Join for quick access. Enter your email below and we'll send confirmation plus sign you up to our newsletter.
By submitting your information, you confirm you are aged 16 or over,
have read our
Privacy Policy
and agree to the
Terms & Conditions. Geographical rules apply.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
You are now subscribed
Your newsletter sign-up was successful
Join the club
Get full access to premium articles, exclusive features and a growing list of member rewards.
An account already exists for this email address, please log in.
Tech whiz's internet-accessible Synology NAS gets bit by ransomware attack from 18-month-old remote code execution flaw — security updates neglected in a series of catastrophic errors
Systems administrators are among the first to point out lax security policies in other companies' or people's setups. Sometimes, they are the ones who get bitten by not taking the same advice they will so readily dispense. Such is the tale of Reddit user NakamuraHwang, who had files on their Synology DS918+ NAS encrypted by a ransomware attack after making a series of unforced errors.
Hwang appears to be quite technically proficient and provided a detailed write-up of the situation. The key points, however, are that the unit in question (a) had its web interface exposed to the internet and (b) was roughly 18 months out-of-date with security patches. Just like the recent PHP snafu has adeptly shown, complacency is a far worse enemy than an army of AI bots.
The tech has a 3-2-1 backup setup, so they seemingly didn't lose any data. They attached the disks to a Proxmox machine for further inspection — Synology's DSM operating system uses mdraid underneath, so you can take the disks to another box and mount them there. Investigation of logs and the operating system files revealed that the attack was likely performed by abusing the CVE-2024-10441 remote code execution vulnerability, revealed a year and a half ago.
As most any other sysadmin will tell you, it's never advisable to expose devices directly to the internet without some layer of protection in between, chiefly but not only a VPN or an SSH tunnel. Tailscale, for instance, makes having a VPN fairly painless these days, and its free plan covers most home installations.
Synology had published its own advisory regarding the exploit, but that's where the NAS' behavior regarding updates complicates matters. According to multiple comments on the thread and in other forums, the UI will happily tell you that your device is up to date, all while there are critical security updates that need to be manually installed. The manual for DSM indicates that units from 2025 onwards have automatic updates, apparently implying that those of previous makes need to be configured so.
Furthermore, Synology apparently doesn't have a direct channel to warn its customers of critical security vulnerabilities —a simple e-mail notification would suffice. Although the firm is seemingly shifting away from consumer gear, it still sells small units that regular users might buy, and it's not reasonable to expect them to even be aware of security bulletins. Plus, package updates like the patch for the PHP2Shell vulnerability have to be installed separately, too.
Bruno Ferreira is a contributing writer for Tom's Hardware. He has decades of experience with PC hardware and assorted sundries, alongside a career as a developer. He's obsessed with detail and has a tendency to ramble on the topics he loves. When not doing that, he's usually playing games, or at live music shows and festivals.
Who wouldn't feel unsafe after months, let alone years without security updates?
One of my old cellphones hasn't had an update in years and I'm fully aware that it's an unsafe device (so I treat it as such), even though the manufacturer says that "it is up to date".
If automatic updates aren't working on your device, check manually (and there were plenty of updates), else search for alternatives because your device is not safe.
Exposing any admin interface to the web is a very VERY bad idea. That admin interface being an application web page makes it a ludicrously irresponsible bad idea.
Exposing any admin interface to the web is a very VERY bad idea. That admin interface being an application web page makes it a ludicrously irresponsible bad idea.
What exactly do you mean by admin interface on an application web page? I have access to google admin console at work through a google webpage. Does that count in your book as something 'ludicrously irresponsible'?
The NAS here felt unsafe from the day it was installed. Internally everything runs as root and there is no way to install a standard Linux distribution.
Worth checking UPnP on the router too. Synology can open ports on its own through it, so some people end up with the admin page exposed without ever forwarding anything themselves. If you need remote access, a VPN like Tailscale or WireGuard is the easy way around it.
Important to note that the Synology 918+ is a 2017/18 box and as such it will not automatically update to the latest version of DSM. It issued with DSM 6, and will happily stay on DSM 6 until you manually ask it to upgrade to DSM 7. The reason for this is that DSM 7 deprecated a number of DSM 6 software apps.
Once upgraded to DSM 7, it will continue to update with the latest patches (including the PHP ones).
Secondly, you can setup DSM to automatically update or to manually update. It will nag you to do so, but you must initiate the process yourself.
