Massive Botnet Attacking Synology - how to protect your NAS
Vložit
- čas přidán 22. 06. 2024
- Get 20% off DeleteMe US consumer plans when you go to joindeleteme.com/REX and use promo code REX at checkout. Thanks to DeleteMe for sponsoring this video!
In this video, we are going to be discussing a botnet of devices that have been trying to hack in to Synology NAS's. I will be going over how this works, the threat to your system, and how to protect yourself.
Hire Me! yarboroughtechnologies.com/co...
Post on the Forums! forums.spacerex.co/
Links mentioned:
Video on firewall rules: • How to Set up Firewall...
Video on security Setup: • How to Secure your Syn...
Synology Recommendations*:
Hard drives I recommend: amzn.to/3RA3udS
Starter NAS: amzn.to/46hrRS7
Great all around NAS: amzn.to/46egNVP
More powerful NAS (great for larger/mid sized businesses): amzn.to/3YwRziM
#synology #nas #ransomware
TOC:
00:00 Introduction
00:52 What is a botnet?
02:49 Thanks to DeleteMe for sponsoring this section of the video!
04:10 How the botnet gets into your NAS
07:59 How to protect yourself
08:48 Deactivate admin account
10:00 Auto Block
10:45 Account Protection
13:07 Adaptive MFA
14:11 2-Factor Authentication
15:02 Change Port Number
17:12 Geo-blocking
21:33 Quickconnect
23:12 Conclusion
*These are affiliate links, which means that if you purchase a product through one of them, I will receive a small commission (at no additional cost to you). Thank you for supporting my channel! - Věda a technologie
Will last September when I got my 923+ I went through your setup videos on security when setting up mine, basically word for word. I paused after you mentioned changing a setting, changed it myself, and then continued on the video. Your help is better than the Synology's official help which is usually the case with a hardware company.
Thanks so much for your videos. I recently got a nas after doing some research and your videos convinced me that Synology was the way to go for me because of how comprehensive DSM is. Your setup and security tutorials have been invaluable for me!
Thanks for this great video, I've since enabled Account Protection on both my NAS's as the other options I'd already got enabled. I now feel extra confident my data is secure from attack. It was also interesting to learn how the attacks take place with the multiple IP Addresses etc. I don't comment much, but I've been a subscriber back in the day when you had about 25k,subs so it's really really nice to see you channel growing and doing well. All the best - Neil (UK)
Something to consider is that all of this really only applies if the attackers can reach your NAS. My advice is to use Tailscale and make it so only devices on the tail net which need access can reach it.
Tailscale is insanely good. Turning an Apple TV or OpenWRT device into a subnet router and being able to securely access everything on my network remotely from anywhere makes Synology QuickConnect an unnecessary risk.
Absolutely, but there are people who need to be able to have tons of people (contracts and clients) using the NAS. which you have to open up to the internet
Tailscale works great until connected through a relay server (DERP) then it becomes unusable.
A private VPN server would be better, you can control everyone's access by ACL. The only downside I can think of is you would need a public IP
@@NullPointer1100 Actually you can use DDNS service which will fix your public IP issue. If you're referring to CGNAT then yes it's an issue. Tailscale gets around that without an issue.
Good, comprehensive information - thanks. For my NAS clients, I keep remote NAS access disabled, largely for this reason. I only have one client that requires remote access to anything on the NAS, so I have them set up so they have to connect to their office LAN via VPN first, and only then can they access the NAS. This works fine for them largely because they're a small office that doesn't share data directly with anyone else. (And, of course, I keep my NAS clients comprehensively backed up because, well, bad stuff happens...)
Used many of these easier methods on two NASs. One fw 7.2 the other fw 6.2. Virtually no issues on 7.2 from the start but tons of attacks on the 6.2 unit. admin and guest were disabled from the start and the autoblock helped me sleep at night but I had logs of multiple RSYNC attacks from the same IP and then cycling to other worldwide IPs with China and Russia topping lists. The addition of firewall and account protection caused the attacks to cease completely for the past 11 days. Looking at swapping out the remote 6.2 unit for a 7 series soon to further bolster security but for now, all looks quiet. Excellent information much of which I had put into practice already but relatively simple to implement and works very well!
