ntle le go kopa nomoro ya sephiri sa router ya gago.
6. Phimola Diphetiso Tsotlhe Tse di Dirwang ka Seatla (Virtual Server) & DMZ Melao e e supang NAS:
7. Eya go Tse di Gatetseng Pele > Go Fetisetsa Pele ga NAT > Go Fetisetsa Pele kwa Dikoung (kgotsa Disefara tsa Sebele) mme o phimole molao mongwe le mongwe wa go fetisetsa dikou tsa TCP kgotsa UDP (80, 443, 5000, 5001, 8080, 8443, 21 FTP, 22 SSH, 873 tsamaisano, 445 SMB, 32400 Plex fa e sa tlhokege) go IP ya gago ya NAS.
8. Hlahloba E tsoetseng pele > DMZ mme o netefatse hore DMZ Host e Thibetswe (ho beha IP ya NAS ho DMZ ya router ho pepesa dikou tsohle tsa TCP le UDP tsa NAS tse 65,535 tsa NAS ka kotloloho ho inthanete ya setjhaba).
9. Tlhomamisa go tswa kwa Ntle ga Neteweke ya Gago Gore Di-Port tsa NAS tsa Lefela di Butswe:
10. Etela shodan.io kgotsa grc.com (ShieldsUP) kgotsa dira tshekatsheko ya dikou kgatlhanong le aterese ya gago ya IP ya WAN ya botlhe go tlhomamisa gore dikou 5000, 5001, 8080, 8443, 443, le 22 jaanong busetsa Filtered / Stealth / Closed.

Kgato 2: Tlhatlhobo ya Tshoganyetso e e Kgethegileng ya Mofuta (Qlocker, DeadBolt, eCh0raix)¶

Pele o phimola NAS kgotsa o duela thekololo, tlhola gore ke mofuta ofe o o rileng wa ransomware ya NAS o o neng wa itaya sediriswa sa gago. Lelapa lengwe le lengwe le legolo la NAS le na le makoa a a kgethegileng a setegeniki a a letlang go busetsa tshedimosetso ka bontlhabongwe kgotsa ka botlalo kwantle ga go duela:

1. Fa Difaele tsa Gago di ne di emiseditswe ka .7z Diakhaefe (Qlocker mo QNAP / Linux NAS)¶

Jang Qlocker e a dira: Mo boemong jwa go kwala enjene e e itiretsweng ya cryptographic, Qlocker e dirisa sekeripiti se se bitsang NAS e e ageletsweng 7-Zip (/usr/local/sbin/7z) binary go gatelela faele nngwe le nngwe go nna e e sireleditsweng ka nomoro ya sephiri .7z akhaefe mme e bo e dirisa Linux e e tlwaelegileng rm (unlink) mo faeleng ya ntlha. - Leano la go Tlhaola #1 (Go Tshwara Lefoko la Sephiri ka Tlhamalalo mo ps aux Pele o Tima Motlakase): Fa Qlocker e sa ntse e dira mo NAS ya gago mme o ka tsena mo lefelong la gaeno ka SSH (ssh admin@nas-local-ip), dirisa taelo eno ka bonako pele ga o tima:

