Our friends from Q have been asked to stop port forwarding

[EAZ1964]

And again a Q breach, seems like a monthly habit unfortunately:

QNAP warns severe OpenSSL bug affects most of its NAS devices

Taiwan-based network-attached storage (NAS) maker QNAP warned on Tuesday that most of its NAS devices are impacted by a high severity OpenSSL bug disclosed two weeks ago.

www.bleepingcomputer.com

 

[jeyare]

the only port that an attacker can see on my sites from the WAN is the port for IKE2 S2S tunnels, which are fixed only for specified IP addresses/domains.
regularly inspected by nmap check + Shodan and similar services

 

[EAZ1964]

And again:

DeadBolt Ransomware - Security Advisory

QNAP designs and delivers high-quality network attached storage (NAS) and professional network video recorder (NVR) solutions to users from home, SOHO to small, medium businesses.

www.qnap.com

 

[EAZ1964]

And again, it seems like an endless list of vulnerabilities.

Critical PHP flaw exposes QNAP NAS devices to RCE attacks

QNAP has warned customers today that many of its Network Attached Storage (NAS) devices are vulnerable to attacks that would exploit a three-year-old critical PHP vulnerability allowing remote code execution.

www.bleepingcomputer.com

 

[Coop777]

ouch. glad we don't have these headaches...

knock on wood....

 

[EAZ1964]

And again:

Checkmate Ransomware via SMB Services Exposed to the Internet - Security Advisory

QNAP designs and delivers high-quality network attached storage (NAS) and professional network video recorder (NVR) solutions to users from home, SOHO to small, medium businesses.

www.qnap.com

 

[EAZ1964]

It has been rather quiet for half a year, but our Friends from Q are target again:

Over 29,000 QNAP devices vulnerable to code injection attacks

Tens of thousands of QNAP network-attached storage (NAS) devices exposed online are waiting to be patched against a critical security flaw addressed by the Taiwanese company on Monday.

www.bleepingcomputer.com

 

[Coop777]

not good.....

 

[Tedster]

If you have data that you must keep secure, don't store it on any "cloud" device. ANY!

 

[Jan Janowski]

Wasn’t a NAS supposed to prevent need for a cloud?
Oh well! Better start checking Synology download areas every day again, in case S. comes up with something.

 

[WeeblesWobbles]

Wasn’t a NAS supposed to prevent need for a cloud?

If a NAS is used remotely then it's considered to be in the cloud. All cloud refers to is something that is not stored locally.

 

[Jan Janowski]

Ok. If I only access it remotely via QC, with Drive or DS FIle or DS Cam, and no ports are forwarded in router…. Does this mean I should consider myself as a cloud or not?
(I already have DHCP and 90% of LAN IP’s Blocked from NAS access).

 

[WeeblesWobbles]

Ok. If I only access it remotely via QC, with Drive or DS FIle or DS Cam, and no ports are forwarded in router…. Does this mean I should consider myself as a cloud or not?
(I already have DHCP and 90% of LAN IP’s Blocked from NAS access).

Let's say that you go on vacation and access your files remotely while on vacation then that can be called the cloud.

 

[Jan Janowski]

And if I don’t access them…… ?

I Never quite understood where the dividing line between ‘safe’ and ‘unsafe’ is…. Why the repeated questions.

 

[Coop777]

If a NAS is used remotely then it's considered to be in the cloud. All cloud refers to is something that is not stored locally.

this statement makes no sense. I have 3 NAS boxes behind my router's firewall. I access them while outside of my home network all the time. They are not "in the cloud"

Run security advisor, implement 2FA for admin accounts at least, implement strong passwords, open up ports only as needed, disable uPnP on your router.

 

[WeeblesWobbles]

this statement makes no sense. I have 3 NAS boxes behind my router's firewall. I access them while outside of my home network all the time. They are not "in the cloud"

Misconception that people make that they think the cloud refers to a physical thing, when it's not, similar to back in the 90's when the internet was referred to as the information superhighway. Also people mix up between the cloud and a cloud service.

 

[Coop777]

cloud storage and services run on physical devices...it is WHERE those devices are that defines public vs private.

 

[WeeblesWobbles]

cloud storage and services run on physical devices...it is WHERE those devices are that defines public vs private.

I think you might get stopped by security if you call a data centre a public building, it's all private. The cloud refers to the data travelling over the internet rather than it's physical storage medium.

 

[Coop777]

the only people able to access the data stored on my NAS boxes are controlled by me. BIG difference.

 

[WeeblesWobbles]

the only people able to access the data stored on my NAS boxes are controlled by me. BIG difference.

In my day, that was called a Sysop and no difference, it just means you are giving your self permissions, but NAS boxes can be multi-user, it all depends on the use case, but it's no different from a NAS sitting at home to a server in a data centre.