In dsm 7.2 the block list extends to quickconnect so blocked at Synology end and by default doesn't enable portforward via UPNP
Also it's quite easy to get list of Synologys that have quickconnect enabled
Thanks. reminders on good security anre always appreciated. I especially loved the simple firewall suggestions. Adopted. I accidentally typed 196.168 instead of 192.168 and the NAS would not apply the rules because it woul block the computer making the rule change! Quite impressed.
The Synology firewall rules are actually really good about that kind of stuff! I have always been pretty impressed by how well they work
You had me worried for a moment! Checked my logs and no drama :) As always great content and I had already done most of the things you suggested from previous tips from you!
Brilliant video. You covered a lot of ground with just the right amount of detail. Excellent.
So timely for me right now. Thank you for this!
Realy helpful appreciate your work, thank!
Thanks Will! Excellent video!
Thanks Jeffrey!
Thank you for that security update.
OMG watched this video to learn about the Botnet attack. While watching saw that I had used these same firewall rules mention to block access for countries outside the US. No wonder my apps were not working when I traveled. Thanks for the indirect help! You are man!
Excellent tips. I've been on Synology NAS models for 13 years. Very to see I'm doing the right things to security harden.
Thank you, that was very informative.
Outstanding post! - Thanx Rex 👍👍👍👍👍
Thank you for the information! As always a great video.
Always appreciate your tips 👍🏿
Thanks for sharing this great information !
Thank you.. This is really useful and in an easy and beautiful way
You sir are a godsend! Thank you so much!
More incredible content, thanks Will. And the SpaceRex team is hurtling towards 100k subscribers, getting very close now!
I wonder how AI will affect their attempts at 'brute focing' thing, or really just tactics for approaching what they are trying to do. As with everything AI supercharges, you'd think it would also be of benefit to them too in some way...
I am sure that AI will soon be used to look at your IP address and check the Dark Web for all the passwords that you have used on prior sites that have been hacked and based on your password structure it will generate a list to use on your other devices. It is just a matter of time
There's one more thing to consider. Reverse proxy, is a great way to limit your exposure down to just one port. This is great if you have multiple services running.
Also if you choose a specific LAN interface to configure, instead of all, you have the option to just switch interfaces should you be unlucky enough to lock yourself out playing with the firewall rules.
Will, great tech advice as always -- and of course, great hair 👍
This made me go through all of the protections that I have set and, I'm happy to say that, other than Account Protection, I had everything setup correctly. ( I also had the geo-block setup on my Synology router.) I hadn't realized that Synology had automatically enabled Adaptive MFA at some point so I was a bit shocked one day when I got the email alert. This has been a great exercise and one that we all need to review periodically. As a slight aside, even though I am mucking about in the Control Panel fairly often, I can easily forget what settings that I've changed, when, and why. So, I have gotten into the habit of keeping an Excel spreadsheet on all of this stuff for all of my devices. A bit anal, yes, but very effective. But it keeps things consistent around my network. It would be so nice if some of these devices would allow the export of all of their settings into something like a CSV file. May thanks again Will.
A diff analysis tool (current vs default) is a feature that sadly is missing in most equipment.
Great video Thanks So Much!
Done! Thanks!
thanks for the update to best security practises
I am still running an old Synology NAS but I am definitely considering upgrading in the next year. That said I really like your channel Will, it's helping be better informed and more aware of what's going on in the NAS space. So I just want to say thanks.
Really appreciate it!
@@SpaceRexWill 🙏
Thanks for this!
Good video Will, it finally prompted me to disable the default 'admin' account and set up a new one......I mean Synology has been nagging me to do that forever!