ps aux | grep 7z

2. Fa Sekerini sa Gago sa go Tsena mo NAS se ne sa emisediwa ka DeadBolt Tsebe ya Thekololo (.deadbolt difaele)¶

Jang DeadBolt ditiro: 1. DeadBolt e emisetsa /home/httpd/index.html (kgotsa /home/httpd/cgi-bin/index.cgi) e e nang le tsebe ya yone ya binary/HTML e e tseelang sebatli sa gago sa webo ka dikgoka nako le nako fa o leka go bula dashboard ya QNAP QTS / Asustor ADM, e e batlang Bitcoin go ananya ka selotlolo sa konokono sa go tlhalosa ditlhaka di le 32 tsa hex (se se gorosiwang ka Bitcoin e e mo ketaneng . OP_RETURN kgwebisano). 2. Kafa o ka kgonang go tsena gape mo Dashebotong ya gago ya Motsamaisi wa mogaka wa QNAP QTS / QuTS kwantle ga go latlhegelwa ke tshedimosetso ya gago: - Tlhopho A (Ka SSH ya selegae fa e kgontshitswe): SSH mo NAS ya selegae (ssh admin@<nas-ip>), emisa setlhobogi deadbolt thulaganyo fa e le gore e dira, mme o dirise sekeripiti sa semmuso sa go busetsa serweboleta sa QNAP kgotsa o busetse sa ntlhantlha /home/httpd/index.html go tswa mo setshwantshong sa ROM sa tsamaiso e e buisiwang fela (/mnt/HDA_root/update_pkg/). - Tlhopho B (Flashe ya Serweboleta se se senang Diseke + Go Tsenya Gape Polaka ya Hot): 1. Tima maatla a NAS. 2. Relela di-hard drive tsotlhe ka disentimetara di le 2 (1 inch) gore di kgaoganngwe le backplane (nomora tatelano ya tsone ya bay ka kelotlhoko ka theipi ya motaki pele). 3. Maatla a NAS * ntle le * di-hard drive, batla IP ya yone ka ** Qfinder Pro **, fa o tlhotlhelediwa mo sekirining sa go rulaganya hot-plug di-drive gape mo dikoung tsa tsone tse di tlhomameng, mme o tlhophe "Ntšhwafatsa Firmware Feela (Boloka Tshedimosetso Yotlhe le Dipeakanyo)" (o se ke wa tobetsa "Simolola di-drive tseo,). 3. Tlhagiso e e Botlhokwa ya go Tlhalosa Molao ka DeadBolt: Mo ditirong tse di gokagantsweng tse di eteletsweng pele ke Sepodisi sa Bosetšhaba sa Netherlands (Politie), Yuropolo (No More Ransom), le Baarabi.nu, ba tiragatso ya molao ba atlegile go tsietsa DeadBolt matshosetsi batšoantšisi nakong mempool tefello spike ka ho lokolla ** fetang 150 mong'a decryption dinotlolo ** pele bahlaseli 'tlaase-tefello Bitcoin ditransekshene ne hlakolwa ka Replace-By-Fee. Tlhola deadbolt.responders.nu le nomoreransom.org go bona gore a DeadBolt senotlolo sa aterese ya motswasetlhabelo se tserwe ke mapodisi.

3. Fa Difaele tsa Gago di Felela ka .encrypt (eCh0raix / QNAPCrypt)¶

• Dikokomana di le mmalwa tsa eCh0raix (QNAPCrypt) e dirisitse go tswa ga senotlolo sa AES se se sa siamang kgotsa e ne e na le taolo le taolo ya yone (C2) polokelotshedimosetso e e tserweng ke babatlisisi ba tshireletso le ba tiragatso ya molao.
• Etela nomoreransom.org mme o laise difaele tse pedi tse di tsenngwang khoutu (kgotsa ntlha ya thekololo README_FOR_DECRYPT.txt) go leka mahala Bitdefender / Ga go na Thekololo e nngwe eCh0raix Decryptor pele o phimola sepe.

Kgato 3: Go Busetsa Difaele tsa Gago go tswa go Btrfs, ZFS, kgotsa QNAP Ditshwantsho ka Metsotswana e le 60¶

Fa e le gore NAS ya gago e ne e tsentswe khoutu ke Vector #2 (PC e e tshwaeditsweng ke ransomware mo LAN ya gago e e tsenyang khoutu mo ditsholadifaeleng tse di abelanwang ka SMB), kgotsa fa e le gore o ne o na le Immutable (WORM) Ditshwantsho kgotsa tse di sa amiwang Ditshwantsho tsa LVM/Btrfs/ZFS ka nako ya tlhaselo e e tlhamaletseng ya NAS, o ka busetsa diperesente di le 100 tsa difaele tsa gago ka bonako:

1. Seteišene sa Diseke sa Synology (DSM 7.x ka Btrfs Poeletso ya Setshwantsho)¶

1. Sa ntlha, netefatsa gore PC e e tshwaetsegileng mo LAN ya gago e kgaotswe mo netewekeng, mme o ntšhwafatse Synology DSM go ya kwa tokollong ya bošeng ka fa tlase ga Phanele ya Taolo > Ntšhwafatsa le Busetsa.
2. Bula sephuthelwana sa Poeletso ya Setshwantsho mo teng ga Synology DSM.
3. Tobetsa Pholoso mo bareng ya kafa molemeng.
4. Tlhopha Setsholadifaele se se Abelanang se se tsenngwang khoutu (kgotsa iSCSI LUN) o bo o tobetsa Busetsa.
5. Batla lenaane la dinepe tse di rulagantsweng (GMT+...) mme o tlhophe setshwantsho se se tserweng ka bonako pele ga go tsenngwa ga ransomware go simolola (tlhola Tiro > Batla pele go leba pele difaele tse di mo teng ga senepe seo mme o netefatse gore di phepa e bile ga di a tsenngwa).
6. Tobetsa Tiro > Busetsa mo setshwantshong seno (kgotsa Klone ka leina le lesha fa o batla go boloka foltara e e tsenngwang khoutu e sa amiwa go bona bosupi jwa forensiki fa o ntse o tsenya khopi e e phepa ya foltara e e abelanwang ka bonako).
7. Ka gonne Btrfs ke Khopi-fa-go-Kwala (CoW) tsamaiso ya difaele, go busetsa morago foltara e e abelanwang ya di-terabyte di le 20 go ya kwa setshwantshong sa pele ga tlhaselo go tsaya metsotswana e e kwa tlase ga e le 10.

2. NAS ya QNAP (QTS Ditshwantsho tsa LVM tsa Boemo jwa Boloko & QuTS hero ZFS Dinepe)¶

1. Hang ha QTS / QuTS mohale e patched le arohane ho tloha WAN, bula ** Polokelo & Ditshwantsho **.
2. Eya go Polokelo > Polokelo/Ditshwantsho, tlhopha Bolumu e e Bokima, Bolumu e e Sesane, kgotsa Setsholadifaele se se Abelanwang sa ZFS se se amegang, o bo o tobetsa Molaodi wa Ditshwantsho (aekhone ya khamera).
3. Tlhopha senepe sa bofelo se se phepa se se tserweng pele ga setempe sa nako sa tlhaselo.
4. Batla setlhare sa ditsholadifaele mo teng ga letlhabaphefo le le kafa mojeng go netefatsa gore difaele tsa gago di sa senyega, o bo o tobetsa Revert Volume Snapshot (kgotsa tlhopha ditsholadifaele tsotlhe o bo o tobetsa Busetsa go kwala fela difaele tse di tsenngwang).

3. NAS ya Boammaaruri (CORE / SCALE mo ZFS) le E e sa tlhaselwang (ZFS / Btrfs)¶

• Mo TrueNAS (ZFS): Eya go Polokelo > Ditshwantsho (kgotsa Tshireletso ya Tshedimosetso > Ditiro tsa Ditshwantsho tsa Nako), batla setshwantsho se se phepa (tank/share@auto-2026-10-31_12-00), o bo o tobetsa Rollback (kgotsa kopisetsa senepe mo seteng e ntšha ya tshedimosetso zfs clone tank/share@auto-2026-10-31_12-00 tank/share_recovered ka jalo ga o ke o latlhegelwa ke dinepe tse disha tsa magareng).

