Vulnerabilities, Ransomware and Exploits on Synology & QNAP NAS – Stay Updated!

Be Regularly Updated on Security Concerns with Synology & QNAP NAS

Recently there has been a spotlight on some NAS brands and their security and protection from attacks by hackers and online intruders. In some cases, this has been down to holes being found in the system software or system protocol over time that, if left unpatched can lead to Ransomware like the QNAP QLocker of 2021, the Synology Synolocker of 2014. Typically, these can stem from many methods but ultimately revolve around hackers boarding the latest firmware and finding loopholes/backdoors within the system software each time it has an official update. This is not unusual and practically ALL the computer software-related services and hardware in your home/business environment go through this – most updates to the firmware in everything from your phone to your TV, router, console and more are specifically designed to close these newly found chinks in the armour. It is a constant game of cat and mouse, however, in almost all cases the vulnerability in software (that led to your system being penetrated) will be down to the fact your device has not been updated in firmware/software in a considerable length of time.

Why Do People Not Update Their QNAP or Synology NAS System Software Immediately?

Of course, updating the firmware on your NAS every single time a new system software version is released is not quite as simple as that. Sure, the actually ACT of updating is super easy and the NAS system will constantly remind you of updates in your system firmware or individual app software – but many still do not immediately action this update. This is by no means exclusive to NAS either, with many, MANY users choosing to ignore the windows update icon at the bottom right of the screen right now, or the recommended system update restart/remind option at the top right on a Mac. There are several reasons that people do not immediately update their firmware, such as:

  • The system is currently in use and there is no time right now to allow a restart, as well as having current projects/tabs/services operational
  • You once/twice experienced an update on a NAS (or really any device that has regular updates) that made the system unable to perform to the previous standard (software feature changed/removed), so you had to perform a complicated firmware roll-back/downgrade and it left you less keen on immediately firmware actions
  • It is a major firmware update that changes the system GUI and system options notable, so you do not wish to action a software update that will increase the learning curve
  • (less common but certainly happens) Your NAS system is part of a wider network of systems (part of a CMS) that either cannot or is not recommended to be individually updated without updating every other system at the same time

So, it is all fair and well for me to say ‘you should always update’, but the truth is that many have rather valid/understandable reasons for not actioning these straight away. Of course, the alternative would be for brands to automatically FORCE system updates through, or restrict an app/system able to connect with online services until the update is installed (as found with gaming services like Playstation Network and XBox Live) – but in a NAS, or even desktop/computer/phone-based systems these options would be INCREDIBLY UNPOPULAR! So, that is how we reached the current state of affairs between the NAS Brands, their system updates, individual app updates and how/when users choose to action them. So, how do we resolve this?

 

How to Remove QSnatch from your QNAP NAS Protecting Your Synology NAS from Ransomware
What is QNAP QLocker? How to Remove QLocker from your QNAP NAS

How Can You Stay On Top Of NAS Updates and Be Aware of Vulnerabilities on your NAS?

Many users might not be aware, but the majority of NAS brands (and indeed this extends to enterprise service providers like NetApp, cloud storage like Google Drive and large blob type storage like AWS and Azure) have an online portal that, known as the Security Advisory, that details the latest vulnerabilities, issues, faults and issues that are raised on their respective platforms. These are then available for public view (as they are submitted) and their effect, danger, current investigated status, date of the resolution and recommended action are then displayed. See Below:

This slideshow requires JavaScript.

 

These pages are almost certainly a legal requirement as part of their term of service and due diligence, not just a kind and wholesome gesture. However, it can be INCREDIBLY INTIMIDATING to read through them – even a 5-minute glance will make you question how on earth you have not been hacked yet! However, many of these vulnerabilities are exceptionally small and are built on exceptionally outdated firmware (perhaps 2-3 years overdue), require exceptionally weak security settings in place, DMZ network settings or simply are specific to a particular tool being used in a certain way. Nevertheless, many users will see these listings of issues and go one of two ways. One, they IMMEDIATELY UPDATE EVERYTHING and regularly update as soon as updates appear (regardless of the reasons against it listed earlier). Two, they look at the vulnerabilities, scroll through, see that none of them appear to be applicable to their own network hardware/storage setup and then continue to not-update until something more specific to their setup appears. There are pros and cons to either action of course, but better to have all the facts and listed vulnerabilities at your disposal than to proceed on just hunches and guesses!

How to Automatically Get Updated When Synology and QNAP NAS Vulnerabilities are Reported

Pretty much ALL of the brands in NAS, Data Storage and Cloud services have these security advisory pages, but the idea of checking these pages manually (i.e. bookmark etc) every day, week or month is too much of a hassle for many. On the other hand, they all arrive with an RSS feed link that allows users to subscribe to updates BUT many users are not even aware of how to apply an RSS feed (it’s a complex XML feed of text that needs to be injected into an appropriate RSS feed client/agent – so yeah, hardly noob friendly). So, in order to make this 1000x easier, I have (and by me, I mean Eddie the Web Guy spent time on it and I made this article!) made this page that will be constantly updated with the latest vulnerabilities reported on the popular NAS brands and storage-related manufacturers. It is still being built (so more brands are being added) but it will allow you to just chuck your email address below (will not be used for profit or spamming etc) and then you will get an alter EVERY TIME a new security vulnerability is updated by the brands (this is automated, so it will appear here as soon as it appears on the respective security advisory page). Additionally, there will be links back to the brand/manufacturer site so you can find out more about individual exploits and vulnerabilities, how they work, what they do and (most importantly) give you a better idea of whether you should update your NAS/Storage system or not. I hope you find it helpful and if you have any recommendations or idea of what we should add to this page/service to make it even better – let us know in the comments or directing here – https://nascompares.com/contact-us

Sign Up Below to Get Updates as New Vulnerabilities Are Reported


Articles Get Updated Regularly - Get an alert every time something gets added to this page!