I'd also point out Synology's Active Insight might be helpful here. That's how I was notified about the ongoing attacks. We got that exact attack from around the beginning of the month. SSH attempts happen fairly often, but this was the first time I saw DSM targetted on that scale. I set aggressive permanent IP blocking, and they all only ever tried the "admin" account. It has been several weeks with no more attempts.
thanks for this. you the man!
Thx a lot - very helpful
Please talk about securing the Nas physical. I just realized recently that the buttons on the back can activate and rest the admin password, meaning anyone that can steal your nas physically will have access to all your file. This is really dangerous and there is a solution for that.
In the system settings, under "System Reset," there's an option to "Keep Admin Password Unchanged." Activating this option ensures that if someone tries to reset your NAS, they can enable the admin account but won’t be able to reset the admin password. To implement this, you need to change your admin password and select this option.
Some might argue that the files are encrypted. However, if you have auto-mounted files and the thief resets the password, they would still have full access to everything. Therefore, taking this additional security measure is crucial to protect your data.
Great advice! I had no idea that feature existed, I found it in Control Panel > Update & Restore > System Reset
@@jemmrich just make sure to never ever ever forget admin password as you will not be able to rest it if you lose your normal administration account and also forget the admin password that you just changed.
I would advise to add it somewhere in your phone or Google cloud or any other cloud so if you forgot you can go back to it. The admin is not visible unless you push that button for 4 seconds. Add it to Google cloud as no one will have access To the admin account unless they steal your nas and hack your Google account.
Encrype your shared folder. Folder won't mount without the password
@@Dragonx21 yes, but if you don't active key manager (auto-mount) every time you restart you have to sign in and mount all the file.... To do what I mentioned is way easier but just don't forget your password ever.
@@hassan_ksu I've never understood people that encrypt their drives and then have them auto-unlock.
As you've said it basically doesn't protect you from physical theft at all.
My NAS is all encrypted with a passphrase needed at boot. If someone steals my server they aren't getting $#!^.
Thanks, I checked the logs on my 920+ I didn't see anything unusual in the logs. I had already disabled admin and guest. Looks like everything is good. Great tutorial!
Thanks man, really doing a community service here
Very useful video, thanks Will ! Are you running Graylog as a container on a Synology ? If yes I would be very interested on a video on how to setup a Graylog install 😇 !! Keep on doing what you do (and keep on with the nice shirts) !!!
I would like to learn too.
Thanks for the video. Checked my logs and earlier this month and last month had thousands of attempts on mine. Very scary.
Great and absolutely essential video again Will. What I'd add is to set a high security profile in Security Adviser, it takes some time to get all the green checks but well worth it. (-;
Hi Will thanks for this awesome Tipps. Just found out DSM 7.2 will show you it is up to date but when you actually check on their Website I could update to 7.2.1 😮. So I did this imediately. Also you could mention to have Backups, just in case.
Part of the problem is that when the computers that were infected with the botnet are located here in the USA and generated from a foreign country, the foreign countries being blocked will be ineffective as they are US IP addresses. They also seem to use VPN. With my UniFi UDM-Pro I took security one step farther. I have utilized all 150 UniFi max of countries to block, but there are 195 countries on this planet so there will always be about 40 unblocked unblocked countries. Working with my UDM-Pro's Security Detections log I have fine tuned the list based on the LOG with the countries that have more than 1 attempt. I also noticed that the CIARMY also uses specific blocks of IP addresses based here in the USA and a majority of attempts are by IP addresses with the same first 2 octets (22.239.0.0/16) of the IP address. I took the UDM-Pro's "Critical Security Detection" log and created a rule that blocks all the traffic from the log's IP addresses within the first 2 octets. Seems to be working fine! Great video.
You scared me with your title. I thought I missed a new threat. Like they were a few years ago. Especially at Qnap. To be sure, I took my 920 offline. This is because I heard the HDD more often than what is normal for my use. Today I had time to watch your video and I saw that almost everything you described was prepared for me. :-) I'm only going to use Tailscale.
