Synology mijozlarni o'zining Network Attached Storage (NAS) qurilmalarini quvvatlaydigan DiskStation Manager (DSM) dasturiy ta'minotini yangilashga chaqirmoqda, bu ransomware hujumlaridan so'ng sodir bo'lmoqda.
Tayvanlik sotuvchi aytdiki, u tahdid aktorlarining 2024-yil dekabrda tuzatilgan zaiflikdan foydalanib, DSMning eskirgan versiyalarini ishlatayotgan qurilmalarni nishonga olayotganini kuzatdi.
"Bu hujumlar ma'lumotlarni shifrlash va to'lov talab qilishga qaratilgan," deb aytildi o'tgan hafta e'lon qilingan bayonotda.
Synology bu hujumlarda aniq qaysi xavfsizlik zaifligi ishlatilayotganini oshkor qilmagan bo'lsa-da, kompaniya 2024-yil noyabr oyidagi xavfsizlik maslahatiga havola qildi, unda uchta zaiflik ro'yxatga olingan:
- CVE-2024-10441 (CVSS balli: 9.8) — DSM tizim plagin demonidagi noto'g'ri kodlash yoki chiqishdan qochish zaifligi, bu aniqlanmagan vektorlar orqali masofadan kod bajarilishiga olib kelishi mumkin.
- CVE-2024-50629 (CVSS balli: 5.3) — DSM webapi komponentidagi noto'g'ri kodlash yoki chiqishdan qochish zaifligi, bu masofadan hujumchilarga aniqlanmagan vektorlar orqali cheklangan fayllarni o'qish imkonini berishi mumkin.
- CVE-2024-10445 (CVSS balli: 4.3) — DSM yangilash funksiyasidagi noto'g'ri sertifikat tekshiruvi zaifligi, bu masofadan hujumchilarga aniqlanmagan vektorlar orqali cheklangan fayllarni yozish imkonini berishi mumkin.
Muammolar quyidagi versiyalarda tuzatilgan:
- DSM 7.2.2 — 7.2.2-72806-1 yoki undan yuqori versiyaga yangilang
- DSM 7.2.1 — 7.2.1-69057-6 yoki undan yuqori versiyaga yangilang
- DSM 7.2 — 7.2-64570-4 yoki undan yuqori versiyaga yangilang
- DSM 7.1 — 7.1.1-42962-7 yoki undan yuqori versiyaga yangilang
- DSM 6.2 — 6.2.4-25556-8 yoki undan yuqori versiyaga yangilang
Bu voqea mijozlar tomonidan berilgan xabarlarga ko'ra sodir bo'lmoqda, ularning Synology qurilmalari C3RB3R ransomware tomonidan zararlangan, bu foydalanuvchilarning fayllarini ".L0CK3D" kengaytmasi bilan qulflayotgani kuzatilgan.
Bu NAS qurilmalari ransomware hujumlarining nishoni bo'lgan birinchi holat emas. 2019-yilda Tayvanda joylashgan QNAP Systems tomonidan ishlab chiqarilgan NAS qurilmalari QNAPCrypt (aka eCh0raix) ransomware tomonidan buzib kirilgan.
Keyin, 2021-yil avgust oyida Synology StealthWorker deb nomlangan zararli dastur oilasi tomonidan boshqariladigan qo'pol kuch hujumlari haqida ogohlantirgan, bu ransomware infektsiyalariga olib kelgan.
"Bu hujumlar allaqachon zararlangan qurilmalar sonidan foydalanib umumiy ma'muriy ma'lumotlarni taxmin qilishga harakat qiladi va muvaffaqiyatli bo'lsa, tizimga kirib o'zining zararli yukini o'rnatadi, bu ransomware'ni o'z ichiga olishi mumkin," deb aytgan u o'sha paytda. "Zararlangan qurilmalar boshqa Linux asosidagi qurilmalarga, jumladan Synology NAS'ga qo'shimcha hujumlar amalga oshirishi mumkin."
O'sha oyda Palo Alto Networks Unit 42 ham NAS qurilmalarini nishonga olgan eCh0raix variantining tafsilotlarini oshkor qilgan, bu QNAP va Synology'dan CVE-2021-28799 kabi zaifliklardan foydalanib yoki keng tarqalgan ma'muriy ma'lumotlardan foydalanib qo'pol kuch bilan kirib olgan.
"Synology zaif versiyalarni ishlatayotgan barcha foydalanuvchilarni o'z tizimlarini himoya qilish uchun DSMni darhol yangilashga qat'iy chaqiradi," deb aytdi kompaniya. "Synology shuningdek, DSMni doimo yangilab turish uchun avtomatik yangilanishlarni yoqishni tavsiya qiladi."
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.
The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.
"These attacks aim to encrypt data and extort ransom," it said in a statement released last week.
While Synology did not disclose the exact security flaw that's being exploited in these attacks, the company linked to a November 2024 security advisory that listed three vulnerabilities -
- CVE-2024-10441 (CVSS score: 9.8) - An improper encoding or escaping of output vulnerability in the system plugin daemon of DSM that could lead to remote code execution via unspecified vectors.
- CVE-2024-50629 (CVSS score: 5.3) - An improper encoding or escaping of output vulnerability in the webapi component of DSM that could allow remote attackers to read limited files via unspecified vectors.
- CVE-2024-10445 (CVSS score: 4.3) - An improper certificate validation vulnerability in the update functionality in DSM that could allow remote attackers to write limited files via unspecified vectors.
The issues were addressed in the following versions -
- DSM 7.2.2 - Upgrade to 7.2.2-72806-1 or above
- DSM 7.2.1 - Upgrade to 7.2.1-69057-6 or above
- DSM 7.2 - Upgrade to 7.2-64570-4 or above
- DSM 7.1 - Upgrade to 7.1.1-42962-7 or above
- DSM 6.2 - Upgrade to 6.2.4-25556-8 or above
The development comes amid reports from customers that their Synology devices have been hit by C3RB3R ransomware, which has been observed locking users' files with a ".L0CK3D" extension.
This is not the first time NAS devices have been the target of ransomware attacks. In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (aka eCh0raix) ransomware.
Then, in August 2021, Synology warned of brute-force attacks driven by a malware family called StealthWorker that led to ransomware infections.
"These attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware," it said at the time. "Devices infected may carry out additional attacks on other Linux-based devices, including Synology NAS."
That same month, Palo Alto Networks Unit 42 also disclosed details of an eCh0raix variant targeting NAS devices from both QNAP and Synology by leveraging vulnerabilities like CVE-2021-28799 or brute-force their way in by making use of commonly used administrative credentials.
"Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems," the company said. "Synology also recommends enabling automatic updates to keep DSM up to date at all times."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.