A hot potato: QNAP issued a security statement urging their NAS users to take immediate action and secure their data against ongoing ransomware and brute force attacks. While the responsible parties have not been identified, the widespread attacks appear to target any vulnerable network devices. The company has provided security setting instructions and mitigation actions that any QNAP NAS users should implement immediately.
A security statement released by the storage appliance provider on Friday issued very clear instruction to QNAP NAS users: take immediate action to secure your network appliances or take them offline. The attacks, which appear to indiscriminately target any network device exposed to the Internet, pose the most risk to devices with internet connectivity but little to no protection in place.
QNAP users with the ability to access and secure their devices can verify whether their device is exposed to the internet using the QNAP Security Counselor. According to the company’s statement, the user’s NAS is exposed and at high risk if the Security Counselor console displays a result stating, “The System Administration service can be directly accessible from an external IP address…”
In the event that a user’s NAS is exposed to the Internet, QNAP’s security statement provides instructions to determine which ports are exposed as well as how to disable port forwarding on the user’s router and UPnP on the NAS device.
Port forwarding, also known as port mapping, redirects requests from the original address and port to another address and port. Some users and administrators no longer view port forwarding as a major risk, as software firewalls packaged with most modern operating systems are capable of providing adequate protection when properly configured.
However, QNAP has specifically stated that enabling port forwarding, UPnP, or demilitarized zone (DMZ) functionality can result in the NAS connecting directly to the internet, making the device vulnerable to attack. The recommended preference is for the NAS to remain behind a user’s router and firewall with no public IP address.
NAS users without access to or familiarity with the Security Counselor console still have one last nuclear option–simply disconnect the device, terminating any potential connectivity to the outside world. While it may seem drastic, the fact remains that attackers scanning for vulnerable targets can’t hit what they can’t see.
Image credit: Michael Geiger
Note: This article have been indexed to our site. We do not claim legitimacy, ownership or copyright of any of the content above. To see the article at original source Click Here
VENSEEN 100 PCS Popular Singer Stickers, Waterproof Music Stickers for Water Bottle Laptop Guitar Skateboard, Gifts for Adults Kids Boys Girls
$4.99 (as of June 25, 2024 21:05 GMT +00:00 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
DaVinci Gourmet Natural Agave Syrup, 25.4 Fluid Ounce (Pack of 1)
$9.99 (as of June 24, 2024 21:06 GMT +00:00 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
Wire rack cover by Crafted Palm for removable wood shelf covering in closet, kitchen pantry, bathroom, office, hallway or mudroom shelving board upgrade (16 Inch Length, 12 inch deep, Early American)
$63.99 (as of June 24, 2024 21:06 GMT +00:00 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
SAMSUNG Galaxy A15 5G (128GB, 2024) 6.5" 90Hz AMOLED, 50MP Camera, 4G Volte (Fully Unlocked International Model for AT&T, T-Mobile, Verizon, Global) A156U (Blue Black) (Renewed)
$128.99 (as of June 25, 2024 21:05 GMT +00:00 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