Completely relieved! Thanks for al your great video's
Another great video. Thanks Will.
You may have done it already, but if you haven't, please consider creating a video about graylog.
Another great video Wil! If you change your ports from the default (5000/5001), would that cause issues with existing external services such as Plex users? Most of the stuff you outlined here I've already done because of your past videos but I'm also going to look into geo-blocking as well. Thanks for the info!
Plex operates on an entirely different port! (32400 by default) so it will not mess this up.
@@SpaceRexWill good to know. Thanks for the reply!
I recommend changing the default port for Plex as well, even though security through obscurity doesn't really work well for targeted attacks.
U SCARE ME NOW !!! ...thank God in the first minute you calm me down
I do miss two other very important points that protect your from a hack: Backups and Snapshots with an immutable period configured.
These help recover you from a hack - not prevent it.
They do protect your data from being taken as ransom. So they protect you too for not having to pay that ransom. Because zero day hacks are a thing and have happened in the past.
Backups should be a given anyway for any NAS user, but if you have the basics of this video implemented - don't have an administrator account called "administrator", strong passwords on any admin and/or service accounts, 2FA/MFA and change default ports, then you'd be fairly well covered for any unauthorized attempts.
@@MrCoffis Backups do not protect your data from being taken.
@@Shocker99 I said they protect you from having to pay ransom.
The whole idea of a ransom attack is to take your data as hostage and pay them money to decrypt it. If you have a backup you protect yourself from being a victim of a successful attack. Zero day hacks can happen anytime no matter how well you set up your security. A back up protects you from all unforeseeable events that can happen. Even a fire and other natural disasters if you follow the 3 - 2 - 1 rule.
Some hacks or loss of data are unpreventable and back ups are the only thing that can protect you from losing your data.
Loss of data is what you are trying to avoid.
The Security Advisor app also checks a few key basics. Also useful to let you know what packages (or DSM) have updates. It is a good starting point and then go through the items listed in the video to the extent they apply (beyond the generally applies to everyone items).
You mentioned Tailscale when setting up the firewall rules. The built in firewall won't block tailscale as it's an outbound and then established connection. Synology's firewall rules only effect inbound connections.
Hey, great video! thanks for the explonation and nice demo.
Do you also have a special discount code or agreement for Europe(Netherlands) Synology?
Great vid 👍👍👍.
thank you very much
This is the most common secure settings you need to have. One more level to secure the NAS, is by only allowing it to connect it to your local network, and setup a VPN to get into your network when you're remote. You might need an upgrade on your modem (like Unifi)... This way even the most skilled hackers won't be able to get into your NAS so easy.
great important info. always count on being attacked. great tips.
Thanks Will, where specifically in the DMS Control Panel did you see a Log of the the login attempts at the very beginning of this video?
under logs!
❤ thanks so much!
A proper router with IDS/IPS is a must have these days. In addition to blocking any port scanning on your public IP, it is also critical to block the IP ranges of known attackers, C&C, botnets and scanners like Shodan.
The most obvious one, don't open port 5000 to the internet. While this is the first line of defense, it's not the only one as if you have a compromised device in your network, they can use that to bypass the firewall. But that takes a lot of effort on one specific target. Not the MO of the these botnets..
You're the best dude!
You’re not weird, not only did I deactivate the admin account I too change the default password for it.
Very good information. Question: if you disable admin and admin has tasks, how can you transfer the tasks first to another user?
What news outlet are you using? Of course, I'm aware. that there are always attacks going on, but I'm not finding an article right now about a massiveogy. Could you please share the link?
For me I have just been tracking them with my severs that I manage for clients
@@SpaceRexWill Thanks! It was driving me nuts to not find a single threat on the news :)
thanks
random question? what is the brand and model of you screens on your desktop?
Thanks for great information. A quick question about the FW rules. I use portainer (as I think you do to 172.16.0.0 ?). When I have more stacks/networks inside portainer, do I need to add the additional networks to the FW ruleset as well? (Ie. 172.18.0.0 - 172.20.0.0 ...)
