Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 | 3 | 4
 
 
 

Affiliate link: Invest in the US market with a Hatch account.
michaelmurfy
/dev/null
9557 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  #1103239 6-Aug-2014 12:54
Send private message

nigelj: Based on networkn's quote and the Synology changelog, looks like the issue that was fixed back in Feb was related to the following two CVEs:

 


6955 looks to be the nasty one:

Overview

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.


So:  People upgrade your NAS!


There has been people on the latest firmware at the time this was released and got pwned too. The exploit has been around for a while however Synology have not gotten to patching it up until the day a few NAS's were cracked.




networkn
23211 posts

Uber Geek

Trusted
Lifetime subscriber

  #1103242 6-Aug-2014 12:56
Send private message

michaelmurfy:
nigelj: Based on networkn's quote and the Synology changelog, looks like the issue that was fixed back in Feb was related to the following two CVEs:

 


6955 looks to be the nasty one:

Overview

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.


So:  People upgrade your NAS!


There has been people on the latest firmware at the time this was released and got pwned too. The exploit has been around for a while however Synology have not gotten to patching it up until the day a few NAS's were cracked.


Hi. 

Where did you see that ? I have not seen any reports of any infected running v5 or even later versions of v4?


 
 
 
 


michaelmurfy
/dev/null
9557 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  #1103259 6-Aug-2014 13:15
Send private message

networkn: 

Hi. 

Where did you see that ? I have not seen any reports of any infected running v5 or even later versions of v4?



I can't remember where but my NAS was running DSM 4.3-3827 Update 4 at the time it got owned, only port 5000 forwarded.




networkn
23211 posts

Uber Geek

Trusted
Lifetime subscriber

  #1103441 6-Aug-2014 16:14
Send private message

michaelmurfy:
networkn: 

Hi. 

Where did you see that ? I have not seen any reports of any infected running v5 or even later versions of v4?



I can't remember where but my NAS was running DSM 4.3-3827 Update 4 at the time it got owned, only port 5000 forwarded.


Can I recommend you contact Synology. If they are working off incorrect information I think it's important they know the issue might be more widespread. 


networkn
23211 posts

Uber Geek

Trusted
Lifetime subscriber

  #1103698 6-Aug-2014 22:18
Send private message

I am happy to provide you with the local distributors details in a PM if you don't know them already.

CYaBro
3330 posts

Uber Geek

Subscriber

  #1103735 6-Aug-2014 23:50
Send private message

Looks like those who did get hit by cryptolocker are in luck!
If you still have the encrypted files that is.

https://www.decryptcryptolocker.com

amanzi
971 posts

Ultimate Geek

Trusted

  #1103738 7-Aug-2014 00:22
Send private message

CYaBro: Looks like those who did get hit by cryptolocker are in luck!
If you still have the encrypted files that is.

https://www.decryptcryptolocker.com


Seems too good to be true, but excellent news if it works. More details here: http://www.fireeye.com/blog/corporate/2014/08/your-locker-of-information-for-cryptolocker-decryption.html

 
 
 
 


CYaBro
3330 posts

Uber Geek

Subscriber

  #1103769 7-Aug-2014 05:52
Send private message

I have one client who got hit, that we sorted out with a restore from their ShadowProtect backup, that I still have the encrypted files from.
Will give it go and report back.

freitasm
BDFL - Memuneh
68498 posts

Uber Geek

Administrator
Trusted
Geekzone
Lifetime subscriber

  #1103792 7-Aug-2014 08:18
Send private message

That's why NAS who led have backups too...




 

 

These links are referral codes

 

Geekzone broadband switch | Eletricity comparison and switch | Hatch investment (NZ$ 10 bonus if NZ$100 deposited within 30 days) | Sharesies | Mighty Ape | Backblaze | Amazon | My technology disclosure


1101
2289 posts

Uber Geek


  #1103830 7-Aug-2014 10:12
Send private message

CYaBro: Looks like those who did get hit by cryptolocker are in luck!
If you still have the encrypted files that is.

https://www.decryptcryptolocker.com


Not so lucky.
I read that site/fix doesnt work for synolocker .


