Taiwanese firm, QNAP has warned its clients of ongoing attacks targeting QNAP NAS (network-attached storage) devices and urged to strengthen their devices’ security by changing their passwords and default access port number, and disabling the admin account.
The company warned its customers by stating, “recently QNAP has received multiple user reports of hackers attempting to log into QNAP devices using brute-force attacks – where hackers would try every possible password combination of a QNAP device user account. If a simple, weak, or predictable password is used (such as ‘password’ or ‘12345’) hackers can easily gain access to the device, breaching security, privacy, and confidentiality. ”
If threat actor manages to guess the right password then they are able to secure full access of the targeted device, allowing them to exfiltrate confidential documents or install malware. If the hackers are unable to brute-force their way in, the NAS devices’ system logs will mark the attempts and log them with ‘Failed to login’ warning texts.
To protect their devices from ongoing attacks, customers have to enhance NAS security by changing the default access port number, implementing password rotation policies, and disabling the default admin account. Additionally, since the attack is only viable on Internet-facing NAS devices, QNAP recommends customers don’t display their devices on public networks.
Firstly, customers have to create a new system administrator account before disabling the admin account. If the administrator account on QNAP NAS devices is running on QTS 4.1.2 then the following steps will disable the default admin account:
• Go to Control Panel > Users and edit the ‘admin’ account profile.
• Tick the ‘Disable this account’ option and select ‘OK’.
Additionally, customers can also configure the NAS device to automatically block IP addresses behind several numbers of troubled login attempts.
QNAP has also published a checklist to secure their customers’ device and protect their data:
• Remove unknown or suspicious accounts from the device
• Download QNAP MalwareRemover application through the App Center functionality
• Change all passwords for all accounts on the device
• Set an access control list for the device (Control Panel > Security > Security level)