The firewall rules that I wrote here will cover the entire 172.16.0.0 - 172.31.255.255 private address range.
It's the way that subnets work. 172.16/12 means the exact same thing as above.
RFC1918 are you local LAN addresses: netbeez.net/blog/rfc1918/
(you would not want to create a 172.33.0.0 subetnet for docker as this would be a public IP)
@@SpaceRexWill Ahh, I understand. Thank you!
Not a single attempt on the seven Syno systems I take care of at work. Seems the DNS Server is working properly lol.
General "brute force attacks" or "credential stuffing attacks" can be fought off pretty easy imo. Targetet attacks are what should scare people.
Hey Will thanks ! qq, if you disable admin account, what is happening to the root account to login to root in cli ?
Have closed the firewall for traffic coming from e.g. China and similar countries, with autoblock enabled and admin account disabled. Ports 25 and 5001 are actually open for my mailserver and friends and family logging into my server without VPN and haven't had a malicious login attempt for weeks.
PS the blocklist from Marius Hosting also helps a bunch I guess.
4 years ago I had this with my qnap.. Lucky for good security had all attempts blocked
With geo-blocking, will this prevent Synology tech support from remotely logging in (if they are from a different country)? Or do you need to remember to disable that first before requesting support?
You would need to get their IP and allow it
What should I do if i allready used the admin for several years (Cloud Station for example). What do I have to do that my Cloud Station works with my new admin account?
Can I just rename the default admin insteat to be save?
same thing about SSH.... don't allow it to be open to the net or change the port to something less obvious OR don't give the internet access to your files, if you don't want it stolen and used on the internet, keep it off the internet
I already did everything else, except for the firewall rule and changing the port number. I tested on my smart phone and made sure I am able to access the NAS.
Basic Preventive measures (posting before watching the video):
1) Disable the default admin account on a synology (create a different user with Admin access)
2) Enable 2FA for any accounts with admin priviliges
3) Do not forward port 5000-5001 to your NAS. If you want to access DSM remotely install the VPN service and first connect to your Synology over an OpenVPN connection.
4) Turn on Account Protection in the Security Options
5) Only forward ports you specifically need to be able to access from outside of your LAN to your NAS. (Should be obvious but I'm sure there are people who have forwarded the entire range of available ports to it)
Now lets see if there are any important ones I missed.
What monitors do you use? ☺️
Hi need help After change my phone i don't have access to Synology by quick connect . The Secure Signin code gave me error if i disable from account app still ask for code and code didn't work.
21:25 @spacerex Question: When locking down NAS to location - would this affect QuickConnect if that is located in the US?
Quick connect follows firewall rules now!
I need my nas public. This video and nginx proxy manager works for me.
good job I don't use the default admin account, I never use default credentials
Hi, nice and useful video as usual 👏🏼 I should like to have your opinion about the time amount to block the access attempts.
I read an article some time ago where the author was saying that attempts for login aren't anymore done in sequential way, but the bot do one attempt and if it is unsuccessful it'll try after some hours. So I checked my log and among the attempts there were several hours, so I made a change in my config, for automatic blocks I reduced the attempts to 3 and set the amount of time to the max.
What do you think?
I was "attacked" due to a very stupid mistake in port forwarding on my router.
also a 2nd admin account is helpful in case the primary gets locked up from hacker trying to access it
Yes, its very very important to have your most valuable personal data to have available 0/24 on the internet.
1: Never allow NAS internet access for any reason. Not in not out. Period.
2: See 1
Where do you look at the login attempt logs file?
Not very network savy but wondering why you have 3 different ip address on your local network when blocking outside countries. Is there something That I need to look for when setting mine up?
So those three subnets are the local subnets. Basically any of those, can not come from the internet, they had to come from the local network. So if you dont know about subnets, add all three, because your network will be one of them
How you miss to enable Denial of service (DoS protection) ?
