Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 | 3 | 4
6933 posts

Uber Geek
+1 received by user: 3224

Moderator
Trusted
Lifetime subscriber

  Reply # 1103239 6-Aug-2014 12:54
Send private message

nigelj: Based on networkn's quote and the Synology changelog, looks like the issue that was fixed back in Feb was related to the following two CVEs:

 


6955 looks to be the nasty one:

Overview

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.


So:  People upgrade your NAS!


There has been people on the latest firmware at the time this was released and got pwned too. The exploit has been around for a while however Synology have not gotten to patching it up until the day a few NAS's were cracked.




Michael Murphy | https://murfy.nz
Want to be with an epic ISP? Want $20 to join them too? Well, use this link to sign up to BigPipe!
The Router GuideCommunity UniFi Cloud Controller | Ubiquiti Edgerouter Tutorial


15331 posts

Uber Geek
+1 received by user: 4045

Trusted
Lifetime subscriber

  Reply # 1103242 6-Aug-2014 12:56
Send private message

michaelmurfy:
nigelj: Based on networkn's quote and the Synology changelog, looks like the issue that was fixed back in Feb was related to the following two CVEs:

 


6955 looks to be the nasty one:

Overview

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.


So:  People upgrade your NAS!


There has been people on the latest firmware at the time this was released and got pwned too. The exploit has been around for a while however Synology have not gotten to patching it up until the day a few NAS's were cracked.


Hi. 

Where did you see that ? I have not seen any reports of any infected running v5 or even later versions of v4?


 
 
 
 


6933 posts

Uber Geek
+1 received by user: 3224

Moderator
Trusted
Lifetime subscriber

  Reply # 1103259 6-Aug-2014 13:15
Send private message

networkn: 

Hi. 

Where did you see that ? I have not seen any reports of any infected running v5 or even later versions of v4?



I can't remember where but my NAS was running DSM 4.3-3827 Update 4 at the time it got owned, only port 5000 forwarded.




Michael Murphy | https://murfy.nz
Want to be with an epic ISP? Want $20 to join them too? Well, use this link to sign up to BigPipe!
The Router GuideCommunity UniFi Cloud Controller | Ubiquiti Edgerouter Tutorial


15331 posts

Uber Geek
+1 received by user: 4045

Trusted
Lifetime subscriber

  Reply # 1103441 6-Aug-2014 16:14
One person supports this post
Send private message

michaelmurfy:
networkn: 

Hi. 

Where did you see that ? I have not seen any reports of any infected running v5 or even later versions of v4?



I can't remember where but my NAS was running DSM 4.3-3827 Update 4 at the time it got owned, only port 5000 forwarded.


Can I recommend you contact Synology. If they are working off incorrect information I think it's important they know the issue might be more widespread. 


15331 posts

Uber Geek
+1 received by user: 4045

Trusted
Lifetime subscriber

  Reply # 1103698 6-Aug-2014 22:18
Send private message

I am happy to provide you with the local distributors details in a PM if you don't know them already.

2848 posts

Uber Geek
+1 received by user: 258


  Reply # 1103735 6-Aug-2014 23:50
Send private message

Looks like those who did get hit by cryptolocker are in luck!
If you still have the encrypted files that is.

https://www.decryptcryptolocker.com




Amanzi
815 posts

Ultimate Geek
+1 received by user: 50

Trusted
Subscriber

  Reply # 1103738 7-Aug-2014 00:22
One person supports this post
Send private message

CYaBro: Looks like those who did get hit by cryptolocker are in luck!
If you still have the encrypted files that is.

https://www.decryptcryptolocker.com


Seems too good to be true, but excellent news if it works. More details here: http://www.fireeye.com/blog/corporate/2014/08/your-locker-of-information-for-cryptolocker-decryption.html

2848 posts

Uber Geek
+1 received by user: 258


  Reply # 1103769 7-Aug-2014 05:52
Send private message

I have one client who got hit, that we sorted out with a restore from their ShadowProtect backup, that I still have the encrypted files from.
Will give it go and report back.




BDFL - Memuneh
59412 posts

Uber Geek
+1 received by user: 10621

Administrator
Trusted
Geekzone
Lifetime subscriber

1282 posts

Uber Geek
+1 received by user: 265


  Reply # 1103830 7-Aug-2014 10:12
One person supports this post
Send private message

CYaBro: Looks like those who did get hit by cryptolocker are in luck!
If you still have the encrypted files that is.

https://www.decryptcryptolocker.com


Not so lucky.
I read that site/fix doesnt work for synolocker .


2848 posts

Uber Geek
+1 received by user: 258


  Reply # 1103851 7-Aug-2014 10:52
Send private message
BDFL - Memuneh
59412 posts

Uber Geek
+1 received by user: 10621

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 1105275 9-Aug-2014 09:58
Send private message

Received today (well, last night):


We have discovered security vulnerabilities on the software currently installed on your Synology product. These vulnerabilities might result in unauthorized parties compromising your Synology product.

We strongly suggest you install the newest version of DSM as soon as possible. To do so, please visit our Download Center and download DSM 5.0-4493, DSM 4.3-3827, DSM 4.2-3250, or DSM 4.0-2263 according to your current version. Then, log in to DSM and go to Control Panel > Update & Restore > DSM Update > Manual DSM Update (for DSM 4.3 and earlier, please go to Control Panel > DSM Update > Manual DSM Update) and manually install the patch file.

For more information about security issues related to Synology products, please check our Synology Product Security Advisory page.






2074 posts

Uber Geek
+1 received by user: 961

Trusted
Subscriber

  Reply # 1105284 9-Aug-2014 10:21
Send private message

I've shut down port forwarding on my router. Not too techy, is this all I need to do?

BDFL - Memuneh
59412 posts

Uber Geek
+1 received by user: 10621

Administrator
Trusted
Geekzone
Lifetime subscriber

2074 posts

Uber Geek
+1 received by user: 961

Trusted
Subscriber

  Reply # 1105295 9-Aug-2014 10:48
Send private message

Thanks. Fascinating, how do they find the diskstations in the first place ? Do they randomly target ip addresses and try port 5000? And once they find a diskstation, how do they get past strong admin passwords?

1 | 2 | 3 | 4
Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

New Zealand hits peak broadband data
Posted 18-Jan-2018 12:21


Amazon Echo devices coming to New Zealand early February 2018
Posted 18-Jan-2018 10:53


$3.74 million for new electric vehicles in New Zealand
Posted 17-Jan-2018 11:27


Nova 2i: Value, not excitement from Huawei
Posted 17-Jan-2018 09:02


Less news in Facebook News Feed revamp
Posted 15-Jan-2018 13:15


Australian Government contract awarded to Datacom Connect
Posted 11-Jan-2018 08:37


Why New Zealand needs a chief technology officer
Posted 6-Jan-2018 13:59


Amazon release Silk Browser and Firefox for Fire TV
Posted 21-Dec-2017 13:42


New Chief Technology Officer role created
Posted 19-Dec-2017 22:18


All I want for Christmas is a new EV
Posted 19-Dec-2017 19:54


How clever is this: AI will create 2.3 million jobs by 2020
Posted 19-Dec-2017 19:52


NOW to deploy SD-WAN to regional councils
Posted 19-Dec-2017 19:46


Mobile market competition issues ComCom should watch
Posted 18-Dec-2017 10:52


New Zealand government to create digital advisory group
Posted 16-Dec-2017 08:47


Australia datum changes means whole country moving 1.8 metres north-east
Posted 16-Dec-2017 08:39



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.