So I think someone really wants to access my NAS

[FreedomEclipse]

And it looks like it was being hit by a botnet spoofing a mega butt tonne of IP address because they were absolutely hammering my NAS and none of the IPs were making the ban list for 5 wrong passwords from the same IP in under a minute.

 

[Hachi_Roku256563]

Dam what is on their

 

[FreedomEclipse]

Dam what is on their

Its only a media server. I mainly use it stream videos and music around my house.

 

[InhaleOblivion]

Yikes. Yeah that's alot of attempts.

 

[R-T-B]

Its only a media server. I mainly use it stream videos and music around my house.

Why not just let them in and fill it with rick roll youtube vids that are read only,,,

 

[jboydgolfer]

Ive had like 30 attempts on my steam account that has 1 free game in its library. Maybe hackers are just bored

 

[Jetster]

Why not just let them in and fill it with rick roll youtube vids that are read only,,,

honeypot

 

[Micko]

This happened to me as well this weekend and they did manage to break through.
QNAP event notifications showed that they attempted to log in as admin, from different IP, every 2 minutes. After about 20 hours of attempts, there is a message that System0.1 app has been installed. At the same minute that app was installed, it began to encrypt files (only document files, pdf-s and pictures. Movies and other data types were left alone). In each folder there was a .txt file with message that this is ransomware and you can decrypt them if you pay etc.

I suspect that "ransomware" managed to log in as one of the users since all the files had that user as "owner" and only files that this user had access to were infected. Serves me a lesson to never again set username and password as same word..

I removed the said user, deleted all the files (none of them were important) and disabled myQnapCloud. It is gonna stay like that for the time being.

 

[FreedomEclipse]

This happened to me as well this weekend and they did manage to break through.
QNAP event notifications showed that they attempted to log in as admin, from different IP, every 2 minutes. After about 20 hours of attempts, there is a message that System0.1 app has been installed. At the same minute that app was installed, it began to encrypt files (only document files, pdf-s and pictures. Movies and other data types were left alone). In each folder there was a .txt file with message that this is ransomware and you can decrypt them if you pay etc.

I suspect that "ransomware" managed to log in as one of the users since all the files had that user as "owner" and only files that this user had access to were infected. Serves me a lesson to never again set username and password as same word..

I removed the said user, deleted all the files (none of them were important) and disabled myQnapCloud. It is gonna stay like that for the time being.

I had two factor authentication enabled anyway, So even if they did eventually manage to brute force my user account, guessing the two factor number probably would have taken them an eternity.

I consulted the google and they suggested turning off UPNP on my router and on the NAS so I did that, cloud service is still running and not had anything attempt access since i made the original post.

 

[Solaris17]

Looks like that NAS is open to the public.

 

[qubit]

Hackers are why I don't make my data available over the internet over a login, despite how useful it would be to me.

I'd keep that NAS safe behind your firewall, away from the internet if at all possible for you.

 

[TheLostSwede]

The problem with turning off UPnP means that some other services work poorly. That said, it's an antiquated protocol with no real security, yet used by so many things.
Glad I have a custom build which is not visible to the internet. I can still access is via a private VPN connection when I'm not at home.

 

[FreedomEclipse]

Looks like that NAS is open to the public.

Set on private access only though

 

[Solaris17]

Set on private access only though

If the interface is available to the public, then its going to get hit. No matter what kind of auth method you are using.

 

[TheLostSwede]

Might be worth checking if you have any ports open on your network, just in case.

Open Port Check Tool - Test Port Forwarding on Your Router

Port checker is a utility used to identify your external IP address and detect open ports on your connection. This tool is useful for finding out if your port forwarding is setup correctly or if your server applications are being blocked by a firewall.

www.yougetsignal.com

 

[neatfeatguy]

I don't know why you just don't do what they do in the movies.

Once they hack into your system you use a backdoor hack to access their system and turn on their camera to capture a screen shot of them and then you battle it out hacker style. Then, once you know who they are, you vow to come to their house and kick their ass or you tell them that you have a set of skills and you'll find them, no matter where they go if they don't leave your system alone.

I see it in movies all the time, so it must be true.

 

[newtekie1]

Set on private access only though

It is obviously not private only if it is getting hit with login attempts from the internet.

 

[qubit]

Set on private access only though

To elaborate on what the others have said, it's still open to the public internet, ie packets from Mr Hacker can still reach it. Once they find a flaw in the OS to crack it open, then it's game over for you and your data is theirs.

Also, don't think that sitting behind a firewall with certain ports opened up to allow access to the NAS is safe, either. It isn't. Hackers can port scan an address in seconds, find those open ports and then start poking at your system exactly like before. This is why I've run a hardened Linux based hardware, or edge firewall on my network for the last 20 years. The diddy little firewall in your broadband router does the same thing, but it's just not as secure.

 

[bug]

I had two factor authentication enabled anyway, So even if they did eventually manage to brute force my user account, guessing the two factor number probably would have taken them an eternity.

Chinese hackers bypass two-factor authentication

One cyber firm believes it knows how it was done.

ia.acs.org.au

 

[qubit]

Chinese hackers bypass two-factor authentication

One cyber firm believes it knows how it was done.

ia.acs.org.au

This is exactly why I don't make my data available over the internet, no matter how secure the access might seem. I'm not a government entity, or company with deep pockets able to pay for professional-level security and if these guys got rooted like this, then my setup is gonna be a piece of cake for hackers. My firewall remains locked down.

 

[TheLostSwede]

Looks like QNAP issued a timely news release...

Take Action to Protect Your QNAP Devices From Brute-Force Attacks

Taipei, Taiwan, March 24, 2021 - QNAP® Systems, Inc. (QNAP), a leading computing, networking and storage solution innovator, consi ...

www.qnap.com

 

[FreedomEclipse]

Just a little follow up. It seems they were hammering my NAS for at least two days before i decided to do my random regular login in to check the status.

Followed the instructions from the post above and deleted the admin account. Everything has been quiet on it since disabling upnp though and i have yet to run in to and problems because I disabled it. (though i havent tried connecting to my NAS via cloud or remotely from my tablet or mobile when im away from home)

thank god they didnt manage to crack my password.

 

[Caring1]

Wow, they definitely tried hard.

 

[MentalAcetylide]

Just a little follow up. It seems they were hammering my NAS for at least two days before i decided to do my random regular login in to check the status.

View attachment 194576


Followed the instructions from the post above and deleted the admin account. Everything has been quiet on it since disabling upnp though and i have yet to run in to and problems because I disabled it. (though i havent tried connecting to my NAS via cloud or remotely from my tablet or mobile when im away from home)

thank god they didnt manage to crack my password.

"Training day" attacks. Probably some individual experimenting or refining their technique.

To be honest & clear on where I stand with all of this: despite the obvious benefits, I think it was an extremely idiotic, ass-hatted, and very shortsighted idea to have critical infrastructure set up and networked in such a way that someone else anonymously using a computer(or even a cell phone) on the other side of the globe can break in and pretty much create all kinds of havoc. Besides hostile states being active in this area, you also have groups of individuals doing it for shits & giggles, bitcoins, or just to take the piss.
All of the fancy passwords, authentication protocols, protections, etc., are worthless when they can be bypassed. With the ever increasing number of ubiquitous software suites, apps, etc., its at a point where the dog is chasing it's tail.