In many small and mid-sized offices, the network-attached storage (NAS) box in the corner holds everything: shared files, scanned documents, camera footage and, very often, the backups. That makes it one of the most valuable devices in the building, and in the past two weeks two of the best-known NAS makers have warned that attackers are going after it.
Synology: ransomware through a flaw fixed in 2024
On 29 October, Synology urged customers to update its DiskStation Manager (DSM) software after identifying attackers exploiting a vulnerability it patched in December 2024. The attacks target devices still running outdated DSM versions, encrypt the data and demand a ransom.
According to BleepingComputer, victims had been reporting infections for more than two weeks before the warning. The ransomware, known as C3RB3R or Cerber, adds a .L0CK3D extension to files, leaves a note called read-me3.txt and directs victims to buy a "decryptor" for thousands of dollars. Synology rarely issues warnings like this; its last was in 2019.
Synology has not said exactly which flaw is being used, but its warning points to a November 2024 advisory covering a remote code execution flaw (CVE-2024-10441, rated 9.8) and two file read and write flaws. Fixed versions include:
- DSM 7.2.2: update to 7.2.2-72806-1 or later
- DSM 7.2.1: update to 7.2.1-69057-6 or later
- DSM 7.2: update to 7.2-64570-4 or later
- DSM 7.1: update to 7.1.1-42962-7 or later
- DSM 6.2: update to 6.2.4-25556-8 or later
Internet monitoring group Shadowserver tracks more than 380,000 Synology NAS devices reachable from the internet, though it does not say how many have been updated.
QNAP: compromise through an app, not the operating system
On 6 November, QNAP warned that some customers' NAS devices appear to have been compromised through Plex Media Server, a popular media app installed from QNAP's App Center. The attackers are using Plex2Shell, a chain of four flaws in Plex that has been exploited since its details were published in mid-October.
QNAP says its own operating systems are not affected, but its advice is stark. If a vulnerable Plex server was exposed to the internet, treat the NAS and everything on it as compromised. Updating Plex to version 1.43.3.10861 or later stops new attacks but does not remove anything already installed, so QNAP recommends checking for signs of compromise, reinstalling the operating system and resetting all Plex and NAS passwords.
Why NAS devices are such a target
The two cases have different causes but the same lessons:
- NAS devices are often forgotten. They are set up once, work quietly for years and rarely get the attention given to servers and laptops. Synology's attackers are succeeding with a flaw that has had a fix for almost two years.
- They are often reachable from the internet. Remote access to files and media is convenient, and every open port is also an open door.
- Add-on apps widen the risk. Media servers, download tools and other apps add code that has its own flaws.
- The backups are often on the same box. If ransomware encrypts the NAS, it may take both your files and your way of recovering them.
We are not aware of any reported victims in the UAE or GCC, but these devices are as common in offices here as anywhere else.
What UAE and GCC organisations should do now
- Find every NAS you own. Include branch offices, warehouses and devices used by remote staff. Note the make, model and software version of each.
- Update the operating system and every app. Bring Synology DSM to a fixed version, update Plex and any other installed apps, and turn on automatic security updates.
- Take management pages off the internet. Block internet access to the NAS admin interface and to app ports such as Plex's port 32400. If staff need remote access, use a VPN. We explained the risks of exposed admin pages in our article on firewall admin pages open to the internet.
- Remove what you do not use. Uninstall unused apps and disable services and accounts that are not needed.
- Protect the admin account. Use a strong, unique password and enable two-factor sign-in for every administrator.
- Keep a backup the NAS cannot touch. Follow the 3-2-1 rule: three copies of your data, on two types of storage, with one kept offline or in immutable cloud storage.
- Replace unsupported models. Devices that no longer receive updates should be retired and their data moved.
- Know what to do if you are hit. Disconnect the device from the network, do not pay without professional advice, and restore from a clean backup after the device has been rebuilt.
Small box, big risk
A NAS is one of the simplest ways for a growing business to store and share data, and it remains a good choice. But it needs to be treated like any other server: kept up to date, kept off the open internet and backed up somewhere it cannot reach.
COMMPRO Technologies supplies storage, backup and network security solutions from leading vendors across the UAE and GCC. If you would like help reviewing your NAS and backup setup, or planning a replacement for older devices, contact our team.