Kgato 4: Go Thatafatsa NAS ya Gago Gore e se ka ya tlhola e Tsenngwa Gape (Lenaanenetefatso la Dintlha di le 7)¶

Fa tshedimosetso ya gago e setse e buseditswe, dirisa melao eno e supa ya thulaganyo e e tlamang mo sedirisiweng sa gago sa Synology, QNAP, TrueNAS, kgotsa Asustor pele o e golaganya gape le neteweke:

• 1. O se ka wa fetisetsa Port epe mo Router ya Gago kwa NAS ya Gago: Dirisa Tailscale kgotsa WireGuard VPN Go na le moo:
• Tsenya sephuthelwana sa semmuso sa Tailscale go tswa kwa Setheong sa Diphuthelwana tsa Synology / Setheo sa Ditiriso sa QNAP (kgotsa dirisa Sefara ya VPN ya WireGuard e e ageletsweng mo router ya gago).
• Tailscale e tlhama thanele ya letlowa e e tsenngwang khoutu ya WireGuard ya thulaganyo ya lefela, ya balekane (100.x.y.z) fa gare ga founo ya gago, laptop ya gago, le NAS ya gago e e nang le di-port tse di bulegileng tsa lefela mo leboteng la molelo la router ya gago ya mo gae. O ka fitlhelela dinepe tsa gago tsa NAS, difaele, le sekerini sa botsamaisi go tswa gongwe le gongwe mo lefatsheng fa NAS ya gago e ntse e sa bonale 100% mo di-scanner tsa inthanete tse di jaaka Shodan.
• 2. Thibela Thulaganyetsoruri e e Ageletsweng admin Akhaonto mme o Tlhame Motsamaisi yo o Bidiwang ka Tlwaelo yo o nang le 2FA e e Tlamang:
• Synology DSM le QNAP QTS ka bobedi di romelwa ka akhaonto ya thulaganyetsoruri e e bidiwang admin (UID 1024 kgotsa UID 0). Di-bot tse di itirisang tsa maatla a a setlhogo di thula leina la modirisi admin 24/7.
• Tlhama akhaonto e ntšha ya motsamaisi e e nang le leina la modirisi le le kgethegileng, tsena ka akhaonto eo e ntšha, ya kwa Phanele ya Taolo > Modirisi le Setlhopha (kgotsa Badirisi), le Thibela thulaganyetsoruri admin akhaonto.
• Tobetsa Netefatso ya Dintlha di le 2 e e Patelediwang (OTP / Passkey / Approve Sign-in) tsa diakhaonto tsotlhe tsa motsamaisi.
• 3. Tobetsa Se se sa Fetogeng (WORM) Dinepe (7-to-14-Day Retention Lock):
• Mo Synology DSM 7.2+: Bula Poeletso ya Dinepe > Dinepe > Dipeakanyo > Thulaganyo, kgontsha dinepe tsa letsatsi le letsatsi, mme o tlhole "Kgontsha dinepe tse di sa fetogeng" ka paka ya tshireletso ya malatsi a le 7 go ya go a le 14. Le fa motlhasedi a ka utswa nomoro ya gago ya sephiri kgotsa a dirisa bokoa jwa kernel mo DSM, ga go ope (le fa e le root) e ka phimola Setshwantsho se se sa Fetogeng go fitlha tshupanako ya serweboleta ya malatsi a le 7 e fela.