CYaBro
3330 posts

Uber Geek

Subscriber

  #1103851 7-Aug-2014 10:52
Send private message

Can confirm it works for the original cryptolocker.

freitasm
BDFL - Memuneh
68498 posts

Uber Geek

Administrator
Trusted
Geekzone
Lifetime subscriber

  #1105275 9-Aug-2014 09:58
Send private message

Received today (well, last night):


We have discovered security vulnerabilities on the software currently installed on your Synology product. These vulnerabilities might result in unauthorized parties compromising your Synology product.

We strongly suggest you install the newest version of DSM as soon as possible. To do so, please visit our Download Center and download DSM 5.0-4493, DSM 4.3-3827, DSM 4.2-3250, or DSM 4.0-2263 according to your current version. Then, log in to DSM and go to Control Panel > Update & Restore > DSM Update > Manual DSM Update (for DSM 4.3 and earlier, please go to Control Panel > DSM Update > Manual DSM Update) and manually install the patch file.

For more information about security issues related to Synology products, please check our Synology Product Security Advisory page.






 

 

These links are referral codes

 

Geekzone broadband switch | Eletricity comparison and switch | Hatch investment (NZ$ 10 bonus if NZ$100 deposited within 30 days) | Sharesies | Mighty Ape | Backblaze | Amazon | My technology disclosure


dafman
3335 posts

Uber Geek

Trusted
Subscriber

  #1105284 9-Aug-2014 10:21
Send private message

I've shut down port forwarding on my router. Not too techy, is this all I need to do?

freitasm
BDFL - Memuneh
68498 posts

Uber Geek

Administrator
Trusted
Geekzone
Lifetime subscriber

  #1105285 9-Aug-2014 10:21
Send private message

Update the firmware as instructed.





 

 

These links are referral codes

 

Geekzone broadband switch | Eletricity comparison and switch | Hatch investment (NZ$ 10 bonus if NZ$100 deposited within 30 days) | Sharesies | Mighty Ape | Backblaze | Amazon | My technology disclosure


dafman
3335 posts

Uber Geek

Trusted
Subscriber

  #1105295 9-Aug-2014 10:48
Send private message

Thanks. Fascinating, how do they find the diskstations in the first place ? Do they randomly target ip addresses and try port 5000? And once they find a diskstation, how do they get past strong admin passwords?

1 | 2 | 3 | 4
Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic




News »

Amazon introduces new Echo devices
Posted 25-Sep-2020 11:56


Mad Catz introduces new S.T.R.I.K.E. 13 Mechanical Gaming Keyboard
Posted 25-Sep-2020 11:34


Vodafone NZ upgrades international submarine network
Posted 25-Sep-2020 09:09


Jabra announces wireless noise-cancelling airbuds, upgrade existing model
Posted 24-Sep-2020 14:43


Nokia 3.4 to be available in New Zealand
Posted 24-Sep-2020 14:34


HP announces new HP ENVY laptops aimed at content creators
Posted 24-Sep-2020 14:02


Logitech introduce MX Anywhere 3
Posted 21-Sep-2020 21:17


Countdown unveils contactless shopping with new Scan&Go tech
Posted 21-Sep-2020 09:48


HP unveils new innovations for businesses adapting to rapidly evolving workstyles and workforces
Posted 17-Sep-2020 15:36


GoPro launches new HERO9 Black camera
Posted 17-Sep-2020 09:45


Telecommunications industry launches new 5G Facts website
Posted 17-Sep-2020 07:56


New Zealand ranks 3rd in world in GSMA index
Posted 15-Sep-2020 10:13


Trend Micro Security Suite adds web monitoring to prevent identity theft
Posted 14-Sep-2020 15:37


NVIDIA to acquire Arm for US$ 40 billion
Posted 14-Sep-2020 12:27


Epson launches its next gen A3+ colour EcoTank multi-function printer
Posted 10-Sep-2020 16:08



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.