Is it safe to reach our office NAS from the internet?

What is a NAS?

QNAP Photo Station Externally Controlled Reference Vulnerability 2022-09-08 Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.

A network-attached storage (NAS) box, from makers such as QNAP, holds shared files and backups in the office. Many are set up so staff can reach them from home.

Why does it matter?

DeadBolt has been widely targeting all NAS exposed to the Internet without any protection and encrypting users' data for Bitcoin ransom.

On 26 January 2022 QNAP said DeadBolt has been widely targeting all NAS exposed to the Internet without any protection and encrypting users' data for ransom.

CISA lists a QNAP Photo Station flaw on internet-exposed NAS devices that was used in a DeadBolt campaign. CISA added it to its catalog on 8 September 2022.

A NAS often holds the backups too, so one attack can take both the files and the copy.

What do I do about it?

Step 1: Disable the Port Forwarding function of the router

1. Turn off port forwarding to the NAS in your router settings, as QNAP advises.
2. Turn off UPnP on the router and on the NAS.
3. Update the NAS operating system and its apps.
4. Keep at least one backup that is not on the NAS and not always connected.