• Mo mogaka wa QNAP QuTS / QTS: Rulaganya Lefelo la Polokelo ya Setshwantsho kgotsa kgontsha WORM (Write Once, Read Many) dipholisi tsa go boloka mo dišereng tse di botlhokwa tsa bekapo, mme o netefatse gore "Sebaka sa Setshwantsho sa Peeletso" se kgontshitswe.
• 4. Thibela Ditetlelelo tsa Kabelano ya Neteweke ya SMB (Least Privilege) Ka jalo Tshwaetso ya Laptop Ga e Kgone go Tsenya NAS Yotlhe:
• Le ka motlha o se ke wa dira mmapa wa NAS ya gago admin dintlha tsa boitshupo mo teng ga Sebatlisisi sa Faele sa Windows (\\NAS\) mo di-laptop tsa letsatsi le letsatsi.
• Tlhama akhaonto e e tlwaelegileng ya modirisi e e seng ya motsamaisi gore o kgone go bona faele letsatsi le letsatsi, o bo o seta ditsholadifaele tsa gago tsa akhaefe/dinepe (ka sekai, 2010-2025 Family Photos Archive) go ya go Buisa-Fela (ro) ya badirisi ba letsatsi le letsatsi ba desekethopo gore fa PC ya Windows ya leloko la lelapa e ka tshwara ransomware, PC e kgone go bala ditsholadifaele tseo mme ga e kgone go di tsenya kgotsa go di fetola.
• 5. Tobetsa Lebota la Molelo le le Ageletsweng la NAS (Allow LAN + Tailscale Subnets Only) & Go Thibela ka Boitiriso:
• Mo teng ga Phanele ya Taolo ya Synology > Tshireletsego > Lebota la Molelo (kgotsa QNAP QuFirewall), tlhama molao o o gagametseng wa lenaane la ditetlelelo o o letlang dikgolagano fela go tswa mo netepotlaneng ya LAN ya selegae ya gago (192.168.1.0/24) le netepotlana ya gago ya Sekala sa Mogatla/VPN (100.64.0.0/10), e latelwa ke molao o o kwa tlase o o beilweng go Gana Tsotlhe. Le fa mongwe a ka retologa ka phoso UPnP morao ka router, NAS e ka hare pakete filthara tla lahlela mong le e mong setjhaba inthanete pakete hang-hang.
• 6. Thibela SSH (Port 22) le Thelnet (Port 23) Fa e sa Rarabolole Mathata ka Matlhagatlhaga:
• Tlogela SSH e OFF mo teng ga Phanele ya Taolo > Theminale & SNMP ka nako ya tiriso e e tlwaelegileng ya letsatsi le letsatsi; e tobetse fela metsotso e le 10 e o e tlhokang go dira tiro ya mola wa taelo, o bo o e tima gape.
• 7. Boloka Bekapo ya Boammaaruri ya "3-2-1" e e nang le Diphatlha tsa Mowa / e e sa Fetogeng ya Leru (Hyper Backup / HBS 3):
• Latela rona dibekapo tsa khomphiutha le kaedi ya 3-2-1 ya go tsosolosa fa go tlhaga masetlapelo: rulaganya Synology Hyper Backup kgotsa QNAP Hybrid Backup Sync (HBS 3) go kgarameletsa dibekapo tse di tsenngwang bosigo, tse di tlositsweng mo letlhakoreng la tlelaente mo hard drive ya USB ya kwa ntle e o e ntshang mo polakeng kgotsa mo Object-Locked (S3 Object Lock Compliance Mode) kgamelo ya maru (Backblaze B2, Wasabi, kgotsa AWS S3) o dirisa dinotlolo tsa API tse di thibetsweng tsa go tsenya fela.