I solved my synology slowness problem by shutting down the server, moving the drives to another server box, and installing Unraid while adding a 10g Nic and switch. My Synology was a 420j and was getting old.
of course blocking Admin account, but then, adding reverse-proxy, adding geofence and banning IPs which try to login for some users like 'admin', and try to login a few times, or even if requests results in 4xx errors. Is it enough then ? Helpful vid ! thanks !
Crazy to be opening up such an important device to the internet when a VPN server is so easy to setup. I access everything on my home network through a VPN. The only port I have exposed externally is for the VPN and I trust Wireguard security much more than I do Synology and other common services. Also having completely offline backups allows you to recover from a ransomware attack if it happened.
Comes down to the clients use case
A work with a ton of photographers / videographers who want to use it to send clients videos. And you can’t do that over a VPN
Really just comes down to use case / how sensitive the files are
All depends on use case. If you have multiple family members and friends that have access to certain features in the NAS, VPN's won't cut it. It's far too cumbersome to setup and maintain vs direct access to the NAS
@@SpaceRexWill Yeah, that's an interesting use case I hadn't considered and I can see how it drives the need to expose it to make life easier for everyone involved. I use Tailscale to join a NAS I have at a family members house as it requires less network configuration at their end but I appreciate that isn't going to work at scale for the use case you've highlighted. If I had a need to expose it then I'd be taking steps to reduce the threat of an attacker traversing through the network if the NAS was compromised, but appreciate that comes with trade offs between functionality and security too. Like you've said the main risk is if a zero day comes out affecting DSM, however if you're responsible for them and can patch them in good time then it mitigates the risk considerably. Thanks for responding 🙂
No mention of Tailscale?
This guy should be on Friday Nite Live.
Ah, I noticed that happening to my new one at home. Just sad little brute force attempts. I set it to fuck up twice, banned. It went on for about a week and then stopped altogether.
A NAS should never be internet facing... its considered a critical piece of hardware in every scenario. no amount of built in feature to the synology will protect you if the right CVE comes out.
If you truly need access to your synology outside of your network create a wireguard VPN using something as small as a raspberry pi and use that to access your internal resources.
Sincerely a network engineer with a focus on edge security.
Is there a way to block LAN access from Synology, but allow access from LAN into Synology NAS?
Hello there, I’m gettin SMB attempts? How is that posible? Does it means that I have a mole in my network, who is trying to brutforce my Synology Nas?
It depends heavily on them.
Are they SMBv1? or are they real login attempts?
Make sure you haven't enabled DMZ on your router and don't setup router under external access in dsm
Dsm7 accepts any username and password when 2fa is enabled so they won't know if they have a valid username or not (always make sure 2fa is enabled as number of people have had there nas encrypted because 2fa wasn't enabled) don't use email code generation use push or MFA code generator (use authy as it allows syncing between phones/tablets)
@@leexgx Thanks a lot! I will do it like that.
Can you secure your NAS with a yubikey?
When I added the country rules, I could not get in with my DDNS subdomain, only local IP. I had to allow Taiwan in addition to USA, and then it worked. Since the Google-Squarespace domain sale, I've had to use Synology's DDNS service, which server is based in Taiwan...
What about the Denial-of-Service (DOS) Protection, would that be something that should be enabled?
That is not this. Its if you get ddosd
@@SpaceRexWill yes but should it be enabled as good measure I notice it was not mentioned in the video?
Thank you for putting this together. Can you respond to the comment below (Hassan-ksu) about physical attacks and using the Update & Restore -> System Reset -> Reset Option -> Keep admin password unchanged?
ALSO: I am using DSM 7.1 which is recommended. When will DSM 7.2 be recommended? (To get the Adaptive MFA).
The better solution is : don't open any ports from Internet to your DSM .
Use a separate firewall who will do VPN! Install the VPN client on your machine and then connect to your LAN via VPN..
This is the most secure option if you want to have access from the Internet to your DSM, and the only one I recommend.