 

QNAP NAS Current Vulnerabilities and Exploits [OPEN πŸ”—]

in QTS Thu, 13 Jan 2022 Link
in QTS Stack Overflow in QVR Elite, QVR Pro, and QVR Guard Thu, 13 Jan 2022 Link
Stack Overflow in QVR Elite, QVR Pro, and QVR Guard XSS and Open Redirect Vulnerabilities in QcalAgent Thu, 13 Jan 2022 Link
XSS and Open Redirect Vulnerabilities in QcalAgent in QVPN Service Fri, 07 Jan 2022 Link
in QVPN Service Reflected XSS in TFTP Server Fri, 07 Jan 2022 Link
Reflected XSS in TFTP Server Exposure of Sensitive Information in QTS, QuTS hero, and QuTScloud Thu, 30 Dec Link
Exposure of Sensitive Information in QTS, QuTS hero, and QuTScloud Vulnerabilities in Apache HTTP Server Thu, 30 Dec Link
Vulnerabilities in Apache HTTP Server Multiple Vulnerabilities in Apache Log4j Library Tue, 14 Dec Link
Multiple Vulnerabilities in Apache Log4j Library Stack Buffer Overflow in Surveillance Station Fri, 10 Dec Link
Stack Buffer Overflow in Surveillance Station Reflected XSS in Kazoo Server Fri, 10 Dec Link
Reflected XSS in Kazoo Server Improper Authentication in Qfile Fri, 10 Dec Link
Improper Authentication in Qfile Bitcoin Miner oom_reaper Tue, 07 Dec Link
Bitcoin Miner oom_reaper Command Injection in QVR Fri, 26 Nov Link
Command Injection in QVR Improper Authentication in QVR Fri, 26 Nov Link
Improper Authentication in QVR Reflected XSS in Ragic Cloud DB Fri, 19 Nov Link
Reflected XSS in Ragic Cloud DB CSRF in QmailAgent Fri, 19 Nov Link
CSRF in QmailAgent Heap-Based Buffer Overflow in QTS Fri, 19 Nov Link
Heap-Based Buffer Overflow in QTS Stack Buffer Overflow in Multimedia Console Fri, 12 Nov Link
Stack Buffer Overflow in Multimedia Console Reflected XSS in QmailAgent Fri, 12 Nov Link
Reflected XSS in QmailAgent Command Injection in the Fri, 22 Oct Link
Command Injection in the

 

SYNOLOGY NAS Current Vulnerabilities and Exploits [OPEN πŸ”—]

Synology-SA-21:30 Log4Shell Not affected Resolved 2022-01-04 18:20:28 UTC+8
Synology-SA-21:29 Samba Important Ongoing 2021-11-17 16:39:06 UTC+8
Synology-SA-21:28 Mail Station Important Resolved 2021-11-16 15:16:11 UTC+8
Synology-SA-21:27 ISC BIND Moderate Ongoing 2021-11-01 18:33:53 UTC+8
Synology-SA-21:26 Photo Station Important Resolved 2021-09-07 10:03:01 UTC+8
Synology-SA-21:25 DSM Moderate Ongoing 2021-09-29 17:24:02 UTC+8
Synology-SA-21:24 OpenSSL Important Ongoing 2021-09-29 17:22:50 UTC+8
Synology-SA-21:23 ISC BIND Not affected Resolved 2021-08-20 10:43:23 UTC+8
Synology-SA-21:22 DSM Important Ongoing 2021-09-01 14:08:26 UTC+8
Synology-SA-21:21 Audio Station Important Resolved 2021-06-16 16:05:29 UTC+8
Synology-SA-21:20 FragAttacks Moderate Ongoing 2021-05-12 18:26:08 UTC+8
Synology-SA-21:19 SRM Important Resolved 2021-05-11 14:23:32 UTC+8
Synology-SA-21:18 Hyper Backup Moderate Resolved 2021-05-04 13:37:52 UTC+8
Synology-SA-21:17 Samba Moderate Ongoing 2021-05-06 11:28:17 UTC+8
Synology-SA-21:16 ISC BIND Moderate Ongoing 2021-05-03 10:34:51 UTC+8
Synology-SA-21:15 Antivirus Essential Important Resolved 2021-04-28 08:12:48 UTC+8
Synology-SA-21:14 OpenSSL Not affected Resolved 2021-03-29 08:56:36 UTC+8
Synology-SA-21:13 Samba AD DC Important Resolved 2021-07-08 17:14:55 UTC+8
Synology-SA-21:12 Synology Calendar Moderate Resolved 2021-06-19 10:53:03 UTC+8
Synology-SA-21:11 Download Station Important Resolved 2021-06-19 11:15:17 UTC+8

 

ASUSTOR NAS Vulnerabilities and Exploits [OPEN πŸ”—]

 

Work In Progress – More Security Advisory Updates and Reports Coming Soon for Other Brands

 

 

Summary
Review Date
Reviewed Item
How To Stay Updated NAS Security Vulnerabilities on Synology, QNAP and More
Author Rating
51star1star1star1star1star

DISCUSS with others your opinion about this subject.
ASK questions to NAS community
SHARE more details what you have found on this subject
CONTRIBUTE with your own article or review
IMPROVE this niche ecosystem, let us know what to change/fix on this site

ASK YOUR QUESTIONS HERE!