Dinomoro tsa maemo a tshoganyetso tsa kgaolo le diporothokholo tsa boemedi¶

Ditlhaselo tsa ransomware tse di lebisitsweng mo didirisweng tsa NAS di batlisisiwa ke dikemedi tsa bosetšhaba tsa bokebekwa jwa inthanete lefatshe ka bophara, tse di bolokang mabolokelo a dinotlolo tsa go tlhalosa tse di tserweng (No More Ransom) le go latedisa mafaratlhatlha a bosenyi:

• Dinaga tse di Kopaneng le Canada:
• Kgaogo ya Tshoganyetso ya Pabalesego ya Botshelo: Daela 911 fa ransomware e kgoreletsa tlhokomelo ya boitekanelo kgotsa ditsamaiso tsa pabalesego ya mmele.
• Lefelo la Dingongorego tsa Bokebekwa jwa Inthanete la CISA le FBI (IC3): Bega matsholo a serweboleta sa thekololo sa NAS (DeadBolt, Akira, LockBit, Qlocker) kwa stopransomware.gov, ic3.gov, kgotsa leletsa CISA mo go 1-844-Say-CISA (1-844-729-2472).
• Senthara ya Canada ya Tshireletsego ya Inthanete le RCMP: Pegelo kwa cyber.gc.ca (1-833-CYBER-88) kgotsa Setheo sa Canada sa go Lwantsha Tsietso.
• Bogosi jo bo Kopaneng:
• Ditirelo tsa Tshoganyetso: Letsa 999 (kgotsa 101 ya mapodisi a e seng a tshoganyetso).
• Tsietso ya Tiro le NCSC: Bega ditiragalo tsa ransomware kwa actionfraud.police.uk kgotsa leletsa 0300 123 2040 (mola wa tiragalo ya inthanete o o tshelang wa 24/7). Dikgwebopotlana le mekgatlho ya bopelotshweu di ka buisana le Tsibogo ya Ditiragalo tsa Inthanete tsa NCSC (ncsc.gov.uk) kgoro.
• Kopano ya Yuropa:
• Ditirelo tsa Tshoganyetso: Letsa 112 go ralala dinaga tsotlhe tse di leng ditokololo tsa EU.
• Senthara ya Bokebekwa jwa Inthanete ya Yuropa ya Yuropa (EC3) & NoMoreRansom.org: Tlhola nomoreransom.org (e e tlhokometsweng ke Sepodisi sa Bosetšhaba sa Netherlands, Europol, le dikemedi tsa balekane) tsa dinotlolo tsa go ntsha dinotlolo tsa ransomware tsa NAS tse di tserweng, mme o begele CSIRT ya gago ya bosetšhaba le Bothati jwa Tshireletso ya Tshedimosetso (DPA mo diureng di le 72 fa tshedimosetso ya motho e ne e ntshitswe kgotsa e latlhegile ka fa tlase ga GDPR).
• Australia le Sešwa:
• Ditirelo tsa Tshoganyetso: Letsa 000 kwa Australia kgotsa 111 kwa New Zealand.
• Senthara ya Tshireletsego ya Inthanete ya Australia (ACSC: Leletsa Mogala wa Ransomware wa 24/7 mo go 1300 CYBER1 (1300 292 371) kgotsa bega kwa cyber.gov.au.
• SETIFIKEITI NZ: Pegelo kwa cert.govt.nz.
• India le Asia-Pacific:
• India (CERT-In & Mogala wa Thuso wa Bosenyi jwa Inthanete): Letsa 1930 kgotsa bega kwa cybercrime.gov.in le incident@cert-in.org.in.
• Taiwane (TWCERT/CC, taolo ya legae ya di-PSIRT tsa Synology, QNAP, le Asustor): Romela ditekete tsa tiragalo ya tshireletsego ya barekisi ka tlhamalalo kwa go PSIRT ya QNAP (service.qnap.com) kgotsa PSIRT ya Tshwaraganyo (synology.com/en-global/security/advisory).

Dipotso tse di bodiwang kgapetsakgapetsa¶

Ransomware e tshwaeditse jang QNAP kgotsa Synology NAS ya me fa ke ise ke ko ke tobetse kgokagano epe ya phishing mme dikhomphutara tsa me di le phepa gotlhelele?¶

NAS ya gago e ne e tshwaetsegile ka tlhamalalo go tswa mo inthaneteng ya botlhe ntle le go ama dikhomphutara tsa gago. E ka tswa e le gore routara ya gago ya inthanete e ne e na le UPnP (`Universal Plug and Play`) e kgontshitswe (e letla karolo ya NAS ya "Thulaganyo ya Routara ya Boitiriso / EZ-Inthanete / myQNAPcloud" go bula dikou ka tidimalo 8080, 443, 5000, 5001, kgotsa 22 mo leboteng la gago la molelo), kgotsa o fetisitse port ka seatla go fitlhelela difaele tsa gago o le kgakala. Di-botnet tse di itirisang di nna di sekaseka aterese nngwe le nngwe ya IP ya botlhe mo inthaneteng le go dirisa makoa a a sa baakanngwang kgotsa a a bokoa motsamaisi diphasewete mo digokaganong tsa webo tsa NAS tse di senotsweng.

Nka bona jang gore a ransomware e ne e tsamaya ka tlhamalalo mo teng ga NAS OS ya me kgatlhanong le mo go nngwe ya dikhomphutara tsa me tsa Windows ka karolo ya neteweke?¶

Leba ditshupo di le tharo: Sa ntlha, fa e le gore Sekerini sa go tsena sa botsamaisi jwa webo sa NAS ka bosone e ne ya emisediwa ka lekwalo la thekololo (jaaka Bolot e e Suleng), kgotsa fa e le fela NAS e e nang le difaele tse di tsenngwang fa PC nngwe le nngwe mo netewekeng ya gago e le phepa, malware e diragadiwa ka tlhamalalo mo teng ga NAS Linux OS. Sa bobedi, bula Pegelo ya Kgolagano ya NAS / Pegelo ya Phetiso ya Faele ya SMB (mo Thutong ya Ditshwantshanyo Lefelo la Lokwalo kgotsa QNAP Senthara ya QuLog): fa o bona aterese ya IP ya LAN ya lefelo leo (jaaka 192.168.1.24) go dira ditiro di le dikete di le masomesome tsa ka bonako Kwala / Naya leina gape / Phimola ditiro mo godimo ga SMB, morago ga moo khomphiutha 192.168.1.24 ke sediriswa se se tshwaetsegileng se se tsenyang NAS ya gago ka neteweke.

Goreng DeadBolt fela go tsenya tshimologo ya difaele tsa me tse dikgolo tsa bidio kgotsa tsa polokelotshedimosetso, mme a ke sa ntse ke kgona go tshameka kgotsa go baakanya difaele tse di tsenngwang tshedimosetso ka bontlhabongwe?¶

Go tsenya masomesome a di-terabyte tsa polokelo ya NAS pele ga mong wa yone a lemoga gore di-hard drive di a sila le go goga polaka, mefuta e e tshwanang le . Bolot e e Suleng tsenya khoutu fela dikilobaete tsa ntlha di le 512 (`524,288 bytes`) ya faele nngwe le nngwe mme o tsenye .selotlolo katoloso, e tlogela di-gigabyte tse di setseng tsa faele di sa amiwa ka mokwalo o o tlwaelegileng. Fa go latlhegelwa ke 512 KB ya ntlha go senya ditokomane tse dinnye le dinepe tsa JPEG gotlhelele, difaele tse dikgolo tsa dibidio tsa di-gigabyte tse dintsi (`.mp4`, `.mov`, `.mkv`), ditshwantsho tse di tala tsa khamera, le ditshwantsho dingwe tsa disiki tsa motšhini wa mmatota (`VMDK`/`VHDX`) kgotsa dipolokelotshedimosetso tsa SQL gantsi di ka baakanngwa ka go jala tlhogo ya setshodi e e mosola (`moov` atom) go tswa mo bidiong e nngwe e e gatisitsweng ka yone khamera eo go dirisiwa didirisiwa tse di jaaka go kgaola.

A Sinoloji QuickConnect kgotsa myQNAPcloud Link go babalesegile go tlogela go kgontshitswe fa ke tima router UPnP le Port Forwarding?¶

Ka router UPnP le go fetisetsa pele ga port ka diatla go timilwe gotlhelele, ditirelo tsa go fetisa tse di tswang jaaka Synology Relei ya Kgolaganyo ya ka Bofefo le Kgokagano ya leru la me la QNAP di bolokegile thata go feta dikou tsa WAN tse di bulegileng ka gonne ga di bule dikou tsa go reetsa mo leboteng la molelo la router ya gago. Le fa go ntse jalo, di sa ntse di senola sekerini sa gago sa go tsena sa NAS (`DSM` / `QTS` motshwari wa netefatso ya webo) go ope fela yo o itseng kgotsa yo o fopholetsang `QuickConnect ID`. Go bona tshireletsego e e kwa godimo, thibela phitlhelelo ya rile ya botlhe mo segokaganong sa botsamaisi mme o dirise Sekala sa mogatla kgotsa VPN ya Sethibelathapo go na le moo, e e tlhokang netefatso ya sedirisiwa sa kriptokerafi pele pakete e le nngwe ya HTTP e ka fitlha le kwa sefareng ya gago ya webo ya NAS.

A ke tshwanetse go duela thekololo ya Bitcoin ya DeadBolt, Qlocker, kgotsa eCh0raix fa ke sena di-backup e bile ke sena dinepe?¶

Ditheo tsa tiragatso ya molao (`FBI`, `CISA`, `Europol`, `NCSC`) ba gakolola thata kgatlhanong le go duela dithekololo ka gonne madi a tuelo a tshegetsa ditlhopha tsa dikebekwa mme ga a na netefaletso epe ya gore sekwalwa sa motlhasedi se se itirisang sa go ntsha difaele se tla dira kwantle ga go senya difaele. Pele ga o ka akanyetsa go duela: (1) Tsaya setshwantsho kgotsa o boloke di-drive gore o se ka wa gakatsa dilo, (2) Tlhola **`nomoreransom.org`** le **`deadbolt.responders.nu`** go bona gore a ba tiragatso ya molao ba setse ba tsere selotlolo sa mofuta wa gago, (3) Go **`Qlocker`**, taboga **`PhotoRec` / `QRescue`** mo sebakeng sa disiki se se sa abiwang (se gantsi se busetsang 60% go ya go 90% ya di-original tse di phimotsweng mahala), le (4) Go di-original tse dikgolo . `.mp4`/`.mov` dibidio di amilwe ke go tsenngwa ga setlhogo sa bontlhanngwe, go tlhatlhobiwa sešwa ga setlhogo sa teko ka `untrunc`.

Dikaedi tse di tsamaelanang¶

• Tshwaetso ya serweboleta se se kotsi, serweboleta sa thekololo, le serweboleta sa ditlhodi: go thibelwa ka bonako le go se busetsa
• Go sireletsa diroutara tsa mo gae le didirisiwa tsa IoT
• NAS RAID array e senyegile, go palelwa ga go kgweetsa gantsintsi, le go boela ga ZFS/Btrfs
• Dibekapo tsa khomphiutha, leano la 3-2-1, le go tsosolosa fa go tlhaga masetlapelo
• Go dirisa dipatchi tsa tshoganyetso tsa letsatsi la lefela le go tlhaola sediriswa kwa bokhutlong jwa botshelo
• Dinomoro tsa tshoganyetso go ya ka dinaga

Metswedi le kaelo ya semmuso¶

• Setheo sa Tshireletsego ya Inthanete le Tshireletsego ya Mafaratlhatlha (CISA) & Biro ya Bosetšhaba ya Dipatlisiso (FBI) (StopRansomware.gov): Tlhagiso ka Polokelo e e Gokeletsweng mo Netewekeng (NAS) Didirisiwa tse di Lebisitsweng ke DeadBolt, Qlocker, eCh0raix, le Ransomware ya Akira.
• Senthara ya Bokebekwa jwa Inthanete ya Yuropa ya Yuropa (EC3) & Sepodisi sa Bosetšhaba sa Netherlands (Politie) (NoMoreRansom.org): Tshebetso ya ho Hapa Senotlolo sa DeadBolt, Polokelo ya Decryptor ya eCh0raix, le Ditataiso tsa ho Fokotsa Ransomware.
• Setlhopha sa Tsibogelo ya Ditiragalo tsa Tshireletsego ya Dikumo tsa QNAP (QNAP PSIRT) & Boto ya Bogakolodi jwa Tshireletsego ya Synology: Dipegelo tsa Setegeniki ka ga go Thibela Router UPnP, Go Busetsa Dikhonsole tsa Botsamaisi tse di Tseilweng, QRescue (PhotoRec) Pusetso e e sa Abelwang, le Go Kgontsha Tse di sa Fetogeng WORM Ditshwantsho.
• Senthara ya Bosetšhaba ya Tshireletsego ya Inthanete (NCSC) (Bogosi jo bo Kopaneng): Go Fokotsa Malware le Ransomware mo Polokelong ya Neteweke le Didirisiwa Tse Dinnye tsa Ofisi.